d643f913e92cc3d9c799a3e87e7f2833cc2714b8872969b9029042c12dfb8677

Analysis

user interaction
yes
max time kernel
500s
max time network
479s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 50.3MB
Sample260824-jgblcsthph
SHA256 d643f913e92cc3d9c799a3e87e7f2833cc2714b8872969b9029042c12dfb8677
MD5 876273d9cf54d3007a6fa23356e41b93
SHA1 4dbfb3355775bc2ab50f8927ae6039fcd9e43b68
SHA512 137eb58a61f724af1e51dd2eb2c85a2aa2e55c1003bf4f89993868923ca938e727769116ca96eca079f42f90b5ca4117d983f8a1f330a9fa9d44352bebfaf21b
SSDEEP 1572864:5JZ8E8Ss2SN94ZgCsN8gDp8M8grR/BdWISpCj6QJ:xH8wSN94+V8gIgrUIS5QJ
TLSH
T17AC7332A77225E41F8E7213A4362CD0E5B387BEBF703812745B60E4BB79B6582D32571
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
132	5880	chrome.exe

Executes dropped EXE 19 IoCs

pid	Process
2892	RobloxPlayerInstaller.exe
2600	RobloxPlayerBeta.exe
2688	RobloxPlayerBeta.exe
5852	RobloxPlayerBeta.exe
2004	RobloxPlayerBeta.exe
2748	RobloxPlayerBeta.exe
2740	RobloxPlayerBeta.exe
3428	RobloxPlayerBeta.exe
5688	RobloxPlayerBeta.exe
3148	RobloxPlayerBeta.exe
2600	RobloxPlayerBeta.exe
616	RobloxPlayerBeta.exe
4236	RobloxPlayerBeta.exe
5228	RobloxPlayerBeta.exe
2100	RobloxPlayerBeta.exe
2500	RobloxPlayerBeta.exe
3116	RobloxPlayerBeta.exe
4224	RobloxPlayerBeta.exe
3484	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
2688	RobloxPlayerBeta.exe
2004	RobloxPlayerBeta.exe
2740	RobloxPlayerBeta.exe
5688	RobloxPlayerBeta.exe
2600	RobloxPlayerBeta.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe
6032	Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

