84ea6b01750e756639ed60d0ad89f9fe2972d49010b3c558dfb1603aa56da991

Analysis

user interaction
yes
max time kernel
481s
max time network
482s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
imgoinginsane.7z
Size 100KB
Sample260818-ppvbbssdla
SHA256 84ea6b01750e756639ed60d0ad89f9fe2972d49010b3c558dfb1603aa56da991
MD5 e69f4e4772f764cc2d49f7856283c319
SHA1 f3292195b1b074245c5c58e5d6f553555d4493be
SHA512 fdfd1ac768ee6da0eb64e8c77fc828b5e842dc8491b6de2bf68edcd54b1f5f4a7b6aa8c4271ac04288739441684a255e7b74644b39d769ffc8744d0dc015f88c
SSDEEP 1536:eYTC73d5Wj5L5imWbEOkMZ9hku0NIzNH8OuTWBXgJu/G8eli+iyj/:zB9LQmWb59hf0NIBHpuShGaUiyj/
TLSH
T105A31282B6A7473C73168200E436B6FF43A889378061F58FF614F5699BE4CEB243C252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
280	2792	chrome.exe
309	2792	chrome.exe

Sets service image path in registry 3 TTPs 3 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CLXlNrwylcpEgCcgvxXJZ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\CLXlNrwylcpEgCcgvxXJZ"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\XWUgeYWPIqFODEaKxugeBI\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\XWUgeYWPIqFODEaKxugeBI"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\irWYJROAYXcLDcxoPHc\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\irWYJROAYXcLDcxoPHc"	mapper.exe

Executes dropped EXE 11 IoCs

pid	Process
2988	injector.exe
5044	mapper.exe
4272	mapper.exe
6936	injector.exe
4292	RobloxPlayerInstaller.exe
400	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe
6944	injector.exe
3664	mapper.exe
4216	mapper.exe
6836	mapper.exe

Loads dropped DLL 2 IoCs

pid	Process
400	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
400	RobloxPlayerBeta.exe
400	RobloxPlayerBeta.exe
400	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\families\Balthazar.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\textures\water\normal_03.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Input\TouchControlsSheetV2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\Players\Unmuted-White.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\InGameMenu\game_tiles_background_desktop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio_6x6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\smallTriangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Emotes\ErrorIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\BuilderSans-Medium.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\shaders\shaders_vulkan_desktop.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\New\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\Arimo-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\families\BuilderExtended.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\LegacyRbxGui\ComboBoxArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\MenuBar\arrow_down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\zekton_rg.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\DeviceEmulator\sim_rotate.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\RobuxIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\Radial\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\models\Thumbnails\MakeupEnvironment.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\textures\water\normal_06.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\PathEditor\Control_Point_Selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\preview_expand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-pending.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\Fondamento-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\sky\clouds-bc4.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\terrain\materials.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\LegacyRbxGui\health_greenBar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\TopBar\chatOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\configs\DateTimeLocaleConfigs\en-ca.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\avatar\abilities\AbilityManagerActor.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarToolsShared\RoundedBorderRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\loading\robloxTiltRed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\PlayStationController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\Help.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315299735662101"	chrome.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-d679641ad17741aa"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{02455AA0-DD83-488C-BBA2-D8920BEE2262}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ddf602d9cfe44005"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ddf602d9cfe44005"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2988	injector.exe
