b1edefa5105f0fbbaf07ac6aef88ad68e014e67c480012fc5824bef74a80e775

Resubmissions

06/09/2026, 21:57

260906-1vb8gshj8y8

06/09/2026, 21:53

260906-1r13fahj6s3

06/09/2026, 21:52

260906-1rd8nsdd871

06/09/2026, 21:49

260906-1pcbasgr9z8

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dpi.bat
Size 302B
Sample260906-1pcbasgr9z
SHA256 b1edefa5105f0fbbaf07ac6aef88ad68e014e67c480012fc5824bef74a80e775
MD5 06e77f3be8bcb2ce7b4331b73a666039
SHA1 e20f871a2bfeebd748343778862a25d5c81bdb0d
SHA512 077502a8510726fc4bc082be00da7b763cfa368afed8a8f1697903907a1813a003fa725b6404055977f67bcb292cd0027e2a06e0b5a1b210ef28fe9aa470e65c
TLSH
T143E07D3E03CC517CF78ED10120282002B4D5D0176E31A6E3A478B5301B263DFC8C1159
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	3528	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
6104	RobloxPlayerInstaller-C888TH27Q7.exe
5608	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
5608	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-C888TH27Q7.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5608	RobloxPlayerBeta.exe
5608	RobloxPlayerBeta.exe
5608	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\Large\SelectedGradient.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Vehicle\SpeedBarEmpty.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\DeviceEmulator\sim_console.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\images.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\water\normal_01.dds	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_zoom.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-24x24.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\whiteCircle.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\PlayStationController\ButtonCross.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\Unmuted20.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\translations\CoreScriptLocalization.csv	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\ic-checkbox.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\ImageSet\AE\img_set_1x_2.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL1.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DefaultController\DPadRight.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\dpadRight.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\RobotoCondensed-Regular.ttf	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Arimo.json	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\homeButton.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Input\DashedLine.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\MenuBar\icon_chat.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\Animated\laugh-joy.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\btn-control-sm.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\AppSettings.xml	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\period.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\DpadUp.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Radial\Alert.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\input-default.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\localizationImport.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\particles\fire_main.dds	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted80.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\ErrorIconSmall.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Capture\CloseButton.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\Montserrat-Regular.ttf	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\LuckiestGuy.json	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\DevConsole\Filter-stroke.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\water\normal_19.dds	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Slider\BarRight.png	RobloxPlayerInstaller-C888TH27Q7.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller-C888TH27Q7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4592	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
916	chrome.exe
964	chrome.exe
3528	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-C888TH27Q7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-C888TH27Q7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-C888TH27Q7.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332049687032871"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C888TH27Q7.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-C888TH27Q7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxPlayerInstaller-C888TH27Q7.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
6104	RobloxPlayerInstaller-C888TH27Q7.exe
6104	RobloxPlayerInstaller-C888TH27Q7.exe
6104	RobloxPlayerInstaller-C888TH27Q7.exe
6104	RobloxPlayerInstaller-C888TH27Q7.exe
5608	RobloxPlayerBeta.exe
1028	RobloxPlayerBeta.exe
5092	chrome.exe
5092	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeDebugPrivilege	5528	firefox.exe
Token: SeDebugPrivilege	5528	firefox.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
6104	RobloxPlayerInstaller-C888TH27Q7.exe
5528	firefox.exe
5528	firefox.exe
5528	firefox.exe
5528	firefox.exe
5528	firefox.exe
5528	firefox.exe
5528	firefox.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5528	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4632	3620	chrome.exe	90
PID 3620 wrote to memory of 4288	3620	chrome.exe	91
PID 3620 wrote to memory of 3528	3620	chrome.exe	92
PID 3620 wrote to memory of 4288	3620	chrome.exe	91
PID 3620 wrote to memory of 2160	3620	chrome.exe	93
PID 3620 wrote to memory of 2160	3620	chrome.exe	93
PID 3620 wrote to memory of 3996	3620	chrome.exe	96
PID 3620 wrote to memory of 3996	3620	chrome.exe	96
PID 3620 wrote to memory of 2756	3620	chrome.exe	95
PID 3620 wrote to memory of 2756	3620	chrome.exe	95
PID 3620 wrote to memory of 2228	3620	chrome.exe	97
PID 3620 wrote to memory of 2228	3620	chrome.exe	97
PID 3620 wrote to memory of 2500	3620	chrome.exe	98
PID 3620 wrote to memory of 2500	3620	chrome.exe	98
PID 3620 wrote to memory of 3844	3620	chrome.exe	99
PID 3620 wrote to memory of 3832	3620	chrome.exe	102
PID 3620 wrote to memory of 3832	3620	chrome.exe	102
PID 3620 wrote to memory of 4252	3620	chrome.exe	103
PID 3620 wrote to memory of 4252	3620	chrome.exe	103
PID 3620 wrote to memory of 1640	3620	chrome.exe	106
PID 3620 wrote to memory of 1640	3620	chrome.exe	106
PID 3620 wrote to memory of 4360	3620	chrome.exe	107
PID 3620 wrote to memory of 4360	3620	chrome.exe	107
PID 3620 wrote to memory of 5288	3620	chrome.exe	113
PID 3620 wrote to memory of 5480	3620	chrome.exe	115
PID 3620 wrote to memory of 5488	3620	chrome.exe	116
PID 3620 wrote to memory of 5500	3620	chrome.exe	117
PID 6104 wrote to memory of 5608	6104	RobloxPlayerInstaller-C888TH27Q7.exe	121
PID 5592 wrote to memory of 5528	5592	firefox.exe	123
PID 5592 wrote to memory of 5528	5592	firefox.exe	123
PID 5528 wrote to memory of 5860	5528	firefox.exe	125
PID 5528 wrote to memory of 5860	5528	firefox.exe	125
PID 5528 wrote to memory of 5860	5528	firefox.exe	125
PID 5528 wrote to memory of 5792	5528	firefox.exe	129
PID 5528 wrote to memory of 5792	5528	firefox.exe	129
PID 5528 wrote to memory of 5792	5528	firefox.exe	129
PID 5528 wrote to memory of 5792	5528	firefox.exe	129
PID 5528 wrote to memory of 4644	5528	firefox.exe	130
PID 5528 wrote to memory of 4644	5528	firefox.exe	130
PID 5528 wrote to memory of 4644	5528	firefox.exe	130
PID 5528 wrote to memory of 4644	5528	firefox.exe	130
PID 5528 wrote to memory of 1924	5528	firefox.exe	131
PID 5528 wrote to memory of 1924	5528	firefox.exe	131
PID 5528 wrote to memory of 1924	5528	firefox.exe	131
PID 5528 wrote to memory of 2320	5528	firefox.exe	132
PID 5528 wrote to memory of 2320	5528	firefox.exe	132
PID 5528 wrote to memory of 2320	5528	firefox.exe	132
PID 5528 wrote to memory of 2320	5528	firefox.exe	132
PID 5528 wrote to memory of 4400	5528	firefox.exe	133
PID 5528 wrote to memory of 4400	5528	firefox.exe	133
PID 5528 wrote to memory of 4400	5528	firefox.exe	133
PID 5528 wrote to memory of 4400	5528	firefox.exe	133
PID 5528 wrote to memory of 4796	5528	firefox.exe	134
PID 5528 wrote to memory of 4796	5528	firefox.exe	134
PID 5528 wrote to memory of 4796	5528	firefox.exe	134
PID 5528 wrote to memory of 4796	5528	firefox.exe	134
PID 5528 wrote to memory of 3492	5528	firefox.exe	135
PID 5528 wrote to memory of 3492	5528	firefox.exe	135
PID 5528 wrote to memory of 3492	5528	firefox.exe	135
PID 5528 wrote to memory of 3492	5528	firefox.exe	135
PID 5528 wrote to memory of 1088	5528	firefox.exe	136
PID 5528 wrote to memory of 1088	5528	firefox.exe	136
PID 5528 wrote to memory of 1088	5528	firefox.exe	136
PID 5528 wrote to memory of 1088	5528	firefox.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dpi.bat"
1⤵
- Executes a command shell one-liner
PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdc882c728,0x7ffdc882c734,0x7ffdc882c740
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,11701232017507658956,12289819102139867162,262144 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10481913735702434471,2144429537735564469,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,7488218978835167136,12181250992983975052,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,17030082314844859861,11907806197490280126,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,6763539730170714552,9269940923259078471,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,1294248356467425500,8149760879304345378,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,13800499840630213467,15320379052946370535,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13985760498675356691,17555573546910028869,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,7707575028095099821,8035297513025740381,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3336,i,2715921880238980543,1935813201781289863,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3640,i,6354524785162472547,18050899609167482440,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5996,i,5726711095150664875,14714638860089004728,2097152 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,11506002572887348915,13355276972355541840,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,10128981261948413463,12374411260422505956,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,12775769553060878326,2485186535031089988,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,7960819466511359634,171744631753135256,524288 --field-trial-handle=2108,i,1460546681456965583,520828867002966128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:5500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5648