pid	Process
2688	RobloxPlayerBeta.exe
2688	RobloxPlayerBeta.exe
2688	RobloxPlayerBeta.exe
2004	RobloxPlayerBeta.exe
2004	RobloxPlayerBeta.exe
2004	RobloxPlayerBeta.exe
2740	RobloxPlayerBeta.exe
2740	RobloxPlayerBeta.exe
2740	RobloxPlayerBeta.exe
5688	RobloxPlayerBeta.exe
5688	RobloxPlayerBeta.exe
5688	RobloxPlayerBeta.exe
2600	RobloxPlayerBeta.exe
2600	RobloxPlayerBeta.exe
2600	RobloxPlayerBeta.exe
4236	RobloxPlayerBeta.exe
4236	RobloxPlayerBeta.exe
4236	RobloxPlayerBeta.exe
2100	RobloxPlayerBeta.exe
2100	RobloxPlayerBeta.exe
2100	RobloxPlayerBeta.exe
3116	RobloxPlayerBeta.exe
3116	RobloxPlayerBeta.exe
3116	RobloxPlayerBeta.exe
3484	RobloxPlayerBeta.exe
3484	RobloxPlayerBeta.exe
3484	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\PressStart2P-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\dpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-18.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\PermanentMarker-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\Cursors\Gamepad\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\btn_newGrey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\MenuBarIcons\HelpTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\gr-profile-150x150px.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\DenkOne-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\sky\sun.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\grid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\statusSuccess.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Chat\Chat.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\VRStatus\ok.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\XboxController\ButtonLS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Moments\Reactions\skull-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\ic-createchat1-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_gray.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\zekton_rg.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\sky\cloudDetail3D-bc4.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\textures\studs.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-36x36.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\avatar\animations\humanoidR6AnimateChildren.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\import.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Moments\Reactions\laugh-joy-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerLight\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\textures\sky\indoor512_dn.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\PlayStationController\DPadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\Players\ReportFlagIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\MicDark\Muted.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\models\Photobooth\AbyssBlueLight.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\sky\bn.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\Gamepad\ControllerSelect.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\InspectMenu\Button_white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\dialog_white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
3772	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5880	chrome.exe
3468	chrome.exe
4656	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320308420747240"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-dcbeee682ce74ee0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{E13B01E0-334A-4FEA-8613-C59A6A893434}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ddf602d9cfe44005"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ddf602d9cfe44005"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4480	Launcher.exe
6032	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe
4480	Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4480	Launcher.exe
6032	Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	Launcher.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4480	Launcher.exe
6032	Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4480	4108	Launcher.exe	89
PID 4480 wrote to memory of 1132	4480	Launcher.exe	90
PID 3332 wrote to memory of 4308	3332	chrome.exe	94
PID 3332 wrote to memory of 5880	3332	chrome.exe	95
PID 3332 wrote to memory of 612	3332	chrome.exe	96
PID 3332 wrote to memory of 612	3332	chrome.exe	96
PID 3332 wrote to memory of 3044	3332	chrome.exe	98
PID 3332 wrote to memory of 3044	3332	chrome.exe	98
PID 3332 wrote to memory of 3732	3332	chrome.exe	99
PID 3332 wrote to memory of 3732	3332	chrome.exe	99
PID 3332 wrote to memory of 2216	3332	chrome.exe	100
PID 3332 wrote to memory of 2216	3332	chrome.exe	100
PID 3332 wrote to memory of 3364	3332	chrome.exe	101
PID 3332 wrote to memory of 3364	3332	chrome.exe	101
PID 3332 wrote to memory of 4056	3332	chrome.exe	102
PID 3332 wrote to memory of 4056	3332	chrome.exe	102
PID 3332 wrote to memory of 5560	3332	chrome.exe	103
PID 3332 wrote to memory of 5608	3332	chrome.exe	104
PID 3332 wrote to memory of 5608	3332	chrome.exe	104
PID 3332 wrote to memory of 4624	3332	chrome.exe	105
PID 3332 wrote to memory of 4624	3332	chrome.exe	105
PID 3332 wrote to memory of 4240	3332	chrome.exe	109
PID 3332 wrote to memory of 4240	3332	chrome.exe	109
PID 3332 wrote to memory of 4980	3332	chrome.exe	111
PID 3332 wrote to memory of 1596	3332	chrome.exe	110
PID 3332 wrote to memory of 4980	3332	chrome.exe	111
PID 3332 wrote to memory of 1596	3332	chrome.exe	110
PID 3332 wrote to memory of 1512	3332	chrome.exe	112
PID 3332 wrote to memory of 1512	3332	chrome.exe	112
PID 3332 wrote to memory of 5948	3332	chrome.exe	113
PID 3332 wrote to memory of 5948	3332	chrome.exe	113
PID 3332 wrote to memory of 5104	3332	chrome.exe	114
PID 3332 wrote to memory of 5104	3332	chrome.exe	114
PID 3332 wrote to memory of 2444	3332	chrome.exe	115
PID 3332 wrote to memory of 2444	3332	chrome.exe	115
PID 3332 wrote to memory of 1368	3332	chrome.exe	116
PID 3332 wrote to memory of 1368	3332	chrome.exe	116
PID 3332 wrote to memory of 2940	3332	chrome.exe	117
PID 3332 wrote to memory of 2940	3332	chrome.exe	117
PID 3332 wrote to memory of 2748	3332	chrome.exe	118
PID 3332 wrote to memory of 4268	3332	chrome.exe	119
PID 3332 wrote to memory of 2748	3332	chrome.exe	118
PID 3332 wrote to memory of 4268	3332	chrome.exe	119
PID 3332 wrote to memory of 3340	3332	chrome.exe	120
PID 3332 wrote to memory of 3340	3332	chrome.exe	120
PID 3332 wrote to memory of 1640	3332	chrome.exe	121
PID 3332 wrote to memory of 1640	3332	chrome.exe	121
PID 3332 wrote to memory of 5420	3332	chrome.exe	122
PID 3332 wrote to memory of 5824	3332	chrome.exe	123
PID 3332 wrote to memory of 1192	3332	chrome.exe	124
PID 3332 wrote to memory of 2748	3332	chrome.exe	125
PID 3332 wrote to memory of 252	3332	chrome.exe	126
PID 3332 wrote to memory of 3380	3332	chrome.exe	127
PID 3332 wrote to memory of 3380	3332	chrome.exe	127
PID 3332 wrote to memory of 1060	3332	chrome.exe	128
PID 3332 wrote to memory of 1292	3332	chrome.exe	129
PID 3332 wrote to memory of 1292	3332	chrome.exe	129
PID 3332 wrote to memory of 1532	3332	chrome.exe	130
PID 3332 wrote to memory of 2892	3332	chrome.exe	131
PID 2892 wrote to memory of 2688	2892	RobloxPlayerInstaller.exe	135
PID 3332 wrote to memory of 5852	3332	chrome.exe	142
PID 3332 wrote to memory of 5852	3332	chrome.exe	142
PID 2752 wrote to memory of 2176	2752	chrome.exe	147
PID 2752 wrote to memory of 6120	2752	chrome.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd0481c728,0x7ffd0481c734,0x7ffd0481c740
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,6732660600318180688,6107719760494781698,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,16988918829859488162,16676628094140939115,262144 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,14727758914944973192,2484348441797276963,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,5671585342242992939,16622741222926691363,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,16511358712209778269,17450104026515141369,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,1287075938469814785,1421817748818200198,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,10064466060637951093,7713702071006143779,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,8397217389230031320,13291456289113301097,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5428,i,11597213421910354154,221260709392915983,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5456,i,3826631619520238208,1073467041929908227,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5760,i,2042513515849387794,15660981870435573614,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5916,i,6593296314279578575,14480616202228472622,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,16736915481304083295,12989418696912598114,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6288,i,14683096155231051892,3420203168997349369,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,14408731489159018546,15520684711741401363,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5764,i,11027669933738368202,659423944556061910,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6392,i,11911692669246931270,849372840293172703,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6404,i,8896283457728798122,2773195135532186797,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,16915709048527656880,5825152418732671629,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5440,i,9143508499901691592,11855707395441565803,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6332,i,13295046157502785634,11176203095248475636,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:9
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5656,i,8178422950172404025,17331669987458971519,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6504,i,14050946710571880017,15680267230489754985,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,18196802557730700850,5242883383744159026,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,1838616738672178601,4789865742871386750,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,18204650155140688497,7338287251816531374,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,10461547526309534220,17098494461187587233,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,1651174515042891506,17513635586637401179,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  - Modifies registry class
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,5402525655698388728,1936269307084626754,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:12
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7016,i,8776229596452910130,14954941268873975507,262144 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:10
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7144,i,9869393824442009365,10723546443893670704,2097152 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,14710226938700056464,14158454122560530029,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
  2⤵
  PID:1532
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2892
    3⤵
    - Executes dropped EXE
    PID:2600
- - C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2892
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,11952645266303420516,5528809289885409883,524288 --field-trial-handle=2052,i,10392837396476489037,10698925388212152273,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xac,0x134,0x7ffd0481c728,0x7ffd0481c734,0x7ffd0481c740
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,6074359761391800421,5510311133358512694,262144 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,2591454200472417184,1520463894459204545,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2020 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,7392963047748568155,15524266913498572347,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,16443821495056806471,2741247789040818047,2097152 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10146242802660869414,3729518542897649054,2097152 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,13811873224674288624,13851294435497159756,2097152 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3196,i,12165402929167223286,483863531443211553,2097152 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,6223697030670246317,6618421634175971464,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3556,i,16723310788216197104,2614410578870282699,2097152 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:XY4Wgg8qpfCRQkZ2fIYDPXfhCSG5uWrpFyUTsKMogxVAY77jdKbd-fFmuoUG149C7U48K7qxt7WvsFd5QvuVZhefBVQLZdM1dUn1iuLbXjZvnS4okyPy2SC27C6J8Zzr-D7xeBq6d5NChUQ5PyAitHb9szjXy9654nuo4g1hFjuMYCp5zGdijjwwW3rdC00DkIcX9KgJKeq-7C21U-PkPsAhLfOT-Bno4lRKsF64Bjdd-cMWEcIZpn5KgFxk4fdypa7YQEz6y6f4auYNENvNwsm5ZV7fNxjENQT09FCHJLLHw4E5shzqWhCBv7MqjxK9tvzgh4GqhxFIhuxFGfUasdQO2Uw2CGfhFAIeKQwy9OJQHo4_R9jhdi9yzQIJnHrawGwyc5JN-ARBXotmm9F2u1-nQ7LuLGR5Y3hFECXAql6cyipV9MpO1pfrdjoqWkS4hvEfB2Ge3U7Md3RDZ9Azh4CpnVVWxkTsVYgON_8LE8sPEm0JDWodbB18Fkh7MoZWwYMPm2ef5xDH7zk_WS-6VClR1iYl6oc3ezyU-KUkVeI+launchtime:1787557457169+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1787557251177002%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D56af7e53-14c2-4f3e-8dfa-d51673068f55%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1787557251177002+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:5852
- C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:XY4Wgg8qpfCRQkZ2fIYDPXfhCSG5uWrpFyUTsKMogxVAY77jdKbd-fFmuoUG149C7U48K7qxt7WvsFd5QvuVZhefBVQLZdM1dUn1iuLbXjZvnS4okyPy2SC27C6J8Zzr-D7xeBq6d5NChUQ5PyAitHb9szjXy9654nuo4g1hFjuMYCp5zGdijjwwW3rdC00DkIcX9KgJKeq-7C21U-PkPsAhLfOT-Bno4lRKsF64Bjdd-cMWEcIZpn5KgFxk4fdypa7YQEz6y6f4auYNENvNwsm5ZV7fNxjENQT09FCHJLLHw4E5shzqWhCBv7MqjxK9tvzgh4GqhxFIhuxFGfUasdQO2Uw2CGfhFAIeKQwy9OJQHo4_R9jhdi9yzQIJnHrawGwyc5JN-ARBXotmm9F2u1-nQ7LuLGR5Y3hFECXAql6cyipV9MpO1pfrdjoqWkS4hvEfB2Ge3U7Md3RDZ9Azh4CpnVVWxkTsVYgON_8LE8sPEm0JDWodbB18Fkh7MoZWwYMPm2ef5xDH7zk_WS-6VClR1iYl6oc3ezyU-KUkVeI+launchtime:1787557457169+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1787557251177002%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D56af7e53-14c2-4f3e-8dfa-d51673068f55%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1787557251177002+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,13573930351012063283,12539556101775750260,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,6681291637851098632,8406424594643401907,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,7215685296640177691,16212295547961070343,524288 --field-trial-handle=1800,i,15339396726798346441,7132361118905869635,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ffd0481c728,0x7ffd0481c734,0x7ffd0481c740
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,16638152812794842753,11078875084020985086,262144 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,4299569878866839432,8840564138112397602,524288 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,5966344338547514241,10352332109891857939,524288 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2256 /prefetch:13
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,10721072224100088860,3296920841141417244,2097152 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,17192266502977110284,588705822483050282,2097152 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,2774213841267118081,12064056313977959942,2097152 --field-trial-handle=1768,i,1983750722394351743,1019844746877296215,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1968

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2748

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2740

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5688

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3148

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2600

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
PID:5880
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3772