2988	injector.exe
5044	mapper.exe
5044	mapper.exe
4272	mapper.exe
4272	mapper.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
6936	injector.exe
6936	injector.exe
4696	chrome.exe
4696	chrome.exe
4292	RobloxPlayerInstaller.exe
4292	RobloxPlayerInstaller.exe
400	RobloxPlayerBeta.exe
6416	RobloxPlayerBeta.exe
6944	injector.exe
6944	injector.exe
3664	mapper.exe
3664	mapper.exe
4216	mapper.exe
4216	mapper.exe
6836	mapper.exe
6836	mapper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	7zFM.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
4272	mapper.exe
3664	mapper.exe
6836	mapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4200	7zFM.exe
Token: 35	4200	7zFM.exe
Token: SeSecurityPrivilege	4200	7zFM.exe
Token: SeDebugPrivilege	4272	mapper.exe
Token: SeLoadDriverPrivilege	4272	mapper.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4200	7zFM.exe
4200	7zFM.exe
4200	7zFM.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
4292	RobloxPlayerInstaller.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	injector.exe
5044	mapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4272	3816	cmd.exe	113
PID 2240 wrote to memory of 952	2240	chrome.exe	115
PID 2240 wrote to memory of 4688	2240	chrome.exe	116
PID 2240 wrote to memory of 2792	2240	chrome.exe	117
PID 2240 wrote to memory of 4688	2240	chrome.exe	116
PID 2240 wrote to memory of 2864	2240	chrome.exe	120
PID 2240 wrote to memory of 2864	2240	chrome.exe	120
PID 2240 wrote to memory of 2044	2240	chrome.exe	119
PID 2240 wrote to memory of 2044	2240	chrome.exe	119
PID 2240 wrote to memory of 3508	2240	chrome.exe	121
PID 2240 wrote to memory of 3508	2240	chrome.exe	121
PID 2240 wrote to memory of 4704	2240	chrome.exe	122
PID 2240 wrote to memory of 4704	2240	chrome.exe	122
PID 2240 wrote to memory of 3704	2240	chrome.exe	123
PID 2240 wrote to memory of 3704	2240	chrome.exe	123
PID 2240 wrote to memory of 3856	2240	chrome.exe	124
PID 2240 wrote to memory of 3856	2240	chrome.exe	124
PID 2240 wrote to memory of 3264	2240	chrome.exe	126
PID 2240 wrote to memory of 1484	2240	chrome.exe	129
PID 2240 wrote to memory of 1484	2240	chrome.exe	129
PID 2240 wrote to memory of 744	2240	chrome.exe	130
PID 2240 wrote to memory of 744	2240	chrome.exe	130
PID 2240 wrote to memory of 5324	2240	chrome.exe	131
PID 2240 wrote to memory of 5332	2240	chrome.exe	132
PID 2240 wrote to memory of 5340	2240	chrome.exe	133
PID 2240 wrote to memory of 5708	2240	chrome.exe	134
PID 3816 wrote to memory of 6936	3816	cmd.exe	140
PID 2240 wrote to memory of 6964	2240	chrome.exe	141
PID 2240 wrote to memory of 6964	2240	chrome.exe	141
PID 2240 wrote to memory of 7136	2240	chrome.exe	142
PID 2240 wrote to memory of 4292	2240	chrome.exe	143
PID 2240 wrote to memory of 4696	2240	chrome.exe	147
PID 4292 wrote to memory of 400	4292	RobloxPlayerInstaller.exe	148
PID 2240 wrote to memory of 6508	2240	chrome.exe	157
PID 2240 wrote to memory of 6508	2240	chrome.exe	157
PID 2240 wrote to memory of 6596	2240	chrome.exe	158
PID 2240 wrote to memory of 6596	2240	chrome.exe	158
PID 2240 wrote to memory of 6628	2240	chrome.exe	159
PID 2240 wrote to memory of 6628	2240	chrome.exe	159
PID 2240 wrote to memory of 6780	2240	chrome.exe	160
PID 2240 wrote to memory of 6780	2240	chrome.exe	160
PID 2240 wrote to memory of 5556	2240	chrome.exe	161
PID 2240 wrote to memory of 5556	2240	chrome.exe	161
PID 2240 wrote to memory of 5376	2240	chrome.exe	162
PID 2240 wrote to memory of 5376	2240	chrome.exe	162
PID 2240 wrote to memory of 4776	2240	chrome.exe	163
PID 2240 wrote to memory of 4776	2240	chrome.exe	163
PID 2240 wrote to memory of 4180	2240	chrome.exe	164
PID 2240 wrote to memory of 4180	2240	chrome.exe	164
PID 2240 wrote to memory of 5572	2240	chrome.exe	165
PID 2240 wrote to memory of 5572	2240	chrome.exe	165
PID 2240 wrote to memory of 1760	2240	chrome.exe	166
PID 2240 wrote to memory of 6444	2240	chrome.exe	167
PID 2240 wrote to memory of 6444	2240	chrome.exe	167
PID 2240 wrote to memory of 5776	2240	chrome.exe	168
PID 2240 wrote to memory of 5776	2240	chrome.exe	168
PID 2240 wrote to memory of 5644	2240	chrome.exe	169
PID 2240 wrote to memory of 5644	2240	chrome.exe	169
PID 2240 wrote to memory of 6592	2240	chrome.exe	170
PID 2240 wrote to memory of 6592	2240	chrome.exe	170
PID 2240 wrote to memory of 3644	2240	chrome.exe	171
PID 2240 wrote to memory of 3644	2240	chrome.exe	171