C:\Users\Admin\Downloads\RobloxPlayerInstaller-C888TH27Q7.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller-C888TH27Q7.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -personalizedToken C888TH27Q7 --deeplink https://www.roblox.com/ --webBtid 1788731374781002 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6104
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27099 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {5116c0a9-8a2b-494a-aae1-3a19ab06e715} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27135 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {0070b631-2a39-4d27-aced-043678ebdf7a} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27325 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {82e69e72-e23c-457f-b7d3-c7e636451058} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27325 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {b86739d0-40e3-4176-bf7b-7b208dc79a14} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 34824 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2652 -initialChannelId {59d26629-69a4-4c64-80fb-f7f5a2c484f6} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 35012 -prefMapHandle 4960 -prefMapSize 270279 -ipcHandle 4908 -initialChannelId {39add9bb-5c5f-4784-b34d-73df35a935a7} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32900 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4956 -initialChannelId {d82b7424-c774-483d-9cbb-44525f98e538} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32952 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {7fba4d51-92d7-4714-9bfe-4bc6e49e3ee6} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {cb5c9e4f-4c18-4431-942f-e8bee2cee27e} -parentPid 5528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1088

C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc882c728,0x7ffdc882c734,0x7ffdc882c740
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,8115098978059501551,15484612456669947757,524288 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,13117125336190500475,18090362027886871818,262144 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16965938143366693075,18298664099952919331,524288 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,3588641505201551629,13723744939990380844,2097152 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,9448344807681822012,14068881990099569634,2097152 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,3508547316210692435,1949821647842602559,2097152 --field-trial-handle=2008,i,10034469755624023139,1930395643474960228,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc882c728,0x7ffdc882c734,0x7ffdc882c740
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1952,i,11362473029725679579,1827723246692077878,524288 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,16035989607116875263,7413508508134366254,262144 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2384,i,15331112493167347436,14190433708278903256,524288 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,2018267076804576700,12906395970920441889,2097152 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,843996974229904344,13682583206747038853,2097152 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,16552327678960164906,8743248189381684261,2097152 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5292,i,12078400583679924678,8810507605241235082,524288 --field-trial-handle=2020,i,12241968683963693421,2487792818558914059,262144 --variations-seed-version=20260906-030037.213000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 ba16843aff0ae092f7b5ada3cfa5a46cdc08a8c4d95854108939c6e7b299f49e
MD5 c915e742f16468edc1bb1337904c4fe2
SHA1 08fc874ece1c1ff330de49f591c2d05467e81432
SHA512 2892972459dcd2b182b05fc20797f81390dac4fe34011ccec6bdb5d8f00c51a5c5db9d46152f3f9d3fd51a9ce432e0fe97ff5db5b668b865eedcfc4831c322c3
SSDEEP 196608:7bkm4lWYZk1uGwLEit6yL6yC69Wgxpz9svGiDKxZl:7bYEQ0uGjUjL6yC69WgxpCOiDKF
TLSH
T11827BF4EE9D70AE8C6715470D0AF17E3DB22308C4A6D6EF78AA50121367369D2219F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 aaf079ed9afc9a46283c1f073ab5a7d641290078f9a4f9cf3731bc5ee3bcd574
MD5 88706e65fc1745821f56d27cbfe98427
SHA1 9be8743a9a2dec74f7c21de7f2a7e29408d25ee9
SHA512 349b21ed55502fa3439d34dfff2ff1ecbd828e3fd02fda86bb4dd113bc2f526b59ca9e2ac8340a2077bb222196238dba3f19262ef11d39414234fd2545242a17
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f7cf56dab774fb2bb861aa64537b04524344e85c26fcab855cbc08fc97b57357
MD5 6fdc747e1ca1c7d6d1a22c0bcde9e8cc
SHA1 dbc909a273e494076c3f5a17a612d6108d9a22bb
SHA512 a521771adbc10c0432492e35792999b8f19c0f568b68cdf9cf3543fd0c41b0a4161bb96f527c5f9b1390dd257f0fbcffc544e98ac4f33c4b9477c4003b31062d
TLSH
T170E0E5B9C861AC3708F91B2820104646E74003166A91880B3A3D810D8FB5A2A46B6C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ee5071e00175182766d735501c35e1eecc182a9cca3d823a65afa0adeba01f21
MD5 b0ea8c45bd6781ad03394d2f537d6605
SHA1 2d22ef2f8ccae0001b5ca001ef628684300e8de1
SHA512 44b28310594fd5e02be0eac822221346a528e3f04e4f14956797fe17769f1f0e5c3bc5bb5f054e486aa7104b5a94049defe0b5a9964051ff4b939e85023dd0a8
TLSH
T1DE5182C1ABEDE413FFA17A7D24B90CEB99113EEAE12E6B471568F43463136F714A0904