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:616

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4236

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5228

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2100

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2500

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3116

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4224

C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 adffa6e7af1a3b3c72acd302bcfa31145d13e849834f113ce78157b644f01b78
MD5 67139697f94e1aca17e1ba7fc0e9fdb1
SHA1 17bc9e059ebeeed75734779f3064d2196b899f14
SHA512 81ff6072b00bce501428c027348ac5607c38c88de206b95ef2e4862c8071e0bea55e2557fb00cf9c5f4b917b923b340df060341dcdda42cf9c6f01225164933e
SSDEEP 196608:yOnlae3rNKvLWW8bGiTmsxz3tFBov5zYIr3Z26si:yKbNK8Tmsxzd/65zYIr05i
TLSH
T10AA6BF22B900C032F8D200B296BD9FFA993D9A344B7954D3A7D45DB95A305D33B39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 490KB
SHA256 d8d42d76a3b92fe0a123a0dea0f149be77cf10cf8c4b7854d87dc9502bd65554
MD5 5f05bc6223b75052b594b38016762a77
SHA1 9402fb580707b2a188e3709e3d3016cf46afb141
SHA512 cccaab7d0a3af45079b19cc17911026b598208f34e3169e4e55efc8aee179e91e188488efa21c5d4deab40b8a2ceab37da4013f7076237cc1174300771b9c623
SSDEEP 12288:NHERXJQVlxmdRFRBRxkZs3HJu8eWQ896qqW5:Fdfxmj3fx3JuIQ8ws5
TLSH
T118B4129DBF4B8C03E60976DC6E955FE623A74E2404148F3CAE114749209EF79C43AB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 13508db4bba86518e3c3f4fac9ecd5fc32d73719f8ab9c9bfa985825049c64f7
MD5 88035ecc618dd296ff749968f98e8cce
SHA1 baaa9d64571932f19ae2485a1d9051ec13f35220
SHA512 c1227f294a3b9c1c528a11e65f6c50e28b404215ac5d075d328ec7e5b9dfd4fcd5e712de68befc829e6ed03a3fa2e1dba8b7458bf88d0e2d858ec32b0417de76
SSDEEP 96:o9pKMtSa+oDe5YivjGxIiktxiWlRO6Y9AV6Ft4OIO4en:MpKSSa+Yu1yCRtxicsOVGNIOfn
TLSH
T137A1E70098E85616CF6979702E69CE8B7B383B701982F79B54C3B4216073BE81B6E35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 88cb0e53e080bb985e6719539f9d6d070de99a44a72e6d0a3d7fbc7e99dda8d3
MD5 30ff8a77a0037291482b57edb0573094
SHA1 e80d75037dd9582a24a86c1ce5443c42d943faee
SHA512 dccb40b384e388c736d56acea036e205edc21656cd24ed250359c0e5a5739adf8b6adc19ec0836bf4e9ef6e59246e6842df0fa88a526a22cbee29b6d3f2198d6
TLSH
T1CC41C8129EE07039DF594970B170EC49BB341F5804EA7BE75AC760613003AF96DAEB91
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6fe8b01a3584292328d9d45989834b6f15c75a138b65c1f74f74b71b2320cc74
MD5 0e87b4d38264b64be89b8aaaf650254c
SHA1 3d5e32fde103f4ab94e7356c4371990a3cd7a8c6
SHA512 c8ed89aea1e97df4aef8f6ca18db5d26db153d9e33a91d2527658106512ffaa7652ad84bce76247534ca936cb15f887d31da9e99a2a9e51b09d38fd85c25cb48
SSDEEP 96:QMG2OnmEgRjME19XOU+zoukEOfSDNowvORh3wWhGH:RG2BR9XOUpTEOqJhGRh3phy
TLSH
T17EB1A7C09DD81556CF6855B0686CDE8A76381F601EC2B7F790C3A4716353BEB2E2E318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 3d3356847da228866bb8929ec73275b458307f91a56a5c41f0848af67c1cd28e
MD5 b9303325027848cae174e2cd3986adc8
SHA1 9b732b886486add3dc158c7510b224b075ebe4c1
SHA512 3cd7acfc0b7fd04898a6013142c2e08130158423a27da6492f695a63ab694123ace6e664e394cac8fd8ad41ef25478fab2f5f71b6c2e624734a5ff7297b7ba81
SSDEEP 6:/F4xzPkM/lgHlM/2PSlYDtAWIzDFvQkll:d4xgEgH+2aWhAWIfFYk/
TLSH
T19D139E3E9640D497D75A5E74444D5F7D6378C71E49911A6910E470A563445824ACE311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 5f95713d3a4accbd45c1a93f40d5f2930708cfcf9e32bffd29e9a807c815ace4
MD5 4324ed8c214d1d8a8c0858312164527a
SHA1 8f69bbe7121bec220b1b2a2247b147a96be0d74b
SHA512 22a9b6f38f98cc06364c78b057d854e80baaceb05fe4887a5af841d9f30fe80d8f9e2dc04c266927853644abad6209286859e6ab46f60063d6343150c9ccb5b8
SSDEEP 24:AlaO3RVhx73RVhxkwP3RVhxP9K1G3RVhxvV83RVhxtNW/3RVhx:ulVhHVhjVhaYVhTYVh9WZVh
TLSH
T1B044C10B78504D86F86BCABA75226D6DEE5CA38DD7830F135350622C59A10BE8FC7590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 108KB
SHA256 29a0eb645d6a0f6fa8fc140a8b0ad84b901f83c08cc30e3f0504b7bdad7311ff
MD5 75809b5af4c291dd16ea6bd08c541461
SHA1 14b6bdfdf3faf442a9f59fc78a002e5e6059ce73
SHA512 791e3909125bf1d952594fd28bcd889a1c7da8d7a725d12e84b700555cebbe878451a12af7baf5e0273cd6d0ed0b59f91a1266d2a1c1c7167d1c2f67f373952f
SSDEEP 3072:2Om0n1/iCt88opUSHZNy34jORai7JIx4HOTnN+YTOWmn2pGGdKRiDly+N7ROAwgA:jN
TLSH
T1C4B36866B3D0951ED4E100BFC8615BEA53AE2749FD97832F92D478B68F321A319311E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 9bcc4d071c02143123bd61f87c2e4765ab561029d56d7ec4aee31a409612b5c7
MD5 9909c6e7498ce84487f3343500fa471d
SHA1 52b03def9780aa3ad068275f371afa8d544eecbf
SHA512 adee59d39f6712d2ea401bc48e9e41c1c7ac225d4b92afc71d631baf651296082d3d683d7ff9df0ef1d370722b85575d680da0c26dfd10ac0296c34f71a0bbce
TLSH
T1703185236FAC8066E444173385F701FD8BF5B3887E11694139609B0A492264B5DE7269
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8585ac6aad37c0c2fc6abee8c634aa1dc3a08a670de8e52efef564b044dfd8ef
MD5 826dc013bd08d45773b4291c487de699
SHA1 85e29ec933b0513cd5de8a7b4df76bc4b75bc6b9
SHA512 a770c68aae78502d2e72fbbb8b0ebd596c901e2efb1aa5d884bca3bdcc22b0a28f7013399f8b061aeeb9396ddd92c5f79464121092580a84b269fda0623e2fc4
SSDEEP 96:DtxpuUISifVgJy7GM0HxHuAkgHh9fTYQ7:DtxpuUISifVgJy7GM0HxHuAkgHh9fTYY
TLSH
T199A1BEF783E4CA7D861556F09A156E1BCE690924031C3876C9D0BE1B93F39B2E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 24599c3377e452ddcf8b46ab9d3f6aa6b3ebf60c138ef4cda8c730f281ea2346
MD5 ad503867af6ea3e1a350e54d95a87811
SHA1 b985b9ccbe2bc7dc5a4b7e80feb230261c917a2d
SHA512 b13d5af546f06e7f41481ca58c17f9b225930f3593b487751c6584d63e13de196f60712e6b8af9f512b4677849c30c457e5879a5de1ab9e3bd81cc8e65126ad8
SSDEEP 192:DtxpuIY+yRISifVgJy79Xp/iHOQTMVhgatuGPN19ptzjyeNX1x5d6zvL+8HhfVaP:DtxpvZyRISidgJy79Xp/iHOmMVhgatuQ
TLSH
T118126AF753B1C96D9A1696F09A19AD1BCE580530031C78B6C9E0BE1793F36B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 4eae63eb27ab4013bac841410d9470eb8385aeb510d3a6295619166e09a3b637
MD5 bb4174b8c59a55925fab7642a2a4dccf
SHA1 77b2e302bd6bb0b6eaabb3c9cb0bd4f7bb0a32de
SHA512 d2ae62ecbba0b28b7ffc0d167c4fe67c83c7309049342a6538020e9f9da46497adb5f37107e2f4aaa493b12e3e9a2341069bc405e137f12c142b1ace1451d4ef
SSDEEP 192:DtxpuIY+yRISifVgJy7XHXp/iHOQTMVhgatuTHxPN19ptzjyeNX1x5d6zvL+8HH1:DtxpvZyRISidgJy7XHXp/iHOmMVhgatL
TLSH
T1FB126BF753B1C96D9A1696F09A09AD1BCE590530031C78B6C9E0BE1793F36B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2108b26b131a89fbeaf7477765a54bd5eba0b2c3f33a03ebb96f16518f500fda
MD5 fcc96716ce49a52d02b1b20f77d29399
SHA1 1767193141ab954de826ce69cbe6c84b1f7693b5
SHA512 2a032701cacfcdd7a300c9a23ba2e6eb55f6a286bb9654a7b416a2f559ea642dfb3dbfd391018411279524b98fe55a9ef7c1d2e5b90ef9c9999f21d35bd29bb3
SSDEEP 192:DtxpuIY+yJaISa9Xp/DQTUatpyX1dLoPvk3UD7VexkgLRnavT5NH9HjuGMPN1tzK:DtxpvZyJaISa9Xp/DmUatpyX1dLoPvkA
TLSH
T1E3326AF753B1C96DAA1656F09A19AD1BCF680530031C78B6C9E07E1793F36A1E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5335ede982f818fcb62f1fe482a88517bdc0b3dcc8ac484d1c787fbcb094acf1
MD5 2d86754cda3d990d19a128b936e1b235
SHA1 ff99e8df252a57c5aa620b61a0550be0c0cd8ffd
SHA512 ec54b1d97f36664026d224ed9abd575ee967ef9a0decb42fce5d670d3a26fe94e2e2585a202af23502645b31173b1742956a7db6268f3ab362129bb3786b1764
TLSH
T166318BF3C3D49D7D890456F8E7153E2ACD290D18421C3D26C8D4AE1F57E2876D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 7ac73fb721f2d52453bfe49214f7e41f6bfcd9ecba2cbc1d690ab0ae5abc6892
MD5 e8ae612a2141f78ec29a867905cdb843
SHA1 f2586782461041c3e37746222f73324d998fc45e
SHA512 9dbd2553672f9074a80eeb757a754b5024c80b20de7282b05e843eb7b9b0245d0f233cbe8f2d31e0ed5dc1e4addc6bb49755d8365a27c2bee7d853a9d7a5f9dd
SSDEEP 96:uAUZQUWtkUr4KUFyIUbJU8/ULoUDU1SUxrUO/UxhUqUYNU4uJUnowUozUAAUHYUc:uAUOUYkUNU0IUbJU8/ULoUDU1SUxrUOb
TLSH
T1A1A1AD9BD77EF49F21B819BB1E04F806A6B6E4391293BCF4DB66902DB0419F30712472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 4d0c78dc201dd34b1ffbc02a3b71e43a7555bd092810c956671cba43dd5eef96
MD5 bc90877e84516c9545091106f96a5978