PID 3816 wrote to memory of 6944	3816	cmd.exe	172
PID 3816 wrote to memory of 3664	3816	cmd.exe	173

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\imgoinginsane.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\injector.exe
"C:\Users\Admin\AppData\Local\Temp\injector.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2988

C:\Users\Admin\AppData\Local\Temp\mapper.exe
"C:\Users\Admin\AppData\Local\Temp\mapper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" .
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\mapper.exe
  mapper.exe imgoinginsane.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\injector.exe
  injector.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\injector.exe
  injector.exe Namz.dll
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6944
- C:\Users\Admin\AppData\Local\Temp\mapper.exe
  mapper.exe imgoinginsane.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\mapper.exe
  mapper.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\mapper.exe
  mapper.exe --free imgoinginsane.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:6836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0x11c,0x120,0x118,0x124,0x7ffb70d5c728,0x7ffb70d5c734,0x7ffb70d5c740
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,13613528275360594855,12550528283534562492,262144 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,2981066317339478240,13042463804153848883,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,125702429871415313,17324890008885489593,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,6753885289941777867,10337969059668707120,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,4047829953027865197,3240396821699253987,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2460,i,13072832104868994025,550009864683094832,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,17747184009160378461,8341461989255922159,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,1370214905873741917,6697399733660871511,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,6780985245182756686,16091195482850452946,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3672,i,10013662895104006127,1541842572651806077,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3512,i,1471932733165537954,10063955322955639186,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6429433823690372753,12488039674243455815,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,2019916705741225727,4706141462793720933,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,6270420763289230472,14050006226793345911,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,13587865586639127703,4538698253539616810,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6532,i,2506781995195083365,13912366551103584821,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,6761031371136758099,1869081287154460904,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:7136
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4292
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1204,i,1543440740068906734,4227086885132810808,262144 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,15913242098117004900,5177546751839377267,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:6508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5796,i,1292313778872605077,18366217149986655316,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6644,i,6977800345526013975,5505185821344122591,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7240,i,6384533872432816432,14542707598956200400,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7460,i,761561197737570357,3100238779894599217,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7328,i,780582014255069734,11694204301547594366,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7376,i,6331129631285535036,10958297711402985076,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6552,i,624099014907073171,1068965207191858216,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7508,i,17686213055677915401,4619235910546128507,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7480,i,7274094505352753348,11504459327717593659,524288 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6524,i,9181423278326843658,14979858370145086505,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7728,i,17361277010082347665,8422602110835852352,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7412,i,6686620177142959061,1285487718577161643,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8040,i,4501964952814008023,11103555635544802137,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:6592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7472,i,1412540379999073073,11529773830516482124,2097152 --field-trial-handle=2064,i,6968070796444162397,16935609645330202105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:3644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4680