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 830e85f17ad9399bfa7df9cf0a5dea24db818d6c56ac27da4a963da0b3f8d128
MD5 3759a0cd4da08d9bca932c0d95deb067
SHA1 c8f743048988ffbe74cb218349d60922e581b605
SHA512 9a9dcc4e533942b07528512f3bdbbfa8c1ddd151b32df89156f71058114eed23afacac9e8fa2d6f53487f6335718766331a66746a06bea8fa3b43e8947637cad
SSDEEP 3:MsEllllkEthXllkl2zEkl/Tl:/M/xT02zn/
TLSH
T1D14404447FC04505C50011344011C3D10374FC100D11574335D1C4337CC55400C44110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 db36e8ed51c64bd80ce6ea460683ce8ed916372148fd7883ac4df589a05c5e6a
MD5 d73f288b9c7bf25aae6e1b556036cacc
SHA1 e5b86667e24d8fb768e2b39cc21d1ca2b981096f
SHA512 a9bdea7f4ad32c082e2613a7e1c48c35fcf7c1a373233ce69461cc7a7ab18c0341581b70ffc71ab0a1f5fdf5cd58bc206c37ebd36ec32068645643f3f49bf20b
TLSH
T146E0865424A9C76EA0A49863C375778D8ED17904A6CD3D67670A944232E1B0872D4770
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 be45ae5c63905f443f96beea193de48717d11205b7ceaf8aa9d3bbe76bd65be3
MD5 fb85f3accda73a20dc0ac3b85ed0a616
SHA1 e276772e477f16397f37b81db2d5172b61f96445
SHA512 7ce877ff7d94ba531745fb4843cafa2749f6d18b5a6438411a79a2a2bd3b5fe993937aba33864ef25b2400e9a0a48e75707f0240466f7d62da71cedb77b6910c
SSDEEP 192:ZcJP6EG0HG+6OGtG0QRAt0UAlOPA1qIKznKmyoaNWKmF4TRBH:miN0mD3sHHUu8KyKAfF+X
TLSH
T1D4D25CEB6FB87823EF958DFDB1296954DD33810E8F459CD4781880322DF89535029AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 5c822925261071cf8417acdf01ee5d4bcfdb0c3d8b4525efb11c2673048eb921
MD5 a311ba5d88716ed9eb052bf68e2d2c7e
SHA1 c1424bc98e5c8491309ebc6bd2c637f50552ffce
SHA512 e8a49b57d0a18f0c156834d8b2b38cec84a1e259d731fb581084520b8a1ae80b49c414a0f72501da79d9ff1fbc6de5ee9aaba5e098a36978c1b434e2abf36916
SSDEEP 3:MsEllllkEthXllkl2zEklP:/M/xT02zn
TLSH
T1174404047FC04445C71010344011C3D10370F41045117743355144137CCD5400C44050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 099c746792ecc0885eccc8d1762a281cf40d0e189b3f33d5ffe8be8e0d182a0e
MD5 3a330d771858abe8cc187f22b464aee0
SHA1 0e0d8e93ad4044bbe98cc462ec5e5580570b3372
SHA512 5321a54cfa25fd235f7b5546144ce319597574dfb8d39e71903255fc3a5f0dccb9e4328ecc8b85575a35c3dbf2687303b8029a2ac65ecee34633d6095fead2c1
SSDEEP 384:D73J/tIkUI3ijVYWNkqpVmthwssmAAgTxKQy:D73R64idkqXmthwssmAAgTxKQy
TLSH
T162F378AF6F657213DEB9C17AA8E241974C2EF02F874355C4AC712072CEE1663A01C5FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 38KB
SHA256 85ac2d6d5cae9eb7c363db515566f50306f2f2a08139351011b337b3739321a1
MD5 9f259da1b0d099b08086d0f0ddd6703b
SHA1 bbdf06c12fe3ddf6b2b65a46fcb72d09e416439d
SHA512 40e191c2499231fe7cf99b62a3f73842385e1f575f3ee287375c9ebb998949af034cac100455b18f0b145081ab12fe74c6da598f3b309e1d51ecbf10b27e3d44
SSDEEP 768:iuzgflJ8Xbge7iJJSLH8y86ZPwUgjPj9Jb6bDui9YxU:3g9J8LoSLH8y86ZPwvb6bP
TLSH
T1D50349CED7F8804DFAFB8B8B7FB7518548B5BC562C09E86E41141E1E4A236448DA2737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 cac9f6a5a8ac1c65d33b59462860182472838cfc09f19578264b390cc7650b62
MD5 44c0ecef42f9aa5efaf9d99b48fade50
SHA1 f724384a68a0c880bd1d554eb30ec5a271eaaed5
SHA512 9c4a6b0543821b306bc41a88b2b016445e828a4eb995a026a4bfd37f4c04985c12cc578b923d85199a3a3fbb9785932be56b44f558d0ec1492f642fff40357bd
TLSH
T1AFE0DF6025CEC76E2214901B83B5B78CDBF03904E6CD7AAA4B0AA440B0E850CB7C13F9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4f87899e048b38627cfd675e72631ebf28c22f069511daf806efec8cbea39d07
MD5 b5048a7a7c7fb89bbab0971493fd64a5
SHA1 9f267a6a9d6796c5c79141b15923cb81ed329230
SHA512 29cee26739f049db19bbb68bb147b35b9ea3f0cdd49284f5632e613cd93add5c1be20e88a7e079f886461b515db40f706f3401b69f5908e0290b7e6f176b9342
SSDEEP 192:DiTOfP1rqWaI0056SBUexd3III9IENPIaP4fP3evqMPWzhGfteIHA:DiTOfP1rDaI0056SBUexd3III9IENwaW
TLSH
T11F029DF3C3E8C66D891156F4AB156E2BCE1E0A24431C3C76C5D4BE5B93E2871E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 76219e8a839aba7eeff06ee5635fe587a93a226f8ecbc4bdde35f9ee805896d2
MD5 e4aa480ec69d2c6aae7a9f151e551ee1
SHA1 fd8c37d7010eea9f0b6d1860a4c59f5554189729
SHA512 8777f68c3e337c536a6ca5f322a7d381e46560ebfeb4a9455c2490569673c89595dc9ba1998fa3f0b6138575631842ec063944e17ef4a926678a659318a60b96
SSDEEP 192:DiTOfP1rqWaI0dSBUexd3III9IENPIaP4fPBvqMPWzhGfPIHWfJz2:DiTOfP1rDaI0dSBUexd3III9IENwawfG
TLSH
T12F029BF3C3E8C66D891156F4AB156E2BCE2E0A24031C3C76C5D4BE5B93E2871E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 9f242b6a9c71fc3e23e805f457a5c091d795351448dab61fd70e4070223bd755
MD5 7561d730d4434bba659f713efcb82684
SHA1 bae24e5fe8e1e107605c11b72e510679b61ddb1f
SHA512 05ab7d03854c104a51779f46d915ad1624b46db95c676814f28d4e4eb9168e7863d2d06ca0f84a25bae3e59b46c16e57a32a89ecfd5fe0afe16da4dc9c5c25ca
TLSH
T1D5519B57D2AEB44B613969FB5E047C0E6BBAB4350285B8F4DB52C27CB0825F74B02137
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 56ceb40853504bf345178a83617f19cf424c89220f667560bce7383696ad5f13
MD5 810dc0f0279d5e9edbe8a552e6361118
SHA1 93980246d96b1350aa8d79f410dea156befa9c37
SHA512 bea55985e238dcf7ed298869d93d1563d45002e3f4a1b449bc44dffba082e7f0f7973cf4a5a017d4c46de2400e8b25f6af33334447bb0440784c5f98e3275a8a
TLSH
T16951AA97D2AEB44B213968FB5E047C0E6BBAB4300285B8F8DB56C17CB0825F74B02133
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ea12e82caa2d56b873fafc9901f7b9612a0fdb0190fbfbe9f21f1492d8c0ba2f