SHA1 830bc6a4ac572162947392a4508b1bfa500073ce
SHA512 4356532ff561f62395f2209a8acab221c9d336ae9043d9505b77ab85be70d91309145568fd7a89eeb1df3700841643eee50c3dbd0449fbfc26a260d07d8c1d19
SSDEEP 96:uAUZQUWtkUr4KUFyIUbJU8/ULoUDU1SUxrUO/UxhUqU09UPguJUnowUozUAAUHYr:uAUOUYkUNU0IUbJU8/ULoUDU1SUxrUOz
TLSH
T13AA1AF9BD77EF49B11B819BB1E04F806A6B6E4391297BCF4DB63912DB0419F30712436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 77cd3760e38e1873e222f6fef332b68043d5e14fbcbc215f11b563caf5cb65ea
MD5 114be320e3b508d39531650ca6488d2f
SHA1 483c410c0db6bee87da470d1aa731347d0d29f71
SHA512 ebe32d6a4eb03726915eb500844b6e07ed2e38bc06cc42f1c9f82da0f17ca165b48cae4b81c705f264f7c55d866315642be7797757391456c9bdde5393977a35
SSDEEP 96:stAUCQUitkUEQKUA9IUkJU2/UdoU5UPUSUg/UXhU1UnU3uJUSowUo6UrAU5YUgrE:stAULU0kUEpUuIUkJU2/UdoU5UPUSUgU
TLSH
T1F0A17C9BD67EF84B21B8196B6D04F80975BAB4351257BCF4DB53D12DB0814F30B22476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef6aa9353e62aaf342b11d0262861d8e082ee5e30ecfe93c71110768f166033f
MD5 17596d174aa9c1675422159dd41a46dd
SHA1 74cc3cb6a5f882a0e3a9bee8308508369b798e38
SHA512 2b317057663ad986292dbf47c85d3abb0cd28faa5a1a29fb35b50f43715d918cd92ee6d8fd290aa8998a032d05999272fff806c8d084e4d4dff5c446175d6cb0
SSDEEP 192:IRHGaygwv7FAPRp2r79XxHsb+WNnYQCw2Z2ydqi2swePawqmbVyIsnAUge:IRHGB3sXKfwPIZ2wqi2swuaD8e
TLSH
T1BB42A72EBD24693BADCAC329FA5677A3D7F5102121942E84E7FC892C15EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 514d18ee959939d8ed561c1de172f7d4d8da6b767b9b00da46dd7771a8d00bd9
MD5 5cfe7b287f0e080ba18911c141e326b4
SHA1 7db51639b8fd1b90f740c88018bc40da5131915b
SHA512 fc37e4b32ff9d6bb7b51b3203d2abbd61125a582d3080daf91439bf15d3691730b5647342d8fc2b7ac8d3cbf847658f5d194c12c60a646bd272ecdfa34567fc8
SSDEEP 192:IRHGayAv7FAPRp2r79XxHsb+WNnYQCw2Z2Adqi2swePawqmFVyIsnAUgE:IRHGBcsXKfwPIZ2eqi2swuaDiE
TLSH
T13342B72EBD24693BADCAC229FA5677A3D7F5102121D42E84E7FC8A2C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aa86c87829461bcd45e3ab540eb37c1dec06817f89c7fb226aefc983139c1edb
MD5 ef5ef089278acf569ffad8c352ebb6f0
SHA1 cd10e68263b0ecc66ca612d3a49b70c1fcfbf5ac
SHA512 9de2374c418831d1334c1720c1b635be6978236560f4e340e7e665c8f734eaa1469e1f0eaa35f9ff3268efb6b19c0938e8b7e70f599fa1c533263adc9fb9e92f
SSDEEP 192:IRHGayBv7FAPRp2r79XxHsb+WNnYQCw2Z2ydqi2swePawqmbVyIsnAUge:IRHGBRsXKfwPIZ2wqi2swuaD8e
TLSH
T11E42A72EBD24693BADCAC329FA5677A3D7F5102121942E84E7FC892C15EB5CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f7c1bf96519ffc6edccde12b96164986ef91994f4dbb7811d7b229e992ef7ac4
MD5 9385235f8079583c2f69993d0f4aa324
SHA1 bc0713e1504ab9e894f0c2ae7adc582a34f889c1
SHA512 52f820b5bb3dc289c8e423b77210fca6e4470c51139e875b141623d2cee20ef0f752bd17a7e04a253ea93f6209319ff870b58bafc978bfe814586fb18e0b6c99
SSDEEP 192:IRHGayAv7FrPRpWr79XxHsb+WNnYQCQ4e4dqi2swePawqmDVyIsnAUgE:IRHGBc5XqfwPCemqi2swuaDuE
TLSH
T15142C92EBD24693BADCBD22DFA567BA3D7F5102121942E84E7FC892C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fac210e5d15ffb49ddd2ecc36f6db94e031b310e29e3752a8f49035312575d3c
MD5 c5a53c1d2106210965d21ad2e98beedc
SHA1 f3589b0c175f0e22c6242fb280c5e3ac42a9443b
SHA512 e2ca4ed1b1102d54cf09d6c0dca3108733a6b0018f4bbff6866519310a4022a0805b3e4cf688c07e59351bba41a413fc27317a039fecf0e14a474ac01f08bb5e
SSDEEP 192:IR0WayVv7LrPRpWrG9XxHsb+WNnYQCa98gidqi2swePawqmD8yIsnAUgE:IR0WBlrXnfwP2ggqi2swuaDxE
TLSH
T1A542C92EBD24693BADCBC22DFA5677A3D7F5102121942E84E7FC8A2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b30c749218a8f56255f4e81968f2071011cec1391833153a6c92f3582e96813f
MD5 cb55ccc0d477cace6e62103058b965a2
SHA1 bbf30be31cd0df53d09dffbff80429c9c572e65c
SHA512 25db11909ff878875a19486d6d923510e08fafb7aa1798eaaccd7044859cd3a5e831f3af360da48a905979afe37936ff718977cc009c8fbfafbc14f482214a30
SSDEEP 192:IRHWayjv7LrPRpWrG9XxHsb+WNnYQCs4EMdqi2swePawqmD8yIsnAUgE:IRHWBbrXnfwPyEaqi2swuaDxE
TLSH
T1EF42C92EBD24793BADCBD229FA557BA3D7F5102121942E84E7FC8A2C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ce7f9b6aa54dd6e2d2b3b0849de534c6542d3d45774a8acf6ddc196b905bca10
MD5 af66e94b2364ff1e3d2a110691ae655d
SHA1 e4db73b35af7ca333fab40bb295d1344f1018e69
SHA512 25f5a98e9a08d48f4242140e49c771ffbb02507028f85a2040be4daac46a2567d2611903a8b476d4bf72e40f9b258e6d186c98e185467c53926afce97c9388dd
SSDEEP 192:IRHGayjv7FrPRpWrl9XxHsb+WNnYQCQ4e4dqi2swePawqmDVyIsnAUgE:IRHGBb5XcfwPCemqi2swuaDuE
TLSH
T19042C82EBD24693BADCBD229FA567BA3D7F5102121942E84E7FC892C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0df216ec79ba80dd6fd0ff7399a188efdf332b0a3be0749c41642edf6f2e80f1
MD5 e8a3c4e54c0f74b9154d7c2340031fd5
SHA1 62603ae1ae897cc717ea6a1101bfd7f43dccfcd6
SHA512 0fe9383c080440c27bee513d791fd123107f4248c2bcc81fc4457cebd2a90c855dc5efb02edcfa12cf4d24199eb88f6f278560042586ffc3816e85e16e4a01a3
SSDEEP 192:IRHGayjv7LrPRpWrl9XxHsb+WNnYQCwAYYdqi2swePawqmD8yIsnAUgE:IRHGBbrXcfwP+YGqi2swuaDxE
TLSH
T1CD42C82EBD24693BADCBD229FA567BA3D7F5102121942E84E7FC892C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bf0a7fa98fe9758b390827805b497e103189a13cb1a5aaf74f84fba323ff62c8
MD5 ed9831998a7b2d51ecf842b22636a2c7
SHA1 d500589ea02ca91364e11ae82d00f35e51e2ad10
SHA512 c4e07a93a9d3f8b7912c054e8aa0cdb3ce300f60dc013c31ea2afc4f832fb7f10fa4fed8f5f691dd3fbea63afb8eaa1a4935b8b4ab4387bbada31c676938c580
SSDEEP 192:sR0War5v70rPRpWrQ9XxHsb+WN5U6UXZTZOydqi2swePawqmck8yIsnAUgraJ:sR0WMZsX9fwwFZOwqi2swuaDXve
TLSH
T1C552CA2EBD20693BADD7D22DFA517BA3D7F5102521942E84E7FC8A2C15DB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 93dea363e4a2ca3964e730f3546fac0c88dc97a8b2712cc4affd3b5863f3843c
MD5 97d527d1fd2fb6162e0ee90df3a3cf1a
SHA1 2326bdc52018b7a63e7e11f7fa236b3a4f190a6b
SHA512 81dc5b6b1d7be74ec0b13b15c03d34446e200d516e1c11c53289f3b537889288b54992f4a5e5753e7eb07cd5d80d2955b38b64af8e3c7dcc200aa5c0dd7afd03
SSDEEP 192:sR0Warev70rPRpWrY+9XxHsb+WN5U6UXYDMMIAsdqi2swePawqmck8yIsnAUgE:sR0WMasXifwwMIVqi2swuaDXvE
TLSH
T19452CA2EBD20693BADCBD22DFA557BA3D7F5102521902E84E7FC8A2C15DB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 60863a4fd9f1c50b293aca71594843003be810769847fc7081320e17b8319534
MD5 27046f2ab7b0d705bffdc33608b15855
SHA1 7840388492047e7b962b38f3738335467a0b8d60
SHA512 9861fdcec8e2da724e42e9977a26c99a66d778473ae1dd24695dea7326b3053a1526e15891281bd6ca5c80079aecad1e3c257f87247786a65bd0e49510409308
SSDEEP 192:aR0Wa1Fv70rPRpWrQ9XxHsb+WNPfwXgZTZOQdqi2swePawqmcVSyIsnAUgraJ:aR0Wy1sX9fwAOZOuqi2swuaDXse
TLSH
T14752C82EBD20693BADD6C22DFA517BA7D7F5102521942E44E7FC8A2C15EB6CD221B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c129923a66acee9fb8d8ace243dbe5a257003dad6da6534219522665314bc9b9
MD5 e022c40a8571171389f1667ef7702678
SHA1 94cb6e14453810664e11164b434723e527212072
SHA512 b8dd118ba83e4fbc6e110126d9d47c4701375b9ca45ee4635fe4f49baf5e931b4652ef07017f86b21195b1b18c7489a2103c2648c0793a3aac91d5b8e56fe72d
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3JoHGSEM8qeh:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4O
TLSH
T18952F927684D9A3F0FC8D64CDC166F8FADF6015666B8492497FA5D0803A97CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0a57f932cefb326afcdea987e31e1116212b27fe9096003870f9dd41c84d6da8
MD5 377ed4852fdf222c0b0451b181a704e1
SHA1 c91d0483554723c4e19dc8511ba203bace80cfc8
SHA512 74dfd00f1c14a85aec4d9c894a9a7007ddd1893a666a3f91ace7d520384a3966e951c69310ac7aec1c9d0d182aea8c5643f0a8a291470b06d2da4864945d828c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c2de7a78591a9d9df11a7f885fb6070837784896580d8c95525697889232da2b
MD5 a699a434c9ac5b1a45d210cad833c1ad
SHA1 c82b40a6da7495f5bd638812c098cc612286e6be
SHA512 10d149a7dcf79db3d12897062a7a0fb4c45d4152acd6f612b36fd5dcd7812d331557d70c230562831770e2240e3bc06aab70790f519a221f50410babe272ee74
TLSH
T19DA0021082C41522CD008AB4B0AA1682676259185D6383439CE144448BAB1C05119721
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5cb3c7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5cb3c7.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