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 f2f9ad7aba372d43ca50ee83601d00d1701321edb932a6c31c5ba67d96c107f4
MD5 a2b255c734df85929ce2d1e2e749fffd
SHA1 af83105488e39ef51738fbdd7e5f2c5592c5cbff
SHA512 07d841881202c07d6c2cc7e095955afbd3ca5a4f3184323d24a7a135432b7cb0de3caccff88b313c745d74aa3f13c833b1e35e3275242ecf0c300984c563637c
SSDEEP 196608:6OooX5s0KmLj56WsdmsxZOdr3EV1MbU7H73Zv7Y4N:60KNdmsxZOJ3EV1CU7H7NN
TLSH
T1CBA6B022B900C032E4D100B296BDAFFA997D99341B3954D3A7D45DBD5A305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 7e411ae89687e566d366f56ecc5efe7836d0716b33aba66bd6aed27777374f91
MD5 5128fd95566b86fdd27eeecc48a2143a
SHA1 9f678f840e1d04e1f4d002f1b9f73b81696a4982
SHA512 d56bdfd09d2ab46b27328c59973d8e9409c81bdd7d04df9a1471fd6e1758e828fcba7de386340b4d3ef2130520a6b8e0bc715d98a01a1316baef1d84d535eb13
SSDEEP 196608:s0XjFT+k2vokETkwPZ+t5SulHmbuRwkMk6ZHQk+ZX:sgxTb2NE9PZ+6ImbUwjxZ+Z
TLSH
T18127CF4EB5D60AE4D5A24070E05F57D3E622304C0AA92EF787D902613A7378EA95CF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6c3029a92bc7996102957479b3b557e984b405fad0f76f2d30833c71f6fbcde2
MD5 ab376a924a9cef86a9b3a33102d1d0ca
SHA1 a25acf3b3da1a05cb7b96e9d91415a57c043ac6b
SHA512 ecbaed8a7c22f4061e437abfd6f170d6c9217a701a6707584a6de31852291e632a17016ebfbb5acdedba3c902cf2b53b7b4db2beaeb3661c602c45cb1615bb17
TLSH
T125E02B96CC21AD372CFD4B1851914B45EB5553162A804A1F3A3CC20C8FB162A459AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032
Size 27KB
SHA256 e27d21b448103c0d74b2e35514094cc6648a0bf0c3f2460a5549de7b91658c21
MD5 b4f1b666f295d933b1d1871917079b4d
SHA1 37f8c5eb7178bdb3ac0a9fa1a0046df0f87fb350
SHA512 d37a8c0b446a9c13a8da6eb92cb8a3faabe5b381af880dfa918d0d3b278bf8d4b0ad35838ee5e67434c04965f0ad76b925b0aee3a89a571d91a95de7e8ae384c
SSDEEP 768:pORc+/DPgyGAfuK8lCUn86Bk+O9yMo2r7BcfO0wqwO:pYc+/DKA2K8lCU86Bk+O93o2/oO0Zt
TLSH
T168C2E1046C8511C15C9BD689B3B5A1D6E7CEADEEBD0021B14AEF4436D28B3205F8E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 29KB
SHA256 a6044d68684e8c767e67fa1079c26892fb553cf23ea4bee3d62757576eea5e43
MD5 2d85bf82aefe94d185938754595d46d6
SHA1 bd017a33f2147d0e441e8e6c5b0d16b9104a73c7
SHA512 93e3ce4ceeec110ba61fd7c55450879871d20615456cff77cd535ca29a8414db1e820e2a3b467914ff6b4a13cd39b12fba07b0236aea954d7085f29bdc2ba8ee
SSDEEP 768:l40s+zM333pPTS+nnUxjPQ/GMxjNCFnXw6et:l4gzM333pLUNPQMZI
TLSH
T162D2E1119FF075671CE210D2F32C93425CF8AE9E6F5A99825132F8085BD2FC6A46761F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 22KB
SHA256 a14f0cff05f283ecc9ea6513400685c0d46ed8814537769216ae106398264766
MD5 d7fe3851922df245727597388a99948a
SHA1 80ffb83338c8a723b4e11b8821458ddbb0fe0170
SHA512 c922c50be7d7a7b58fad19ac3be0de1c8767b054850057459bff7886fe808d370ca955c69d6ba14f73872108727e37e4b99f67cc96a1faed9c06b8f82fdd00b5
SSDEEP 384:v6yq5FmplnwrX4/XqcwqzUGftdyK+B3lMzaofZIhmff4yGVg0Tp+fUnHkPh2itcj:E5FawuqRjGfrUVlSPfihmff4zVg0Tp+y
TLSH
T14BA2E176C9F64870C3D7845DA123864CC8D3601696B02D7EE1747ACF84A0EE8C6E1AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 104KB
SHA256 495e17ceb16db5cfaa2a74b9d7c2b719bfaa50a92f38512bbb29ee62295a8586
MD5 58c8135e9e1779350abd69e907c3b964
SHA1 2cafd043661fae52241304559cd6d3ab68f14bf7
SHA512 0eaef2d731a69a317ef8f68f140b1b2ec6d04714598e81952938b16ae69b37e57f0c77dedaf89586a0acbee363ff03e91ceb51c46fd8e474b37e78b5c51aec4d
SSDEEP 1536:Nozd7HYd9e8g7cMFG8riSvLGDAvi63aeLHu5yvsj2/cUxRbincRpU53T3:o7HYdi7vGe3GkVDTLUEpU53T3
TLSH
T100A3126475E5C324E3EDC303B4B16C321C5B100FD9B394A1A99A0EF5E92A7F5308DB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00012e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00012e
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b75535c46ee56ffc84c91cf417ca25d24e4d016bcc05e885d7726358c1abc032
MD5 9dea49c70b965dcfb33612bbc5743be1
SHA1 d27ba101cbd231ae11c2e5f6e4ff464b5458ac18
SHA512 97a0fa0c65598ed606eeefb877ce93f82dccdf9d6d00d97b63801acaef799ff3f6eb4c277d7d1e55587a2f0742f54cf9bc326ebbfa8ec54114f4b554da805e79
SSDEEP 48:fsNOUUGizWDF3qYEQAgB7oOr7lMfWMjuLYJAbRGP5owV2tuWWXAXZz+ti7tdaGfb:XUUsD1A4lif/jIzGBPQXIt6trffzv
TLSH
T1EDA1B716A0EEBE02CFB929F01DB91D79A83C99A315966BAF05444CFBA4037F43311165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 97ab070bff844e2b577e98b6c5837cd9250676a6ff0e8a056ca7ca2672011e46