MD5 072026707ebabf57bff743b657bde9fc
SHA1 fdf3875c91847eaf889f7f85c0b9eb4a62a2b6cf
SHA512 76ad3daab0bc26a97488cae64a543dfbfcfff9792c79ad0f6b73c580ef22c742d425e71ce09fe90bf925fc0b34f3394beda34332f7171062f07b0129d0b78e40
SSDEEP 192:eRycBzb3NWBS+v7cpAPRp2qFdVj9BHsb+WNZKT44sn12/v2VPCS/7zafQySVyIsH:eRymzbd6wUXlxrw1Z232VPNaLS8
TLSH
T1C352E72EB9A0697B5CD6D32AF926B717D3F5102225D42EC4E6FC892C14E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1d3f96b4a65bd68c8895d84e31994aa6f8cdff54cf6812abd03fadc85b1f6996
MD5 c1538c323637ccc66623c21caf773fe8
SHA1 9c546912aba0b92a763e49dd18efaeecdbdf04a9
SHA512 b95161ba6ff8f76817c5674d765aafdb951c8ba6f53360864359741ad16c80e43318255bcbac620121c8dafa1ef97141a047b7a848e2d91fb89d53682bff6d2c
SSDEEP 192:eRycBzf3NWBS+v7cpAPRp2qFdVj9BHsb+WNZKT44sn1D2/2Nv2VPCS/7zafQySVY:eRymzfd6wUXlxrw1ZQ2l2VPNaLS8
TLSH
T14452E72EB9A06D7B5CD6D32AF926B717D3F5102225D42EC4E6FC892C14E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 64c506eab743a525efb3e8a28320b4ae5a358f1ffe7e016d2b42b9c5dc234c54
MD5 1ce44730d896b2c8aca1570c93641974
SHA1 4911ae074b99aafeb1a6aaa9ea7c92c5cc0d9098
SHA512 f9630a80040feae66b3bfc9f270d4e806f45c595b6d191035d165d6b7b4617080fb0ad8f2cdac7159436e0cbd12c3b5882edde66b87f50fb28f54cd15a2b3169
SSDEEP 192:eRycBzf3NWBS+v7cpAPRp2qFdVj9BHsb+WNZPWT44sn1D2/2qv2VPCS/7zafQ0XC:eRymzfd6wUXlxrwFZQ282VPNalTe
TLSH
T15152E72EB9A06DBB5CD6D32AF916B717E3F5102224D02E84E6FC8D2C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b1d494f3d8fa45cf3e6b3741f2a12570d0083708feeff9eefea28e64c8e4945a
MD5 6833ee6d4d4d29ae816639ba8543cb4a
SHA1 e1a13b4332e0636328dafbec85a1a75dce26a83c
SHA512 4e135b3023326013480b756b243d95f76f6868991b02b10f6292a22cd1db631b8aa2d93db43d9f83536d30c344330114c9406e1c121f4cf23de29eb0e4a1e567
SSDEEP 192:SR6cBzf3NWB9ov7cpAPRp2qFdVj9BHsb+WNZPWiGuBsn1D2/2XZv2VPCS/7zafQn:SR6mzfq0wUXlxrwrKQ2h2VPNalXfe
TLSH
T1ED62E76EA9A06D7B5CD6D32AF916BB57E3F5102224D02E80E6FC8D2C15E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 69deea4e4f0919b1d54acd408b800e6c695d967a8c64abe687a00c372c6211f3
MD5 034dd998bb9b185296bd95304ed163a6
SHA1 f3f99e73b0fc98daf87d44bc99fb6abdc416c21b
SHA512 444cae37f14650ebbdc0d8c10771309f25531a16eaa2526e7fece3180cb1d7665e02c0520d8dbece254c6b9702677e40be047a0e7fe826e21543e0914cb627a5
SSDEEP 192:WRLcBzf3NWBnVv7cpAPRp2qFdVj9BHsb+WNZPWxd4sn1D2/2Ov2VPCS/7zafQ0Xk:WRLmzfclwUXlxrwcZQ2A2VPNalXfxe
TLSH
T1DF62F86EA9A0697B9CD6D329FA12B757E3F5102224D02E80E6FC8D2C14E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 6eac95ae824bddc32743288ecdc217b741c86ecb3a7544989091c01533e5ccc3
MD5 6295ec9948fd510d2b62eedfb6602e0a
SHA1 6c8a23d38357556e9f86a5deed25fe0f47156727
SHA512 7b6cf27d308f298e9a1c567b0564fa33b0fd5dbcac1cdd5f3ce1449e7262b50873952f46245257d66a3fcb82766254f961965ecd185d37e6afdc58cc8f331069
SSDEEP 96:F1mKjMyRwcnDh1JA5SLXbXFXKXTiqFXSXTqXFXKXTlqxhXsXk0XbXNXKXTtuZXIX:F13ItmDhocL1ajikCjq1ajlM87L9ajmK
TLSH
T1CEA16C6EB509184EE4AD093ACD78571B6F69CF0C27FE3767A9DF8A0405B4A5701086B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 2c63b05eaa4d5a17350a58ccf5bad57e9ca08368cfba956ae6a0df337bef4ab5
MD5 21c867298326d14e34743fd5f990e713
SHA1 7387a2ff41d60a377de04178286df0edd532c6dc
SHA512 f799bc6890d26590efc952fab6d9398d52c7cd7e4bce2401f7bce386d5f9e342b727506e90addf7032883196bacbd2dbbf6fabbf1b67a5f71aacbdeecaf82a34
TLSH
T1E9E0264425E8C7BE6069A0030371938C8AE4B805D2CE3D663F46C54022D6A0C72D1770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7d1582d34f5c04c50ab317f7773ededd9a2215297c2649797b2b75321dfd3b36
MD5 7fbdffc80b3626d55b3551c281a49e85
SHA1 5c1251a4a13d9aa1370b916e196866cf7a522dea
SHA512 a6007d3da31b5e95570d9f5941ce2987e7229f515288fb220c208d6d7d4ec01cfb8d562bb5d218c457e809d6240eb26fbd964b474b45d16c06b8e66bf909f41f
TLSH
T11CB01241D4055101C02303F8115354887124DF249A0A170183E0B936983555180181A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58beb7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58beb7.TMP
Size 96B
SHA256 446697025a65128187eae040faa978bb156fc80546ad87a2d0e1ccad0dcfe8d8
MD5 5a0151ddedbc5e1c9736911358149f07
SHA1 8ac039551ac563edea97bc510d8b27d8a569e2a5
SHA512 acb7104d3bd3b989baa497198e9adb95019715782c9595f187d2cafaca9ae4fb756bca025cafff50f7137cf3afa56183c41d1fbbdc95d58b4b72520c95286f85
TLSH
T168B02200C0032382E20203F028F0E0C83230CF20CA03020283F02EB2CC20A228022020
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 3a2d5ad5093d2566b6d4a77d1878ae3779f313c51892d93164769583735645cd
MD5 43629e92a374ace864a8ef906fb142fb
SHA1 badfa78eda59a2c3222421a23cae5dcf73f04880
SHA512 9f6f45dcbd97b7bd9014bf05f3ea278657ba86f7dcdfd2da2d5d1bfc69bf835c5e171a8a5cf0c34a4d2cf2f4172e5f5a3f3f3cc18e98dbeeafc761c65d73733d
TLSH
T1F13103F759C8A025FEFC85B0ACD563649F33E42D2F544C81C7103B9D4017B42A9421DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 2d5c340f6316ebd5b621316bfc2c1421e96092bab176377c5c45e6d8b56c9ea1
MD5 df2269ea6fbf765376fb56d1543b97d8
SHA1 13d1263a801ff50a05de2ae4ac052d5cc1456ff5
SHA512 259a4682e821300a1eefc8eaa5c202261bc7f7c66a55f4487eecf0f75cad500406a9e21f25d2dfbc8a89e32bc600adf1bc06e6b9987198cc90a84d353d096b67
TLSH
T13BE0866424C9C76E2165906703B1A74D8AE17904F7DC7966170AD44032DD50C73D13F4
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13433204995449719