a67dcdeb-0149-4de1-afb7-36b482f5b00f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a67dcdeb-0149-4de1-afb7-36b482f5b00f.tmp
Size 414B
SHA256 017cedf8f0c6d67697431f33e495e513ed22a9425e2c46884b6cce53fb5acf7a
MD5 85628a413e227fad5f91472b89c098c7
SHA1 8bd7c5878bc4958d7427d49f95a346bcea19d57e
SHA512 954c0e5b6ed864c7cec6234641c32a6495da8f42af1956c3a018f7dd8d33af097bb652097016e124133c86263d15483305c6fac00325b74f621dd022a109903f
TLSH
T17DE02BA9C921AC3708FD0B5A54604696EB6017171B40491B3B3C820DCFB0636019A81C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 983bcbc6c9a2cbd1fcdcca072469c91524cd927f88a1434335edcd5eae0dda83
MD5 a7568b0908668b92717ac5d756da3c83
SHA1 943b5a34a6339778743e1702a4e244ba8e6182a4
SHA512 481181b1ed1f5ca7ddf8dad4c61965402e1e9ae5747e5d429d754e0347d988582a4a8fa3d032535a0e2d35c738dc3a6e4debbe0a6bdaad93c06dca0d6449a95a
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok50mDPB6nGyvn0b4T80ybJv4a:xC0ITo+TQ0InDUDz5PPb4T80ybl
TLSH
T18BA10939A0284D774476D446F1626A53CFB9706BE972AFD4EAED0E0D14F70EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 05731f3a2ec5e9e78238aaea33920e4fb4458808e2ede9ceed804ec4cb6d0d8c
MD5 982bc6fad7939845a2ac1b136f5e092c
SHA1 ee37febb51730424d0795d5bb733867174096d3d
SHA512 848cbd15655700b266014bb3c43051d71914253394ab79cbb7f12e0d9e50843f2487b27bd6ed5eb9ebb1507cce065232564ee9757d2e70eb65acd98df51b0a84
SSDEEP 3072:yiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLT:IXs6p2+TITPP6BwCoLT
TLSH
T129D302B2A9DD1E6F02F785CDE00B5E274DB4226ADA32AF6E0BB05F1501984DD1117F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 4d7281b7eb7228bbd607edf50265ae6af768028ad15978fca1cb997d3a3c83ae
MD5 98411e066b6738eb07e906b6eb851d81
SHA1 a06ecddf7876f92f0efc14dcc9078d6ab58c12f6
SHA512 1852f29472eb9a1456c4f59204a8e6138fc4f865d2ae14933aadad47d726637ebf06e1d424a058b1aea9a8f5503e0e00ab34c50b76d5a46f1b3688f0c108906e
SSDEEP 3072:OiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLT:MXs6p2+TITPP6BwCoLT
TLSH
T17FD302B299DE1E6F03F784CDE01B5E2B4DB4226ADA32AF6E0B705F1501984DD1117F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 d40fd60235af161c70bd3d2796435bbe226f8a5008e9ebf6302fc7c4913dbcd9
MD5 e20e6cf722c1de47c991c0b8e16856b3
SHA1 ede7916307df0377494dc9caa1f4394daf4664d7
SHA512 3087047398b07d0d03b6a02e6ff2ce730647c70cbe076bb8693ece4975c2bd6b2963d35bd3bf5ee997bdaa0bca20f02f8f7edbe024de1396ffcad51a6a91bfb4
SSDEEP 3072:fdQWs5v6epBblmiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFL0:FQf5yepRlEXs6p2+TITPP6BwCoL0
TLSH
T11FF312E5E5EA5F3F02EEC48CA01B2A274EB4223AD5329FBF0FB15F1501D458D2116A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 aa3b8c1cf09e7430e0c118c52fe5deb08a35088d4b5364a823776864dc3e454f
MD5 a9eac5e6f8157dc04df781bf10bbe643
SHA1 e8e34b53a4739c0cf93b792111bfb933d672ca88
SHA512 4ea207240e0d2dfbcb026ed3446de633dfc953f1ffd1e47f75126819fc6bea039e43d0b9fec600f38ca5827bd83fca32b88ede5ffbf1b967a4fb4d8f93282bfb
SSDEEP 3072:yBiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLT:yXXs6p2+TITPP6BwCoLT
TLSH
T18CD302F2D9DD1E2F03EB859DE11F5E2B8DB42239D5329F6F0BB14E2502984DD1112B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 eeab3329aaa077d62e35c8dd4724c499064b329d35eda65f76f397005c9724a4
MD5 4ca6c7edace029072ab11a29c8ba4282
SHA1 f2457ab40ad5ab64969b931b95241457f46b9a3b
SHA512 3f0879734b5b5813873248d53f6254e128a2708e1b89f19996c557688d13485665d48f6d5d81a6570c435ea41cd026204032095448b8d4533c3b9d260f381435
SSDEEP 3072:OdQWs5v6epBbl1iuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFL0:qQf5yepRlDXs6p2+TITPP6BwCoL0
TLSH
T120F312E5E5EA5F3F02EEC48DA01B2A274EB4223AD5329FBF0FB15F1501D458D2116A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 2f90f4dc8ac368f1df92879141aa3114d5a340ddb2d51af855b6fe652a3ae996
MD5 f00c5413329c68e7d301534bf7646e16
SHA1 9b1fc4cb18a87a988ea9a92a47a8b9b796e61f06
SHA512 cdc9897b4a153f26c0f0092cf49fb0c3e24fd06367686354a782fd715cd4eec9b52c4ab23a3a62741f221483e6ae4a118065320170d81a00586cdc1753639e7c
SSDEEP 3072:FdQWs5v6epBbl2iuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFL/:vQf5yepRlUXs6p2+TITPP6BwCoL/
TLSH
T11EF312E5E9E65F3B02EEC48CA01B2A2B4EB42279D5329FBF0FB15F1501D858D2116A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 857c6303e682fb8a2f55063a29103d0238937c438ef21759cdecd8aec745999b
MD5 7060be3db4aa587ec1dae94f4e55727b
SHA1 f9bd1fdc16363fab572cb98c46fb3b576af6ef35
SHA512 cdd3d8824fee92692c5a527a9caab4f88b92d3eb09550d7a0498f1342cf6aaafd422feca53da66d1ab943440ff1f8dcc6e29e53529672e455d580924fbdd17a6
SSDEEP 3072:NBiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLT:NXXs6p2+TITPP6BwCoLT
TLSH
T1A2D302F2D9DE1E2F03EB859DE11F5E2B8DB42239D5329F6F0BB14E2502984DD1112B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 d25edfebd1162f44172e30aedb3ad2bd608a07edb5ffd3f663ca77bcdf06fa41
MD5 3ad004c2a17bfe83a4e1e33f169e901d
SHA1 629bd9769d8c26d75f847d9b235210d7cb590d98
SHA512 ec441aeab46f31249766af4a328a64f1b7a53f9ab3519037348ae7c52db10027cf692ab9f0502f73499cfabe725d8e003127b801dc13b5a99c0666ba803ff574
SSDEEP 3072:OiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLT:MXs6p2+TITPP6BwCoLT
TLSH
T11ED302B2A9DD1E6F02F785CDE00B5E274DB4226ADA32AF6E0FB05F1501984DD1113F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\MSVCP140_1.dll
Size 27KB
SHA256 d1a0601e781cab04c8dfd46a488ee8dcf3245092532852e2036f1195845c4c4e
MD5 75642fd13eab626d5679899d5b3a822f
SHA1 cdcc3bfece706d57b1cd3c3b78d491c54cedc94e
SHA512 1b720ab22bef73549e957e2c07d0ad157a52f818f58df51beefe04c1acbf3aeaf9ffc5ec469b7f784c3f8c9f04fbab5dc56a89a9d6743504b8746552e54cb76a
SSDEEP 384:3jb2J9VQH+qNy09dmFWcS5gW7DEFP27xWkVbGW/JrpWKrB1y8RbmL4nNytz5P:f8QH+qNy0Pmg1gKxnVbGYJNRr5ALFP
TLSH
T131D28D43BB508D51FC6ACD3494C68A16EA75F290BF83C3CB6325422E0EE23D27976724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\MSVCP140_2.dll
Size 266KB
SHA256 2a0208e4a14e87042469efa481d1f32220bf2a7b7b501173db83c3668fff6669
MD5 37811b070946e570551b269394d5c435
SHA1 3989f03533f6f42a69edea0a00d785727eec880c
SHA512 70e807496f9c76b9c181b9db4324963323f4e70a5e50bf576c080b38b89276d445fda023de83bc5adaeb6c40e1ec5d28c3ccf21f394690ea249388dcd50e9553
SSDEEP 3072:dJ51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD79m:dJbjwvnQo/iy5L/XxTWr5
TLSH
T128443912B51A2EBFC5D6E8B04939B416FC233A409775C48A57C31C8D9E2BA533FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\Qt6Core.dll
Size 9.6MB
SHA256 c7f6a8b9f2f4e67e50f37662102be9e987a7a061f882112a4982a2446d83662f
MD5 6872797af806d7652c1e71b58ed04a11
SHA1 531835d1bf4926efc1331a0ebe1b7cb924d36fa3
SHA512 973f452210f9b6a7b14d074030659726c1debe707f2c6f97c79c70d48df79c665ef0ac42880d019f6108804046dd2633e81df744e37a08941d66392fb988932a
SSDEEP 98304:xmesKMUytgJH1KFdu9CwJsv6tCUDo1cs5Ami7fFbW9/3PO:xm2f1KFdu9CwJsv6tC3OC/3
TLSH
T10BA6290766FA0111FAFBDA34DAB71242DBB27C466B3496DF025861185D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\Qt6Gui.dll
Size 9.1MB
SHA256 7b8f64dda29a859755d04622f0dae11282b1598bf027e0b6f4c722e72fc312df
MD5 9e7e44e9db633e9eba624c0fa8aec7ca