MD5 9449abe7ccd58dbef32949970336b60a
SHA1 f81e4ff7b182908eed09a1e85ceb4edabca7488e
SHA512 76c220c4a28ccac09800c6950953e963b58cfbb709f7d38db8fe8e47c39b3f1d21ff02c33e2a0084efbb3d1f922228bd88ea3125110dee48a333f4d883a081ed
SSDEEP 96:FjUzw1f4yRAOO4gkLRMT4oIGlGTvQAbXz9Pnm+HmtVtA5GTaaw4zSV:FjUg4yKO1LRYIGwTHbXzB1m/oGTzw4SV
TLSH
T170F12C0AA9FEB991CFA46DF019E40D29BAB8499301933F9F07414CFAA63B7F4E700051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_limewire.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 88KB
SHA256 d59277bb14e1b87c0b6e16e5eec9cdeceffd27a6c182e95495a0e3a67f0c474f
MD5 bdc8a8a37a685cbbea50abc123a93eeb
SHA1 87f8a8c6a1af5dfd15eddfab4dee5424c16abe3b
SHA512 da560a6baf546ba5e012d6b4df693f32bf134696b0902b8b2f3fbaf324b87ba6f17eb68ee6718fef20f332f24c7700d66d3e74159916ae3df22c7f82ba9fc4ed
SSDEEP 1536:NLM1S/K4sfpfgKVL7ak2kuUTVBg4uYBWF2kTBa+Fnyjh0ohqxLHDbeSltY9RQaDJ:JM1S/K4sfpfgKVL7ak2kuUTVBg4uYBWe
TLSH
T149938F1767D098A9C0B5007BCA11CBFE8B856AC53E97532FE1D073FEE8314A62D29167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 2acf2224a1a70d0074bdf6d218eff8c8d0345ecbcfb268cb34c5e1865b30a539
MD5 3fb0b8357a9b4df900320028d7fc3d08
SHA1 4cd4f747ccf26671da78b9e0f6b8b37f1c38ee2d
SHA512 ee0718d5cc3bfe906d462eb4f410ad627f6d1f418a7240d29110420a3ad13575a4a9066c35105c4d0b1e329b6128aba728f52c6195c16a678791913705420648
TLSH
T1C831A922CBDD843AD5450B3785EB42FE87F2B7C876528B8676B067190D115071DF335A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 675B
SHA256 36d069b8951695313cc37fe584d030a4514f9d9ad7a60a865a52e83e0d80481f
MD5 5574e78fa572065b0810aa71e9d77e83
SHA1 dc7fce181fae167ed943954412ed7c2dd44fcb53
SHA512 f548b741feba1b076a5c58edae0f63eb7fba41fee953f829e2859da406b7eec924eda2b6cc50d7fbcfd0b20439b77cedbf930abe2e211b304f6b0d2a7efd5a75
TLSH
T1380194E756C687A91CC1C263FA6F3307C9D6D16C968DFB565FD0F96E19C00085426161
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 c0b4d5ddcbc3009a1317160622f37f5aeb2644c91835abc4a6706f5a9c0c4837
MD5 dc402aa3615b73cc4130372d1bf48fde
SHA1 780ad9cf0ac5086f8cb33dbf913f490de8bd9937
SHA512 cc99965fc96e1783b0aeb6faf354aa954754320b63527a3323ca440e268a5b18166ba8eb6b70fc7f28099d0ceeea1e6e49179f2ef5b2e006c6d57a9d346e6069
TLSH
T154B012308BD20856D061553C96BF41C4C95550A0B243D726211C802C04129004D59606
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ee1046892758aabc841b32589bc0aec361a009ba84c8e20391c58074fc267e1
MD5 475d2f662e023709898164f78ac59af6
SHA1 16b2d60df47943b160d9e03d01d3c197c9a21e14
SHA512 cb3506cf2e83f1f03bbf600c4a7cb80c217a02e85d6744edb09db74e0f16175ffbfdcaa2854fb8e4c169816fdaa18833760edaf4cdf53afb7db026deeaa6573a
TLSH
T178416BF3C7D8897D894156F4AB156E1FCE690E14536C3C5AC8D8AE4F53E28B2D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 528e6ebac31dc53ece7bab3f0f24e3261f688ab2eb09ddf994b560be7fc6ee9c
MD5 fe52cb9d1bbfb931d606333f319017b8
SHA1 bad027b26ca96a07d1fb3f3bdcda4cac7d2416e1
SHA512 491aebb222afcfee2b3221655d9ccd8213fab25d08378041ee6b7dfe3f570c31f06a0f96e2281c20b1274146a8d118a8b16d221a93d4dc0eba8eccecbdf92b8e
SSDEEP 384:DZQg15p346lPis2Jw8lNeL+Vhf9aIaEdhlj8yIvPXI+a9kHnQZP8qgWRX1JtMGVM:kPRU
TLSH
T1D972B8F7C3E9CA2C991252F09B19AD1ACE5D0924031C387AC9E4BF5B93E3171E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 17bc27200d8f211c7b84285149f2ca80b19593261062146963189762223f0b3d
MD5 05f7cfd5401a88aafcd1d2f66309ce20
SHA1 0162e320a35f49b829943eef59927b5bbaa30215
SHA512 2de90e12ca1d52bee6292e5d40147f19ebacec342a7551557537f8b979228ff7210521ef3c9d5d13fb376a26cf0c31fb0233bc485f6317f40daf98d625653580
SSDEEP 384:D/lWthx63XKnw1HbGnfsZBSS9S11EhQF20BJIJJ2PVeECG6BeBO8HJQJ9aIa9Xnw:M+vUSh9XhqIANhQxCKrLj
TLSH
T181C26AF783E58A6DD91252F0AA196E1FCE290924431C3C76C9E4BF5B93E2471E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 b3b2860c5b19faa50c02b4aee9f88521d2b08c70e0753c33a74bd7907e421291
MD5 44a898e92e6a82b7f429bfd1080dbee3
SHA1 32550c522a446f757d3fffc7aa64aabdfc4dbdc9
SHA512 856589c9c243c2e679c0c435280516d0a58736b102521adaa9fe950a0b82a396c85b59546fc1205de3a19928c4e7d7a391740694959cedbab34063655333bfc9
SSDEEP 384:D/lWthx63XKnw1Hw8lNeL+VhfEYiFhQF20BJIJJ2PVeECG6BeBO8HJQJ8aIa9Xnc:p+vUS7xXhqqANhTxIKrLn
TLSH
T15FD27AF783E58A2DD91252F0AA196E1FCE190924431C3C7AC9E4BF5B93E2471E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 0edad5496205e4d4b0d1940890f250fcadf715d98250288f76076fa327c9901d
MD5 2d99c354b29a85e1aea978a488ff5e99
SHA1 240ffc7ad35cf86af2921a6330d070d5fb251fcf
SHA512 df60c2dba2fb6a0308b75eb6c00e407df6280d8b3f443892084ad263cb0ec027c6f5ff49a92b9b4e0c6094cc35fe57840a9341fe27590b8daffac8fe687a4758