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13433204995449719
Size 4KB
SHA256 0c4d1bd57e9ae3ff697c6704e8d630b14ee5c16445f7bec62cc5e2037d2238b0
MD5 b19efc5113eaccee540a767441261446
SHA1 b328cab1575f578459136261944b3b5e2ddc65bf
SHA512 2dfcdc24b7d099f726c666eb28d67fed7d70492f6325138047a188c6e819bfb5c5a52c416d285efdfc373518db1bb245163bc5cacc50099fd22be4e938c89d87
SSDEEP 96:3VTpdivGyTrE3TrZivGs3lqivGuivGCjGtc66eJ:3VTp+GyTrKTrSGs5GrGCjGtr6eJ
TLSH
T184A1DF63A9F5803EF33FC87DE9F561F5EE76B50269824D8A902162010872A534B71FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 6d07fce5b394e5130cc32d16c4a0a29503a0b822247c8f57bd7114d5715200e3
MD5 8b2e7e8b1be5095796d5877727d5b09a
SHA1 62eb2048ad59c34c1517ed45357c3a6691bc8949
SHA512 a488ee2c554e33dcbbae3f5352524ea9454b625fe1b3fcb3234d9e6999f2bfdf648d16a0372dc955929981a7f917dc2299a4f616e39865244651f5a7d0178713
TLSH
T133B0240D1104C0D3C343077D7CC5C0C077303C301F4344070055C05040153C74135340
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 3f4dd324f3572f79b0d8b7dc4e294ccc4ebdc1952f564b4d1d75f5cc2ae768ce
MD5 3b17a5572a25f7bf07fbd3479020f21a
SHA1 367ac51bf9575c9014abc5568bc7107e6c99763b
SHA512 358bb2432c1f623c74d1e814a19788ca6a253b4d59398d61d7f8637c33f67e46df600e0ba5537b9a620abc6d59a00e2e50c765f632b1a2adab95ac3fff8d5f80
SSDEEP 48:TVOIy4m1b3fbUtbq0BksXJtkNv4m/OIu/3q/TXSqjr3Z:0LkPxq9Favq/OqrJ
TLSH
T19E130DDF2D14B586D2E8C175E06AAEAE6D3F215C4EC398C558B016B31CD18685C1F1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 b16ec40edfd0bae2e991ffbeff25e387f23e05e7f3d5e831630a0a923fa22ff0
MD5 ae1a8b6ff880260299149415b8d186d5
SHA1 4899e6691fe69c24bd6d06fa41e216590adea99a
SHA512 4034d455796aa8cd22c1d3187c676eb79ad27fd13aacea57fb0b179610d3c0045ff7f02b7cc9377f6154dbbfa585c0a46ab2ac9e5dd97871a0f9683e074f43a8
TLSH
T182C08C0877705206E8A822B61B865B442B00F012A072C1B3DC542B46CA0BA552FE4DE2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 a8b6d1ac796abe5bd4bf5c302d7c274f6d3f6116458a2a9519ab9b8554dfbe26
MD5 786b2a6eb8034f53bfa9603a07cd1534
SHA1 79bcbeb29befbe3ee0716fc63c9470ecdd64e638
SHA512 b655a83b4fa8a8c3a738c4b4d34fa8a2831b0a67992dc3f1262cf26eb80bca0c14e42d6696fefd65413e12914b1c4d591b9d5821757cab062b499f6318c48163
TLSH
T122E0202427C9CB6F6156501B9361E74CC9E2B904D6DD65751F05E580B38950CF2C3770
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 bb0fd1171d456081481c7f555c8f1fd130eee74890f6c7d239f495930a8b674f
MD5 23cd493adbf454c6364976eef0ce28c8
SHA1 0748bf175e9e38a6c444c22908d6de427dfcbd71
SHA512 3520b316391d5f0f44b8c47d5d3270afe7923ec14ac863c47a7482fa4cbd0aadae6eb675a29110ba284f000a31dbf064b6d88121b2b3aacea783f5df609d597e
TLSH
T1D4E04FB825D98B7F6154905243A1A78DCAE0BD0497CE76AA5F055889718160C72F46B0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 749f64aa6cabc93e986f997efb78e0ad58dcfad483471c35305fd03a9fa6abca
MD5 22abc4c707478412c5c05fa65c1ba876
SHA1 2087ee82706ce4c716350c9fee729a765b640e7d
SHA512 3026f14a6b432b48557f1063fcf1921a5819b459881c8334e5772acc906e273d96e88a98debab552c231c812dc7ea42e87c4d3dacd686e4a2393f22421115b6b
SSDEEP 96:f7doKsKuKZKlZNmu46yjUA6ugXwX4C+XSXaxw:7ZT0nzXA6uggWiqy
TLSH
T11103428F6A2890F3D0B6C53EEAD645D6FC7C190CA723B9D111F94B614EAC077A0481A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 96adaf5b117378b81c1990c3b462dc3263fdf7f007b500298c62484440658904
MD5 462609b8b51c4dce2f9fd3b9263301e0
SHA1 9f832bf44f537c799c2c063d48ae07017f504fae
SHA512 9100beeff7a023c9053b9e904be61b7167057e267a2a8760ec824a0a7854e6b3810981dcfac750220614963146d4a81e88770cfb1df9970e7e4a7207a54293ce
SSDEEP 12:jkikJ/qIvnVuN52Gtuz9tJgtwu2PBXXwX4qBmLULIzX+y:dI/nvn8ludFu2ZXXwX4qBmLULAX+y
TLSH
T1F902ABDF7C44E0CAE826047CCB9EE85E6A364CAC3F93B85252F8890364BC413904C3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 29KB
SHA256 24d5b14ec7a7454bee21c762c62d98bcf540c0c0ffd527f9513756f370a79a1c
MD5 6bdcc2663cec6326a42ad5da4709efd2
SHA1 b582262fae5693699e7c45887781e5f15b3603cb
SHA512 e38b472bcb916138077731af2ed79fcb65ffdf4c27c49118feae56762fd84ef5b9181f7cbf40501363589c7fb54d824ec6886ea0c0e9b8b01d444e37ec22d20e
SSDEEP 384:I7UJsdGNbtQXIIImbGMIMNB1hCBsdGH2IEVsdGSvJGsdGkdG0/ZQfuEJFSisdGkd:7btQOf1ZP19
TLSH
T10ED2B5BA93B01A85DC8F97FBBC64CDAE07739C498B850041A0A296FE3873D175D8135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 a93eeee4e346118c081876b9bcbb37db57f3e2eba68daa38844957b355a8301f
MD5 e06739f7f5e75eb769fee0b708eef39e
SHA1 5823ec241ec0d03cdb277341239f7466d544b569
SHA512 ef5d24654abc0b51c0e93b776160ec6e0c82b051c959d14fd27c07742d63112f8de317a109027431ff021681c93e8e8c5170ef9dfd6415408d60c667625cf0bf
TLSH
T166E0DF257AC8C7AFA025902743217B88CAC2390AEADC25AA0B0AC084A0C020C72C0270
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 57a974a6babd110d27425d4159abc6cd01583809ed33f0e212e6119a46ae71eb
MD5 67ec453095e872bfa7b65d9ce5b3b280
SHA1 4f1ba3b01d4fa4be037fd5c50d22f1c740505a3a
SHA512 b3b6bf3187df1d4727916044613c783a71d1bfd6cb9de16741a87ce6256562e589280cdd053cd779801157ca6dd862eb33d8acb926585bb15d82ba1544c9bdd7
TLSH
T1D6212855F332C104D649877A247EAB290334C8679FF8ED0F25B524687FB2E540D472EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 a4f702d4616944f877b5a0437a1d0026ecbfa67c44d98e2db99fcccd3f11bd4e
MD5 0fb22648947a80196dd643f1ca3734c9
SHA1 abc0f6822f1c90326d5215eeec28df8ee3f8a1b9
SHA512 1ebb2091f09622034f27ed9501a0dcf5bf1510500736df5c7c3ebfa9319f6eb0f3b61d232d74ec4bf1ff19cfa2c7b9da35d47d748d0cd1db9d9ac484a1cb53f9
TLSH
T16BE0DF257988C7AFA02190334361BB88CAD23C4AEA9C2E6A0F0AC884A1C020C72C5270
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 cc6dc5723b4ee6515bd2603325b433fcfa447db3a95637073d31bf50da07ab23
MD5 46770488d234cdd026b2b4ca9ace471e
SHA1 0a91272d600995b865bdfb8f913a296ca2644e7b
SHA512 b7e8070ef228c28f56d41895b2ecdf75b339660e1ba889c08e57294a6abac07c9ad0073c8377c151bbb8e58c44c3ad770a8fff57f31056bd8668ff3563824035
SSDEEP 3:MsEllllkEthXllkl2zEklYsc:/M/xT02znY
TLSH