SHA1 958d9e3172b332ece4be27b5558777802828b011
SHA512 1cadc3133322dfbd991a0b3ffbee5ee4b79d5a7d3b6fb044818e7dad5a8aef6c33c5d07586561fc2fc8277101e8da8ec1bd31dbec2b046d9a94eb7eef22daafa
SSDEEP 98304:vv0fimOnRKCT7G93vbkmHUJkz2YHH9RTSrYfTuLRNC:4YKC303vbEJkz2YHH9d9EC
TLSH
T1F9A69D57B2A901D8D57BD13C8B5B9507EBB2700503629BDB02A4CA562F33BF12ABF711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\QtCore.pyd
Size 3.1MB
SHA256 d2bd091416eb60b1fd051cc65a42f3efd4db5521b1f1479bba11d44c4d537125
MD5 34b87dce25e50e6ada59bdf510f192bb
SHA1 46b66471ca0eb2806be33227edbbe385d8201802
SHA512 13922fe0039310216db8c146be6a0d1a84dcfc82182e436c9b8b3698d37d6939171ab230b26e254caf142af969ea5cf5e8e7d3229fb37401992705ddf4926224
SSDEEP 49152:+nQXsVDkBFduUyucIsyE+4S3VEBI1B15PeA4RHKGcrnN1v3xbUVDSpaHlH6i2LQo:+YuUDx6ZJk
TLSH
T19FE55B9F934901C0D63BE07DC90B8A17D6F274924996B30B196ACD641FE77A3136EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\QtGui.pyd
Size 3.7MB
SHA256 c2767ba411264cade8698b7fbc089943b5ddbb141ec6a4bbeab56af51320c88e
MD5 a96c554bf953672432765866686d6d48
SHA1 8b03eaddef6b7f348180c7daa38a195dab1ed0c7
SHA512 14005c3bef0b7c6400a153a960b47ed03957fdd9bed2dbdffccc1c4c43abd0bbbcd554b9ac4aa2dedf13fbe72da71e72bc3501b7e2d0050f133e098b6f77cff6
SSDEEP 49152:HQPmZO2W40CiyBXr86mZu304rGB6dHHR5xRk1BWk+kTQV2avQ+yaSHy3hpPM7oSr:A6Su329+G
TLSH
T1A3064BDA579910C0D23BF07DCD075A13E6F27892C995E207146ACD681FE339227AAFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyside6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\PySide6\pyside6.abi3.dll
Size 254KB
SHA256 668d2e42c5afbf9c9a2caec299694ad51ff4d67e962f18cd745382a8b6e3dfb2
MD5 e94f5ad4d052d2c8cc6124c176893c70
SHA1 4071bc4e630233129ab92cf106a43e377960c4e7
SHA512 0bc53804d4f97e430651d67a266e78e0d3ac37e6b846ac65ce6b32954f53153c7cbbda912b0e15a95956e7b995113c81e7321a7beb09f90213c1040386ccc0eb
SSDEEP 6144:eSa0GkC7pDvHUlQv94y8Deb2oWtneqJX+H738Y9MR8rrOrl7:AvF2y0eb+tne/+lh7
TLSH
T1EC447D6B33405EA9ED6BD179CA428A06D6F3B0020361E78F47A1CBA61F7B353362D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
TLSH
T123937C4A7BA442BBD06AC178C1E34A16F771B844873053CF13B54AAA5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\VCRUNTIME140_1.dll
Size 35KB
SHA256 b1d3b6b3cdeb5b7b8187767cd86100b76233e7bbb9acf56c64f8288f34b269ca
MD5 9cff894542dc399e0a46dee017331edf
SHA1 d1e889d22a5311bd518517537ca98b3520fc99ff
SHA512 ca254231f12bdfc300712a37d31777ff9d3aa990ccc129129fa724b034f3b59c88ed5006a5f057348fa09a7de4a0c2e0fb479ce06556e2059f919ddd037f239e
SSDEEP 384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
TLSH
T1A1F24A4467784096E46B81B4C4A35F27FB38F5A16760928F0BA5D29C2F637D0F63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp39-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_brotli.cp39-win_amd64.pyd
Size 861KB
SHA256 093ab305d9780373c3c7d04d19244f5e48c48e71958963ceca6211d5017a4441
MD5 2c7528407abfd7c6ef08f7bcf2e88e21
SHA1 ee855c0cde407f9a26a9720419bf91d7f1f283a7
SHA512 93e7c12a6038778fcda30734d933b869f93e3b041bb6940852404641a599fe9c8ee1168a2e99dcfb624f84c306aff99757d17570febabc259908c8f6cda4dbea
SSDEEP 12288:mQRpLiY2+Lf+G8vy2DH7BE2UZdJVA6RxAHhly38ZXTw05nmZfRh:mQRxiY2+uy2jrUjbxABiAmZfRh
TLSH
T145159D07E5A20769CC2BC07C8DA71236E77171A8531089E77298E5353B83AE457FB39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_bz2.pyd
Size 84KB
SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
MD5 e91b4f8e1592da26bacaceb542a220a8
SHA1 5459d4c2147fa6db75211c3ec6166b869738bd38
SHA512 cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9
SSDEEP 1536:5XZb8z78wjtQYeO9vDTwE0UaDnV8AQ6HiI37mZIyMVm/yH:5pAzjXeovDsE0UaDnaAQ6HiI3SZIyMVT
TLSH
T18D838E96B3A055F6F0ABF27856614347E371B8090390D3BFA2A4529E2F13B417C6971F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_ctypes.pyd
Size 124KB
SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
MD5 6fe3827e6704443e588c2701568b5f89
SHA1 ac9325fd29dead82ccd30be3ee7ee91c3aaeb967
SHA512 be2502c006a615df30e61bea138bd1afca30640f39522d18db94df293c71df0a86c88df5fd5d8407daf1ccea6fac012d086212a3b80b8c32ede33b937881533a
SSDEEP 3072:IK4a96ls/T8YMsxV2Y88BonwW6frZ90wVGG1IyBP0n1:v76lswYrE8BHfrZJcGI1
TLSH
T10BC36C1B235400AAEA678178C5735F0BDBB2B455472087CF0294C6AA2F637E37E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_hashlib.pyd
Size 64KB
SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
MD5 7c69cb3cb3182a97e3e9a30d2241ebed
SHA1 1b8754ff57a14c32bcadc330d4880382c7fffc93
SHA512 96dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e
SSDEEP 768:Pyz+AYBOBSFlUx/tF5IzZL0fpde9E9GD2Fe7POoJp3RIyYIeqDG4yvOhz:QfBSbyFy1kumGM4Oo/RIyYIeuyvy
TLSH
T154533A0A964410E4D87781BDC8A35E97EA71F911230197DF9264C2CF2F23BE3677AB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_lzma.pyd
Size 159KB
SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
MD5 493c33ddf375b394b648c4283b326481
SHA1 59c87ee582ba550f064429cb26ad79622c594f08
SHA512 a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2
SSDEEP 3072:ajV4pA1vcDRI45a4I9ihQsDPGAznfo9mNo6ndir1NZIyD1UsVM:ajV4pA10Dj5azDePlwYO6cr1NFVM
TLSH
T11CF32886B394F0E6F3328C78D6624F57D7F578190310929A02CC876D2B1FB756A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_queue.pyd
Size 28KB
SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
MD5 103a38f7fbf0da48b8611af309188011
SHA1 1db9e2cb2a92243da12efdca617499eb93ddcbf8
SHA512 2e6c4b9786034cbf6a6d94761ed31807657ee10edd679147c838a2e6e97a0c13acd6e59bc6e69edf1ca725f12e0f972a0de0ae4b331da46dccd687c59096a250
SSDEEP 384:sm9U+03+lESFJvU2S66m6rEO3ay3njs+cEp1IymU/XDG4y8fvRhn:sbOES/v76rEO3XA01IymU/XDG4yyhn
TLSH
T188D28C82AB5458E2E973C575A4A39F26F871F6015324C3EF2228C15C5F363C2727AA6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_socket.pyd
Size 78KB
SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
MD5 fd1cfe0f0023c5780247f11d8d2802c9
SHA1 5b29a3b4c6edb6fa176077e1f1432e3b0178f2bc
SHA512 b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae
SSDEEP 1536:AeG2cHel7zjv5Qe9AM9/s+m+p7ncSrpZjxk1IyBwayyq:3IyzjeMAM9/sb+p4Srbji1IyBwD
TLSH
T1B7735B01A76051FAE673C07AC6678F23F7B0F4801394A79F4164C95A1F23792AE7EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\_ssl.pyd
Size 151KB
SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
MD5 34b1d4db44fc3b29e8a85dd01432535f
SHA1 3189c207370622c97c7c049c97262d59c6487983
SHA512 f5f3dcd48d01aa56bd0a11eee02c21546440a59791ced2f85cdac81da1848ef367a93ef4f10fa52331ee2edea93cbcc95a0f94c0ccefa5d19e04ae5013563aee
SSDEEP 3072:l+W5d6jjX0XH4OAskKCiiII27uUh+9xFq7SwH70NmHh4kwooSLteSdN1qZIyM7s:lx6jjX0XYzskKPVTh+9K7SKDthN1qf
TLSH
T153E37D43F2441AB7E813E4BDC6234942E7A9F105231197DE85D6DA4A0F03B06BE7AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\base_library.zip
Size 1012KB
SHA256 9f90ef03d2ba4f96711e0dd8cb83b2fefcf8b50a067a5b6127de97a1987908a0
MD5 9f185168c80e05d40cf4ac7826e0c06a
SHA1 ac75628d79375f6499643524e6fe4c3a774bd4d9
SHA512 4080a0307789aae076fd82d84f0d5d4c76ea83d4a9367e554a4ce846dcca8eb9651aad4f7c32637ae6a60a227c48f16bfd85b88b709c9d861b3ee042ab0d17e7