SSDEEP 192:mAUZUaU+U42kUxUUUBIUUURJUI/UPoURUZyUmWnUKUcUDC/URUzUydURU8JUNzUD:tOBPladuI9aTTGzTIvxF/SkzdE72zO+C
TLSH
T14CE19EAFD57FB41B10B8497B1E45FC0929B9A436129268F4CF67D23DB0858F31B32466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f22f2ef2bb6fa87df701b15b319357c67087fd815a186e9c187e48c638d156c4
MD5 a78eff3b8f235569a7356eab94cdd53c
SHA1 e0dc6cf0928a3ddeccd0ebe73e0f0fc30a17103d
SHA512 2563357e653a77525fe3924c16c23c7c782007fbc9386580c66ba8cda11dd5353dfa4c4a7c964b04dd6b57b6d1727636be9bd5268614191490b279bdf22c0310
SSDEEP 192:mRp0cBzwLnjseyv7dpYPRpQHuX095Hsb+WNQ48S+4mS0rHSp2QxeX3awXbRt8yI6:mRemzOFexYX0rwD+g0up2Ja4bAe
TLSH
T1D062D71FB8106A775CDAE319F9257B67E7F6102121D42E84EBFC896C14EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5918bdb63aeb1c3c9feb60e58a30e9c13185a1d443926a69ceca64fafedd7acc
MD5 b07f2f422efa38f4ebd1574a4073be66
SHA1 f8302a039f752f021d0cd95b5073ef1f2ef75a04
SHA512 0a0c929083d237ec4c1c5e3dd395fb777119e4330f7054071f6a5f22688d6b9a7ca0c23c2d9dbe0bc79a6fe53d541a8c7f896223f639c51c56eef7ec995db713
SSDEEP 192:mRfwLnjse8v7hpAPRp2Hk895Hsb+WNn8S+48Se2IxeX3awNbRtVyIsnAUgtaJ:mRfOFo9UXorwB+me2hakbl8
TLSH
T12C52D72EB910B53B5CDAD319FA257757D7F6142121D02E84EBFC896C14EBACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 60ff63a404a7d9f6bbd4a1dafe037f09cdfc8ec5743be08dcb6e266c1d3ad237
MD5 70ca09f8115d64e46616730b26268fe7
SHA1 d43982cda8a8066e6846ef45f33027733c85d4ef
SHA512 172c3e2b4fa114381db6a65005c350683f913a4a4f79f1ba1d05671a6c1683dc386087d3b24f6b851aaa8a24590c11c3a385df0b3647b7e3d4b383f073a8ea5d
SSDEEP 192:mRjcBzwLnjse8v7hpAPRp2HuXs95Hsb+WNQ48S+4mS0e+xeX3awNbRtVyIsnAUg8:mRjmzOFo9UXurwD+g0ePakbl8
TLSH
T1C352D62EB910797B5CDAD319F9267B57D7F6102120D02E84EBFC896C14EBACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4d1ab0688f05ff96334b027c67271987ad761425ae08aea7fc5008bc7cd964ff
MD5 a3c77649b4b6f1eee0af91b5051190e3
SHA1 446078e59010951e63dbb79226e68c63e3f0d2f6
SHA512 c25d97eac2b17395eee0923456ffcf1426481eab91afca56cc71c8f2aa24a041de7a727d25ef5e95535ddbef951a0139b48bf4ff42563e813525605c87ad38e0
SSDEEP 192:mRp0cBzwLnjsejv7dpAPRpVHuXs95Hsb+WNQ48S+4mS0rHSp25xeX3awjbRt8yI6:mRemzOFbxUX5rwD+g0up2oa6bAe
TLSH
T18052D81FB8106A7B5CDAD319F9257757D7F6106120D42E84EAFC8D6C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a9b63f24ec86682d37416b28f606d7f38848338d2a506721d16dc727e7f1246a
MD5 8e1d7dc6b218e4bff16402f7e35843f1
SHA1 c8305b436a5d7a45f90a1ee5b9e91e7416e1aef2
SHA512 6cb0df8364928d0cd54efe4f8aed72c8053408e3e277449a10a0cbb26b75fa0cc3d5eb6d8883f79ea907b767e4cd99616dbab969792582c1dd945e1b6e5d021a
SSDEEP 192:qRp0cBzDLnjsYWv7dpYPRpQHuXe95Hsb+WNQ46KBmS0r4fWRxeX3awXbRt8yIsnB:qRemz37ixYXerwd50EWAa4bAe
TLSH
T12762D71FB810697B5CDAE319F9267B67E7F6102121E41E84EBFC896C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6cc9265812239f2d0db840dad4cda601bb523c9a7cfaa0241b5db3f663e45cf2
MD5 de608fa057cc8e3f7c5a43ff4b810fcf
SHA1 a1ded5c6991a9318a91af3122fbf1a24fa563a52
SHA512 9e998e82b22c892b82f62f68abc6e6a32019013ad4c7a12526d1d2f4b3932befb98d64d58b656abdc36c547dba2077c644165f53639696823432d879db50ef91
SSDEEP 192:NRp0cBzDLnjsfWv7dpYPRpQHxqe95Hsb+WNQ4154gcd4fWHxeX3awXbRt8yIsnAq:NRemz3kixYX0rw5oGWGa4bAe
TLSH
T10062C61FB810697B5DDBE219FA267B57E7F6102120A41E84EBFC896C14E7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 34588262c58e4da6d2397d9aeb1e68c2f5660760ae99d9c0c239d311752ad527
MD5 8379aae3b5c9e64ab55b098d4049a387
SHA1 67c286f1d0ce26648b1b6b34c597e169b6b6d1d7
SHA512 be329f68461e9db5df4ae954907196949f5164e32dcb2e5cf867129e141fbb3da8436ba2d913fef932692ee96606e7c5e8a5a95b0e6388f307c5ba6de709e713
SSDEEP 192:NRp0cBziLnjssWv7dpYPRpQHxUXe95Hsb+WNQ415Ueu+gcd4fWtxeX3awXbRt8yr:NRemzcrixYXmrw5MqGW8a4bAe
TLSH
T10862C61BB8106A775DDAE219FE257767E7F6102220A41E84EBFC896C14E7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 832606d44c514c0a2d954798422160b2058868dec2fffcf5797a3346ef54bdbf
MD5 7f1354d8c6136de9dd079cac157c678b
SHA1 f03932c4a96da09e7cf738177e93e2a2255a8946
SHA512 591cfe86aa9fae1f983739293b41459f642a0385377ced456dd3a6ba1ef912166b907bf6d321d4fca77c49202a3c0810d09af6b6564c1c163ae8be0ed554c894
SSDEEP 192:mRp0cBzALnjsePv7dpYPRpQHuXe95Hsb+WNQ48S+4mS0rYmofxeX3awXbRt8yIsB:mRemzeFHxYXerwD+g0ro+a4bAe
TLSH
T1B062D71FB810693B9DDAE319F9257B67E7F6202120D41E84EAFC8D6C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3320f7e41fb52362df3eaf65cdd51fdd23cfdbba173b6ac5cee4abb9d98fbdec
MD5 bdc46480c4b6cc07f783a6f7a6ef21ae
SHA1 15543b2db3c6d51d884c2124b3a3c2f35b2a82bb
SHA512 565870cea7ccd3b70158eae0fbc71409c9ac4e68f4ec0e30a0b9c44d0d6c8b2391958c49f9c9e57079edd00ab0efd5283aa7a4b25d6c13785565f39afee9ab53