T1FA4404047FC14C15CD0050344011C3D30370F4100D15DF43345345135CC55C10C40040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 7880e93cd4e63ffbd30f4ad2d40005762ef6f073b34003eba850b74a8c4697b1
MD5 79ccc2fb8e039495d0379ae80d34c04c
SHA1 68d69cb35c6754beaf62fbac2b9fa49ea985222e
SHA512 fce981521367ece619431c06a6a20ae9be4bfa7412f81504321012a783b53ee6357af3ea24dc0ffe0d6c052a01a0e3b8842cb229f37718ef884bd1c9f7c09a29
SSDEEP 3:MsEllllkEthXllkl2zEklcU:/M/xT02zn
TLSH
T14F4404047FC14C15CD0110344415C3D30770F4340D115F473473451F5CD55400CC4140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 a2136def0207d136efa059ebf59297137de6a86a1e18705bb774404af8e558a3
MD5 88657234bfb40c40366477a60369d700
SHA1 745aa271e2e8f0e684e903c5b224d2d2c5c55aa7
SHA512 1d57bc4dd0f07857997821a6d5c3d9d15618a1b784e25bcc2af305c5a9e284cce88a3442631f62c44ec827dac035d2b2b0bf749d77bc012f96e034c3f911ad61
SSDEEP 3072:SyBNQZOULNpSEerzntMb8gmD0SpflYte1wefCOx9lfU:ReZVsvtMb8gmYSpyMfCOxQ
TLSH
T188D312B4EDFB9937464D9DDD104FA746CEB1864200AC9596C38C0FDF246A26C07A3DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d2d630f5215a3dc83907aaa66e10f17ca5097ecb865c57956c337973d8a1ea83
MD5 0031e3d871501ecca8168e87c6132618
SHA1 59daedf6f519003f091786d4bd32fc6dcc1961fe
SHA512 396d1c2b597a34d1cefa4f9e1230f77faa014abb924028e55af18aa9dc5ddea690e49ef05b02382b94010bc1a3d4239acd738f02052585142aa2c6ffdcf471f4
SSDEEP 3072:SGFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:fFmUi21rSm8uUVNSlzY/
TLSH
T118C3130076E3E8F2EE5930447BEE2A149D6C0D818191C64152739D419DEF3C75FAAF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 83821a11fa224a61d5c288f2ce59d33ce8e54d925526ebeffd28606cd088b7a4
MD5 324ee7a36537da61a3f243d343a378d0
SHA1 d3459406c0388abdb2cb08797cdf2bb91049acda
SHA512 460bb8d05aa43381af0f36adb1954211e4bc53983900b9af521679e318d2827697810ed6939cf15ee2f872de9a96c2495785805626bc05bb4333882df6e89b68
SSDEEP 6144:6eZVsvtMb8gmYSpyMfCOx/FmUi21rSm8uUVNSlzYD:NovtMb8guNfCOTfi21b8j8zS
TLSH
T194342210ADF7E8329F4D24D821CF6714CE754A4141A8C542835E5FC76CAF39A0BBBE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 020c7d0195288f696ca9ed8689b24c98e310f824df0040138a914e3e7fb482be
MD5 dc23cdf0aa615ef7ac647e54aabfee42
SHA1 761903c76ce91e546ee40234ede0043c4cf75932
SHA512 bd253f767a70dc03f36f92c69577c11a52454bfae03bf94ba0243c977dc522d9975f9f91e81296d80ba047574afe80f9b1e63db096d73b0182cd7bd20fabd171
SSDEEP 6144:deZVsvtMb8gmYSpyMfCOx/FmUi21rSm8uUVNSlzYD:EovtMb8guNfCOTfi21b8j8zS
TLSH
T143342210ADF7E8329F4D24D821CF6714CE754A4141A8C542835E5FC76CAF39A0BBBE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ed92cd84a80e65a507d4ad013d3d7d7c84152a1377906cf4d7d2ee621fd475cf
MD5 78fd360420b4f12005f905d9a3f7bf89
SHA1 f230f7c4ba28131923621e07e676f64079f1bce5
SHA512 10df22681c477f356c6d457c7d7bae579b406f7d25355ccc618c6edbe384cf41e1d7234fabc56437a6e950d026d1095f5c19be7d30aaf110dd0fd209ba115427
SSDEEP 3072:SEBNQZOULNpSEerzntMb8gmD0SpflYte1wefCOx9lfz:BeZVsvtMb8gmYSpyMfCOxn
TLSH
T186D312B4EDFB9936064D8DDD104FA746CEB1864200BC9596C38C0FDF246A26D07A7DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 e3267d967cab1dd6724c7eaaf7a012c285477ba3ce05cf13c9262590d7a2bf2b
MD5 42231a9dcd6fd2656d50819ff5e922fe
SHA1 b8c1ff851a64f627f8f69e0790301fc89dd3288c
SHA512 3b7081f5a7867c821de718bc435760e6194790d6a9bc527d2a88a8fcde0553a14afffb313b09d57b31d26602e4c6d9c96bf869e841e3059690fa95fbaeb26ef9
SSDEEP 3:MsEllllkEthXllkl2zEkljpl:/M/xT02znj
TLSH
T1554404047FC1550DC50050344011C3D10374F4100D1557533451C4135CCD5C10C40100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 682e7276d8671468e2b00331d1ba06858fd340f9fd54de2500c01949da82cfb8
MD5 6e902fc08f7a648e11bcce8ba4abcd8c
SHA1 4504b6cc6eac839cab822065ef792f295826f8e7
SHA512 38de16b56cedcc074eadd6fcdf7490aed9ab6fc7a130a854709f4783fb23061b8a7c578e1d01c25f26a00105bcd85401175cadb99993ca90467fa3d684c33267
SSDEEP 48:TkkhCU2QB2zbBxxffKxH6DMBnivG5FwivGPf:QUcfc6DMVivGDwivGH
TLSH
T1CF23D04F1A58319AE1D2483FFED28E517C7E1F59CA1B69D144E009734CE14AA602E5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 d113c58729ff8b4d111f7ca5e86324f7858a30333dd0fccb6fc026edc977ff91
MD5 2f83d96ea174c6f62fa4e7671c478707
SHA1 a935f48990824c17d3b366f7c48fa0311fb62f8d
SHA512 1e872c922cd889c76ae6a1fb48f8ce711ce7908b1e8c6e96edfde4e0b83790e66d80c7ddf046bc417dc09fb5d7e78860a0b5493075ff3ae3c5fe7c6335fe286d
SSDEEP 384:HkCjiO024Y2DL84KKDL849B7SOEAd9KVRaAcP+AWRMAA:EzZY2DL8lKDL8CB7S/AmVAf+hRMB
TLSH
T129729D7D5F003CBC1997C0E8C5F9929A8D18B7A7DFE6C0AD21583D0DC698A69A0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b5ca6f9baf09d242bb632f12b6d15881ad41d0f02c9faf08918e5c5925f1068e
MD5 939f0b8daf82aa1a5ebfdfe5434b95f1
SHA1 2c5157f38f609a4cca7bf019485313af81480c91
SHA512 44a25ee20f6a2ed91aa4a3e2bee403d5581b22e8e3b798de593d1071b22f8b56475c9cee7d0f1d28d312f8176f735a4dd2af83398ea4fed94e311a353ffc5182
SSDEEP 192:q1d66JozGzgCl6mc0dqQcOv5zboPFZxLpyjO1cD:Ud66JozGzgC1j9boNZNpyj3
TLSH
T17CE12D64E629823FC408027BDCA21F410F39398A984E3F2935AD741D2C8B2DD779E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 81614bed537e45977f6f72b635e3d9852f5ceeacf3862f78e28e049db95bbdb1
MD5 60796cf01fcd232af25929f99f3fefaa
SHA1 910fca996f3aa2af8aeb55f71ba286e0197e4dbf
SHA512 b653f23a75078a239b10d02f6cdab122886b24cf53349706879ed5275167b814309ffb51aa576fe7add0b786bf36950e745b6f0da4801b25419dff6e3b3517d2
SSDEEP 192:MQcOv5zboMbxLpyjO1cG1d66JozGzgCl6mc0dz:JboMbNpyjEd66JozGzgC1jd
TLSH
T19CD11C64F629463FC408023BCCA61F414F39395BA84E3F2935ADA4092C9B29E778D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 863c5f580aec70a692ac9b70fe8e562dc7d96c4dbfdb58640b6437b7a37e34e2
MD5 aaa2bc1b95db6b8199a2606b5eaa35e2
SHA1 45bfba572b2a003461eea2f73a6169262517d2f0
SHA512 cc75a6782288ea565b5978895271553979502f6f08ec8bd8bcd0d019aa72751fee4052b8b06c0118eb3e8d1c642db2ed98fce69f5d093f31efb4f982593eb799
TLSH
T17021619C39B84EAAD9C7F2DCB440018D63514E07458B1D930E22EF8DCE815EA336A57D
MD5 SHA1 SHA512 TLSH