SSDEEP 24576:Ehia1OFQcosQNRs54PK4ItaVwHEfVEnoageNDE0J:Ehia1OKcosQNRs54PK4ItHLNz
TLSH
T13F252840BAA26ED7FD09F378411E861C4B2A9339DB49D203794FC39C3F4A3E41E65A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\certifi\cacert.pem
Size 283KB
SHA256 cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748
MD5 302b49c5f476c0ae35571430bb2e4aa0
SHA1 35a7837a3f1b960807bf46b1c95ec22792262846
SHA512 1345af52984b570b1ff223032575feb36cdfb4f38e75e0bd3b998bc46e9c646f7ac5c583d23a70460219299b9c04875ef672bf5a0d614618731df9b7a5637d0a
SSDEEP 6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
TLSH
T1CB546C964F269C05289FE1C1CA9B1357DD3E027B99FEF0F2294A2448D34622617FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\libcrypto-1_1.dll
Size 3.2MB
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
SSDEEP 98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
TLSH
T1AEF58C5AA3AC1194E5BAC07CC9574727E3B1B85A87B05BCF08A681780F27BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\libssl-1_1.dll
Size 674KB
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685
SSDEEP 12288:XXnznrSRNaJkxbpdM2QJCCMHxtfz8Irj0R6wQHPRv8Fl4tekY2U2lvz:vSTxbpd/Rrj0R6nd+SJnU2lvz
TLSH
T192E43995ABB514A9E9E6C17C86534A37E376F4142330AFCF0661853D0F1BBC92B3A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\psutil\_psutil_windows.pyd
Size 75KB
SHA256 d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
MD5 5e9fc79283d08421683cb9e08ae5bf15
SHA1 b3021534d2647d90cd6d445772d2e362a04d5ddf
SHA512 9133011ae8eb0110da9f72a18d26bbc57098a74983af8374d1247b9a336ee32db287ed26f4d010d31a7d64eacdc9cf99a75faab194eff25b04299e5761af1a79
SSDEEP 1536:2ztEQV7I0DiMRAlELBNvpEnd17dO1vIFbHGy:2pESdiQAlEL6dJdO1vibHGy
TLSH
T14E734B46B36A10F8D46AD23DC5B71633EAB1F0A2172283DF4950D9090F6ABD7A375F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\python3.DLL
Size 58KB
SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
MD5 e438f5470c5c1cb5ddbe02b59e13ad2c
SHA1 ec58741bf0be7f97525f4b867869a3b536e68589
SHA512 bd8012b167dd37bd5b57521ca91ad2c9891a61866558f2cc8e80bb029d6f7d73c758fb5be7a181562640011e8b4b54afa3a12434ba00f445c1a87b52552429d3
SSDEEP 768:fn+mYEBMcEfpzVHBlAUcfc0la6Wc6kH/ZFJ1Yu+wNBECaOMyCgUhkb0E/GP1IyB3:f+mYEBMofwkK1IyB00yQIi
TLSH
T18F435F525954FCA3DBEA2DFF39D19DC924E912CC812684DCA97892D30F5A233AD2734C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\python39.dll
Size 4.3MB
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
TLSH
T15D267C23A39411A4DAB79477C5178706DBF2FC412B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\pywin32_system32\pythoncom39.dll
Size 543KB
SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
MD5 70bc8ed8d8010f70eac573acb2da9102
SHA1 0eb61a4b1542560688d74c8242f51f6e4d0fb845
SHA512 c110716018fece63efdb1956eb4a200a74c47f56819e4c112408cf62a50d4f2f325ba8f9c88b91d2824fe6ec1760cc5bc1a63b12dc13a757715101c4b67cca79
SSDEEP 12288:IH10c9/Km/1LDOV+4j71vzdJ1vNreqpd29ydV:IH+c9/Km/1DOVvj7h5J1g1Q7
TLSH
T100C43B4677980981F627B23D8D678B06D3A2B4411791D7CB11B1D3AF2F37BD62A3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\pywin32_system32\pywintypes39.dll
Size 139KB
SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
MD5 7fda0690544ac0051f53adefdb079c6a
SHA1 3d4a20d7b76c3352d3f6b3cddad232d823048152
SHA512 fedc45635b8977fa7bff36659e34e8cd21686ccb8af93ad4b5fa77c8ed02d54210442ccd6479b939b1e928ef1bdc0c9c73fb4dd637e9d4c4d9d88442c49d4a07
SSDEEP 3072:ZZsVDfSemr2vGYrrC0MpJCM6g1cbc7SqT/2mCGIpGX:/s55i2uYrrC0qCA1cbc7S+/2mIO
TLSH
T1C6D33A073746848BD927E37D8DA30A02D3A2B0510751E3CF06A5C29B6FA37E66D3F656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\select.pyd
Size 28KB
SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
MD5 0e3cf5d792a3f543be8bbc186b97a27a
SHA1 50f4c70fce31504c6b746a2c8d9754a16ebc8d5e
SHA512 224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340
SSDEEP 384:+Wu7bFYpo5K98HhIJg6mwhY6HqMGXYPAr70cE9o1IymGpMDG4y8lVJhj/:nykc6mwhBHqFY8p1IymGpMDG4yKhL
TLSH
T1CAD27C51AB9428C7EA739531A4E1AF0BF93576130720C3DF2269C2591F237C17A7E369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\shiboken6\Shiboken.pyd
Size 33KB
SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
MD5 b8ce9f62c17a3543da36247aed3f8d96
SHA1 92320c3410b6ad7b3e0d1b0c14fff2454b3f6fdd
SHA512 19cbf4a8b04801de52485eb04c2fc8edcd77da49938ef4d5a5849767df3df730409d1a7ee6f96aca4cedf69ee3adaeaf6280c0d169c8c5bedd4b276665df6de2
SSDEEP 768:Vd4Z0s8jvWYBt4/zemngKxnVbGYJNF5ALv:VyZibWYuemngKxngGY
TLSH
T10FE27C479A6864DAFD94C67A40868E16D4F0B660574393CF136BC0EA4FE33C23E3AB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shiboken6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\shiboken6\shiboken6.abi3.dll
Size 373KB
SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
MD5 35b18d84bd75636b1e23034058839baa
SHA1 ab410d2c487773737ec8a0604af93eb0b571a21c
SHA512 186c339409f3710a7182a086d7f88bc3dc693e98b6351fc517f546f37ec3bf990c9f6a3fd0c6f16910d1be05d570d4f61006cb9d0aec7af47b5c469a505228d5
SSDEEP 6144:sSS2oJHwF8VhgtcN7T1KZur2F0bYqbP+Jlz5/08au+rWI5AON7:sHLt0l0bZbP+/zsuON7
TLSH
T1B9848D2BAF5410ECF667827C88638507D6B670A2035097CB23F9C2D52B63AD57A7FB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\unicodedata.pyd
Size 1.1MB
SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
MD5 7af51031368619638cca688a7275db14
SHA1 64e2cc5ac5afe8a65af690047dc03858157e964c
SHA512 fbde24501288ff9b06fc96faff5e7a1849765df239e816774c04a4a6ef54a0c641adf4325bfb116952082d3234baef12288174ad8c18b62407109f29aa5ab326
SSDEEP 12288:lezMmuZ63NNQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uB/v:lezumZV0m88MMREtV6Vo4uYB/v
TLSH
T1E2355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE693C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41082\win32api.pyd
Size 131KB
SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
MD5 c2c0fa32e01f7bc4542bf96e0cc3ffe5
SHA1 6b2733b08351442f27ff943c3faccf45378a87eb
SHA512 311f94646e76247ce3db8b73f47a8f56abe7b8f34df642e40bd7842b6609814ec99bf4a500e8c5fbbb0f88fc25413b7c5516cdd9b7ccacea872317cde1a1bbd5
SSDEEP 3072:Ag3Ke7MAgKmvDKsMLMsAv0b2nRHzspVJ4fcuQr4MhnVL7e:me7JgKmvDwSnRTspVpuWtVL
TLSH
T15CD30983639400C6D86AA6BCC4A65F13D771F8140721A7CF46A0C54B5F63BEA7E7CBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_452202460\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 443781.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 443781.crdownload
Size 13.0MB
SHA256 2d9372b6f31b6d0c12b13b23fe0e28d556d86c97277d6a9d13cac2c8cf49f1e1
MD5 5786766febdbf9e5564cc22bded311ef
SHA1 b9eb8b6689d1d0baa720de82cc7273457a7d818c
SHA512 a943a75b020485c9f26d2d916fa5ae4cdca834b7b4b7c288de8fe1e793c2c3fd076f4ff844b783af69de363776173811c2ca0127894b077376714cc3a56a15ea
SSDEEP 196608:sQ5I1Y6lgMxsMh/vlKV4BmJsuCnuE5P5edeL:sa+YWgMV/vk6BmyuCv5yeL
TLSH
T1CED69D5AB2B800E8D4BBD178CA565613EBB1741603709BDF17A046BA1F63BE46F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2100-3215-0x000002211EE20000-0x000002211EE92000-memory.dmp