SSDEEP 192:mRp0cBzDLnjsewv7dpYPRpQHuXe95Hsb+WNQ48S+4mS0rO98dxeX3awXbRt8yIsB:mRemz3FsxYXerwD+g0M8Ma4bAe
TLSH
T11662D71FB81069779CDAE319F9257B57E7F6202120D42E84EBFC896C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9e00b938d51c5ef5fcbe2158b85e7c30578c692475cb9f446c8c6ad418994b39
MD5 2ea9da33b41b2efedab552b45245b370
SHA1 1f82029d4bae78b872ee55eee53751e9f1b8c943
SHA512 3dba6942fb86339001fc42161b899d2a8c6832fda0a773e56fba77108d217cca17c4d7583b56d4b541ced50235135efa3cbcf77fe5064f4b0de4372ab474a385
SSDEEP 192:qRp0cBzDLnjsyWv7dpYPRpQHuXe95Hsb+WNQ46KBmS0r4fWRxeX3awXbRt8yIsnB:qRemz31ixYXerwd50EWAa4bAe
TLSH
T18462D71FB810697B5CDAE319F9267B67E7F6102121E41E84EBFC896C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9716825202389c6b044c3e639e0150af50bd4ccafde32ab68a0056cd5c4b24c8
MD5 2c0eead6527db943e15cf43cf4d2dcaf
SHA1 ec53b748874eaef5dfa94fb1c07cf65485cd8301
SHA512 a53f0e1733bca3c36e9b930034f769c4fd93ed698f198d864bb709feb698175597d3f068e7b4b26fefc94fcd576ab88b435537308360a3bfcb5bb6396e6fdeff
SSDEEP 192:NRp0cBziLnjssxv7dpYPRpQHxUXe95Hsb+WNQ415U0aWgcd4fWzxeX3awXbRt8yr:NRemzcrhxYXmrw5yyGWia4bAe
TLSH
T1B462D61BB8106A775DDBE219F9257767E7F6102220E41E84EBFC896C14E7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6a3fc9ab6eec4fb3293a0ffd9d15ba0d4ffadcf6c29a87f07a6caa031ed7cad8
MD5 2835f157861bf2092ba5d2203d14ce27
SHA1 06fae44f6f727d68fe4f084a9d8ee8836b4e78b7
SHA512 c3c07cfaa34cc4fb3fbf2f8c6f23ef0261780616a74fd57c97bc22b972549d42e230c183431c07ac3276cce39c7c4bbd30f625e40233c05e56b2c39654d52a90
TLSH
T11DB0120080029541D15203B4359264C87298AF14960F1B0163E0A932C829571C018060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 3c18e95fa9494c653e4223e5c9922c7036d6e20ea2cf4c8f5a3d30db68b50cf0
MD5 65c2bdb0d116c25af6495acb24315ee7
SHA1 e35885a2677cfbf39105597feb8496466a6d2927
SHA512 465d3ab567991847fe8d61aa7133b8c1bf2222d928b0870b01ce5a397ea040fb08f9d67683a1736c42e45959274ae6fd2d11f7b6633542587ef10e008aac534a
TLSH
T164C01281C4017151C4CF03F51452A8AC76245F64CA2B239862FC2D12EC38325C115651
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e45b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e45b.TMP
Size 96B
SHA256 75cf6814c4f241c02585f9b5b9396a0cea9f45af11f8b451e14162c953a2166e
MD5 c7bfba8d7823e3ff41b2c1b782227097
SHA1 732a03cd47dd2d97738d73cd6541d55eb32b98d2
SHA512 6fd7512331f951428ba0ce447eba1040ad6f63e2c96bc35483df8340fa77b0568351be1c42cac566fd085e32d0e34da96407e95d94f795c3c804084aa37008da
TLSH
T171B02223C0022222C00303B02080C8EC3220EF20CA03220382F00EAACC222F20020820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f33f3fe83c97900f15c780080061957d04c4d099713bcbc7c25d57caaaeb7a28
MD5 c5b710bcb175a3ad4d59189d8c9a865c
SHA1 12ea4c2047ce55eea2795aafb350125d77327f97
SHA512 22c31d72540ca85bdc465a603970d2755a8602fbbe80b400da5f035bdf30c9c3f700e559fb7a5436179b244d5c4139ff6f42da3fb4b3db4222881bfd0e06dc09
TLSH
T161B002685112051EC54453B4A1C2A484B7310C6D03A7564ED09546E4F521360C667845
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 047291c4ce2ccaf3e09371bbf0e123112cba51c0346e373c10e244568ee0c679
MD5 999c337c41853b0700b9e3ed2113a712
SHA1 de404062b0477374589a9775056ecafd73e2665a
SHA512 c22ff92fb4c0623adfd9e3f4cb94589beb7b25bf3c55ac796e99ff5221fe8762e08de38a3ef7948094c7a21cc71359790960c431b32789d125a3bd20eaa70710
SSDEEP 3072:YPycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:a461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T1B6341372ABD55E321FC4C778BB630D423BF6C0DBA02CA255A7FA73BB6C819950451C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 51cc04b2243668733e8fa45d4e40f34dd04a50671b7a2f34d98c2a384840d410
MD5 8518f9b8ecf2ee14105660c49826687b
SHA1 cdef4ddfd029376ea2ca8dceac8ea284b2e477fb
SHA512 4f6d30c715fe7656be082296c10fbf5405aee67d29180f5ffa7d31f6e00b15ebb948198fd0b7f186f8f5a532892ad8512f6cf6292318941ee17a1484d00352f9
SSDEEP 1536:6gyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Hqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F9C30237EBC25F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 d82ea32fd6d9ddeee8b0fbcd3bbd797ce36474e3a406ddd230ef2c299226027f
MD5 865b79c09cfdc5f13c402641b10bc94d
SHA1 45f7a0a6e9cc025deafbe7d53fa3c1b1574e375b
SHA512 254005a2f3814dfcc44a225eec617bab0d4ab28feb871f6d21793e3fdfcd0eab952b5ec8402f4d8af1eb57c12a3d3535e8c75cfbf96db163c35e9ad40fdc9160
SSDEEP 6144:63PxN461bZ9wg20MtriHc2JqZ/ZLW3Ex3:63746r9wlqciqZ/piQ3
TLSH
T18C542373AB961E320FD8D774B6630D417FFA80DFA034A649AAFA37B77C518910422C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 8a94e9cf678c4e5885916994a166f7681e5922169bc51377f9c89f08219323d5
MD5 bb2aef6254b09a036e02ca1791766c4c
SHA1 1fc75f967d1ee156a444032dddbfd1a37f3e4730