Submit Download

089ca89a-cf7e-454e-9caf-0c121284bde4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\089ca89a-cf7e-454e-9caf-0c121284bde4
Size 235B
SHA256 600af75417311f14c83a6651fbe470a384ad8270ab97b8d50cae66a2d15440e6
MD5 a236d7fad4cf5af9e103906e492f53a7
SHA1 bac60bdbd9bf9e4602e2ccbfbb86e37cccd24913
SHA512 35162132c12f9bb46bf43d213b660aa9a126c37385bf3e6addb04db034b54de52fa9331dd02cf72bdbdc8cbbfeaf1fcfffb4bcf2d5a3ff4ca42a14be870673ee
TLSH
T1FDD09780249C636E08044F0BF0E028C630848C331465683087B104789AFEDC84221C27
MD5 SHA1 SHA512 TLSH

Submit Download

37f69606-8093-462c-9c28-a7b3ad481fb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\37f69606-8093-462c-9c28-a7b3ad481fb6
Size 883B
SHA256 f6d356ba4b31664b1022ad1da795bdf21751b0a2d79bbc33cdc1fbfeda9a3255
MD5 8c48a952138a329b00154ae0d07f7530
SHA1 53136c7b3a697722cd9051f9917acab73f8e5cfe
SHA512 a8fae0ed64988e55dbbe8114184a5179497663ba8116ad2c9beefcb3f9afa64719bc03950126b5d60ca280bf689627eccc7ad275645a9df763686d141a8731d7
TLSH
T1D0110041A635B5B28C7CD24F85953B068BF4762380C955343EB19A181DBF92E93AA20B
MD5 SHA1 SHA512 TLSH

Submit Download

605a7ba4-244c-4c6b-9471-a0f35f774c97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\605a7ba4-244c-4c6b-9471-a0f35f774c97
Size 2KB
SHA256 a349b3399b6e8ca9a00f373a317a96e87cea26801e9dc892060ce133b0dcc7b9
MD5 092e08a50e1508b1db18a9221f5726bc
SHA1 33a4981bc383fca42deaaf7f9afaf5e908919205
SHA512 748977b18af8e757b7d2da6fd48a0197f4982b922f253923c5ce0e003740ad942ae2f8eff0c2701eb5c72b9658aad91191fd4375afc2681354f95badf03bfb42
TLSH
T15241335C35B88CB74DAAF19DD892338E57A44A4300C61C532D62EF0C9C9AA59276A43B
MD5 SHA1 SHA512 TLSH