Download

memory/3116-3216-0x0000017946EB0000-0x0000017946F22000-memory.dmp

Download

memory/3484-3217-0x0000016CD73F0000-0x0000016CD7462000-memory.dmp

Download

memory/4236-3214-0x000001E9848E0000-0x000001E984952000-memory.dmp

Download

memory/4480-2163-0x00000234FA360000-0x00000234FA715000-memory.dmp

Download

memory/4480-200-0x00000234FA900000-0x00000234FA910000-memory.dmp

Download

memory/4480-213-0x00000234942B0000-0x00000234942B1000-memory.dmp

Download

memory/4480-198-0x00007FFCE9F50000-0x00007FFCEA3FD000-memory.dmp

Download

memory/4480-201-0x00000234FA360000-0x00000234FA715000-memory.dmp

Download

memory/4480-199-0x00007FFCE9900000-0x00007FFCE9F46000-memory.dmp

Download

memory/4480-197-0x00000234FA360000-0x00000234FA715000-memory.dmp

Download

memory/4604-938-0x00000266000D0000-0x00000266001F5000-memory.dmp

Download

memory/4604-3075-0x00000266000D0000-0x00000266001F5000-memory.dmp

Download

memory/6032-3213-0x00007FFCE7290000-0x00007FFCE78D6000-memory.dmp

Download

memory/6032-3212-0x00007FFCE78E0000-0x00007FFCE7D8D000-memory.dmp

Download