SHA512 0de5e53a8d29fba2c5b80f2633c00cf49f6111490548486c641e6efb4ff116ea12754d658eb3c974a3b7c55923f140a453a6873dcb9075268ee5f72c103d5584
SSDEEP 3072:Voycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:Vy461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T1DB341373BBD55E321FC4C768BB630D423FF6C0DB9428A209A6FA73B76C819650852C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 3aeee4b6de283a7c83c321439648fe466357192e3635f7aba976412481ca22ad
MD5 408b15a3447decd0e5f855444270ab81
SHA1 69b03cedf99a9b3fedfaab2204e7039080858563
SHA512 eb68d2e8bd45fb3336e7f92255c80b15a98f28030655356bbc57bd4258d6cedfcc5fe820b8dde927da7cf8a31bee4fe0005f29eb6d639a7500658617a6775804
SSDEEP 3072:aoycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:ay461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T199341373BBD55E321FC4C768BB630D423FF6C0DB9428A209A6FA73B76C819650852C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 34ffbbdb2fa95fd17372f0f5fddde885cdb0e599cc0d48d86487d7b61ec14df2
MD5 ad18a2174627dcee67358303030807cb
SHA1 362ec192cd72a0ce9a85a829e1b52f379b238654
SHA512 8e2242597817afe00add4523fc275d00de9710483728a831010c33118ebc7f1cdaf9daa36f56ebcaf87f3535b1e40d691b8fce21249bf9e727314862d4578988
SSDEEP 3072:foycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:fy461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T1B9341373BBD55E321FC4C768BB630D423FF6C0DB9428A209A6FA73B76C819650852C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 1b6a3e624f633d45019dc93ebcecaa495b71ab37cdcebb42223c6eb4994b93be
MD5 a362bcca2727da0f5a2d3ae67ec37c56
SHA1 fd813800f2f047693e0eb52ea59f0c01a1a03548
SHA512 072fca7f50a0d4fae31de8a45ecc679a055397e81cfa1153fbe2670418d5150276a6d33244fadb676c1973af72f33c57db819ae1e9f7491423633945cd06b189
SSDEEP 3072:PPycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:F461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T1BB341372ABD55E321FC4C778BB630D423BF6C0DBA02CA255A7FA73BB6C819950451C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d6f305e342a60cf2a6df7244768ed89149e223d07c40390170f93d96256a7b3e
MD5 1f99977cce55bb6686c6160f32814f39
SHA1 665a03fea8cf8cd72f97de12ec0463bd6cbd5f16
SHA512 20a8d86fc3118dfd8e244cc3cfb2e1b10e97480a8827f3465872a5160bab92faee2cd010cde84aa8d9b4b668ef29e0d2ed794b7379abb71fb87dee670e1f29d5
SSDEEP 3072:u0ycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK0qfd7NtZL8cHQRZEQ6Sps3:uG461bZ9wg20MtriHc2JqZ/ZLW3Ex3
TLSH
T1FD341373BBD55E321FC4C768BB630D423FF6C0DB9428A209A6FA73B76C819650852C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 3939ed131fa83fa725453a76e858f44de14f674bbb412989883f2d9f19631d89
MD5 d4f55ea0174888e92758566378c4e8eb
SHA1 82b1a9e30b235d4932a55c0ac91f28d2c316f61a
SHA512 c06c380d5caf748b30e6282e2ffccfffb62062c0a6c03e809be577967fa268e9b4eb23d63ff6879e40320fcacb1eb0b952d7896050c5119ed3147cdfacff4472
SSDEEP 3:MsEllllkEthXllkl2zEole+51:/M/xT02zDe41
TLSH
T13C4404477FC50405CD003030CC31C3F00370F4D40D1157C334551C535CC75440D00014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\injector.exe
Size 191KB
SHA256 6bab6310554b02bf9c3e43625909f1e6c8a8900149e28329dbc60ce9be959715
MD5 b6fa07f9ea349e3632b14dbb1e3b7108
SHA1 3038f54fada6923bf24b45f2d4a313cd061cf862
SHA512 86ba0307711ddb8d3ed773f8db08e437fbccca54a1b923312cd9ad94401c0d97a1f8666552feffc23d2b4c1b26a11f731adede7a2960cc7dea6953e3fdedc8d2
SSDEEP 1536:S+TO56ALZuA0oaX8mYXm0vx+QkYzLFQwEdNVWwR:S+86AVuA0oaX8momy2QFQzdrWwR
TLSH
T18D14D339C551133C87B9DE604F1D8DD8A6F2F84363BA955A667027A01ECDE306AAF1CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapper.exe

Path C:\Users\Admin\AppData\Local\Temp\mapper.exe
Size 150KB
SHA256 1b33924f2dad2b7faa046bdbca24395fa9ca05df293b6dd9d3c1c0156b0f469b
MD5 2fe494642bbc551fffc79a900e887a9d
SHA1 443db3ce1c79d1426ecc473d25184643c0d1fc01
SHA512 0949372fa21b0ec270b77d6388e0dcbe116361968c23f48124ff95de1cc0ebc82c2d87f4fe345222061c528ee93cf659cea92cfcc70ac5cbf62fb83f11e2a684
SSDEEP 3072:xKNxLkcPV/nK1EDZV8oKkwhmJTQSaMm5/6Y0iXUa:xioM5nsGZ/7pWljzE
TLSH
T1E4E32A5797A9106EF1B7D6B9C9B20911EB727C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 2d9372b6f31b6d0c12b13b23fe0e28d556d86c97277d6a9d13cac2c8cf49f1e1
MD5 5786766febdbf9e5564cc22bded311ef
SHA1 b9eb8b6689d1d0baa720de82cc7273457a7d818c
SHA512 a943a75b020485c9f26d2d916fa5ae4cdca834b7b4b7c288de8fe1e793c2c3fd076f4ff844b783af69de363776173811c2ca0127894b077376714cc3a56a15ea
SSDEEP 196608:sQ5I1Y6lgMxsMh/vlKV4BmJsuCnuE5P5edeL:sa+YWgMV/vk6BmyuCv5yeL
TLSH
T1CED69D5AB2B800E8D4BBD178CA565613EBB1741603709BDF17A046BA1F63BE46F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download