Submit Download

b5fed03c-c07f-4922-92f5-131ee98f104f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\b5fed03c-c07f-4922-92f5-131ee98f104f
Size 235B
SHA256 db24e3840faa5bcf34fb1c58ef6c36a7a4a1d8a72d826a3f50503ca3c25cc070
MD5 1366937c4da75812d842fdabb845eb30
SHA1 facf17b987594bf6769cad76223ab735ac61d034
SHA512 3fde294491b8eabaed8a4feb0f723ede60d539030262e0ecfcdd4bf39320388d349f9c13cac901644293f8a70cc289a7f1b283c0bf93a7096e250b98ce60c696
TLSH
T1D5D0A78564D8ABAE4A150F16B0E0A9D630D94C33247858649AA145789ABDECA5161826
MD5 SHA1 SHA512 TLSH

Submit Download

e2ed55e6-1839-49ee-931e-7084d604cb74

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e2ed55e6-1839-49ee-931e-7084d604cb74
Size 886B
SHA256 1c807fa2ab19aa6e13645c73939d5641e67c815543ade097d446075cf6de7b52
MD5 fa3a5fdaf6091f761d584a47b9f80d55
SHA1 fbc2ef0e8ab092eaee00e496e161f21349ede6f6
SHA512 73970b1f0791dece0ed2da0ee794bfea09ab2698bd034123d94d9729c68f00ce23e944a4d6d9dacb2496299ade8ef10f924ec5495344e429803ac42d89afb762
TLSH
T13E1167415675B572CC7CD15B94A17B428BF4361380C95E343EA15A180DFB41DA37630B
MD5 SHA1 SHA512 TLSH

Submit Download

f8498ecf-6287-4bb1-b304-2010b6d092ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\f8498ecf-6287-4bb1-b304-2010b6d092ab
Size 16KB
SHA256 f013e036194fcacceeb801881cecb33d76324d2ea15e79a01d1f31b3f969f7ab
MD5 1d3c02062900d11b0fd58a8e4e02ae27
SHA1 9ca3d2b6ebe420deaf2756a6406a350965cfad43
SHA512 268e1acd850f5fc196a539eaa0655328f398846ccc5c43edcd2b683d7842d18506041f1e23ecac11084640f319267c3f1961ea60046bbc4d682bba695ad64ebf
SSDEEP 192:8MOY6PB02JLbpqAMNyL6IqRDFD/gpWRj7Cv+6myYSzxRi1aKRw1LGZ7uEB5iPuUj:83YkBjDJW6+6BVlRi1aKRRZyEyuI
TLSH
T16E72E816243045BA8651E798D8F8BFC3E5F528CF4C419FCA9BE4BD086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 f46fb27ebddb752a9e4bbbc9209f648d345a6d50f4e7773d5c724b4699532c2a
MD5 c295a225ad1d6ff0b9f8c8404909c089
SHA1 8db72a09c02a9ccb435c556f7d231c14e1a96182
SHA512 91f66c593c40afb6e857f209e4d0c1d06f2b453f6b8da5eab2f0626b6b034e8ae8b1a0d6d108a482eba15178dad8968eb4bc499be7345dbdbbea08c674dac738
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4HVT4hW:TI4vRf2XZ4D634q4V4c4D4l4M
TLSH
T12F72511545049EB8294EA79BAA367E01C37D433B70845C38F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 8KB
SHA256 fa1e0f802f1158e20179b084cbc3490f3938d28144ec322532b83ce546a3245c
MD5 963da8b0ecacf63de3b1cb3de9efc8b1
SHA1 947ef1b36db8ba23089f01321d36dd6ac105e502
SHA512 2b1614ae8c46859df5f8ea39a0389106340bdade41b0a0dfae351e884631072750914fb64097c3ffd2b253cdb6d734a5b2d109b0c714eebaffe8794aaed0ec08
SSDEEP 96:xHi+JTUHqGqgafb8rObzSYTSSlmdv9jhnuWRc9lNdHW4Bw888Q3a8L4cn3XH1:k+LRgafb8raTSSoRKlfW4Bw88n39V
TLSH
T157020E785104CF7F65B676BCAC2448706A72023BB7BF68D610B998C5015CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 a1a301ed96b92512611339cc28add9c768af53a2d068f1b1eee61b9afce447d4
MD5 af0b6e5c10d378237d57f85814bba8dd
SHA1 c243d3b559b9e54e2a0d2abeba44d1d20576fbe0
SHA512 0fab13b60a6368774d7fad9945c4872a202b56e03986fabe9f1ad540d081e1139d924950878196d8f1f7100d64d20814db847faf314c3118772f4ad3e9c3cb2e
SSDEEP 96:xHi+UTUHqGqgaf08r1zSYTSSlmdv9jhnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf08rtTSSh5lfWTBw88qV
TLSH
T158E12E7894088F7F64B677ACAC6888316AB2013BB7BF68D750B594C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 52a972f61b2c519e8ea20b36d36543cad796ec92dfc9d60a30f0aa006cf860a5
MD5 a7622588a736466a22a31e542f6a5130
SHA1 76f826e6cfeee4350a1896867fb07c0abd6c5df2
SHA512 2076a01557b29af3b55ec4448392e1ac836ce0c8023495207eaf7963fd559db24d2fd4c2a4f6d79ff28661bdd121aef67c826b3ed65d3e67d20f7883e8049236
SSDEEP 96:xHi+JTUHqGqgaf08rObzSYTSSlmdv9jhnuH5lNdHWTBw88y8L4cn3XH1:k+LRgaf08raTSSh5lfWTBw88VV
TLSH
T1DCF10D7891048F7F65B677BCAC6848316AB2013BBBBF68D650B994C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 7f9f1675900ee4d38394b9811abd830b9c87fd9a936df874927fc7a5bd965d9b
MD5 5d090e53039f8d350d456e16ac246da3
SHA1 f4f261cccde3bded44e8f8617aac0919f8c54216
SHA512 1c35fc4da09866e179cd79b1da7bb53ebb89d51b4070a911a6078659a8d129c0195ad870792eafc8e258d601e146b6006bc4403cbc98de7305bb22b1bc5e3475
SSDEEP 96:xHi+UTUHqGqgaf0io1zSmSSlmdv9jpSnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioHSS2B5lfWTBw88qV
TLSH
T1FEE12F7891088B7F74B677ACAC688C716AB2013B77BF68D750B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-C888TH27Q7.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-C888TH27Q7.exe
Size 13.0MB
SHA256 6819f279a5f123fb453c9b9192fe98802a896973b0652115fe3a1c06f1c2345f
MD5 be4ee7c43bebc9dbe029421e585419eb
SHA1 39906c7fa61061f19038a387e4ea1ef0151b0f8b
SHA512 9c01a4814685865f3939841163c528945fcb912f7ea0800173c2920953a139c2f07fb8988080263468533b6091f0f8eb9cf8b7992568386915a5ff1d07bf4555
SSDEEP 196608:Es6Sk0cVzmY5pSVlYL8dg7CwqOrNN5QCJ1IsvE:ErpVzTSVlYgdgOwqcYCz7E
TLSH
T186D69D6AA2B800E9D4BBD17CC6565603EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download