ef8dedce199fba20c70c98a6157ddb530261f8f4264ac9893362185697451a45

Resubmissions

11/10/2026, 04:31

261011-e5hmcsxz8p8

11/10/2026, 04:03

261011-emh56sey4w8

10/10/2026, 21:24

261010-z85araat3n3

Analysis

user interaction
yes
max time kernel
958s
max time network
687s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
erto3e4rortoergn.exe
Size 3.9MB
Sample261011-e5hmcsxz8p
SHA256 ef8dedce199fba20c70c98a6157ddb530261f8f4264ac9893362185697451a45
MD5 2c00326ffe87a343374f0c44e9f697b0
SHA1 c6e6a5ec556da3fbe1819432e34de6c39b9e39f6
SHA512 fc3749688d0f19a3088e7b8790676471bf9f9aa0dd6c8e944a67bb2b1664fb6e1986cf0329055dbf58e78b8152f1ca51985d56e736547ad7e981ea80442a72e0
SSDEEP 49152:J1nKtrhXwtZ+3J2GkADM8XKcvb+UsHbJ7kszf6EzQbvMCJIWnQAkbFGvGMdrg66R:jorP/nXHbMtkZBsbFGvGorgvv5fP
TLSH
T15B16CF56B1B810E9D5B7D0788A879907D6723C49033597FB22E4A6352F27BE14FBE320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
81	4688	chrome.exe

Executes dropped EXE 30 IoCs

pid	Process
5356	RobloxPlayerInstaller.exe
248	RobloxPlayerBeta.exe
5484	RobloxPlayerBeta.exe
5824	RobloxPlayerBeta.exe
5880	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
1872	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
1104	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
1388	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
3492	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
1088	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
2140	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
2964	RobloxPlayerBeta.exe
3128	RobloxPlayerBeta.exe
6056	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
2640	RobloxPlayerInstaller.exe
1468	RobloxPlayerBeta.exe
4264	RobloxPlayerBeta.exe
1096	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe

Loads dropped DLL 14 IoCs

pid	Process
5484	RobloxPlayerBeta.exe
5880	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
3128	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
4264	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4380	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 42 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5484	RobloxPlayerBeta.exe
5484	RobloxPlayerBeta.exe
5484	RobloxPlayerBeta.exe
5880	RobloxPlayerBeta.exe
5880	RobloxPlayerBeta.exe
5880	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
3128	RobloxPlayerBeta.exe
3128	RobloxPlayerBeta.exe
3128	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
4264	RobloxPlayerBeta.exe
4264	RobloxPlayerBeta.exe
4264	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\dialog_blue.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\AvatarBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Settings\Slider\SelectedBarRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\Misc\Unmute.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VR\Radial\SliceActive.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\PlatformContent\pc\textures\water\normal_05.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\SourceSansPro-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\AvatarContextMenu_Arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\Misc\MuteAll.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\families\Nunito.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\common\robux_small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\places\MobileChatPlace.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\DeviceEmulator\sim_server.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\StarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Settings\Help\RotateCameraGesture.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\ic-more-message.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\ic-info.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\sky\moon.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\ErrorIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\FaceControlsEditor\face_sideView.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\shaders\shaders_d3d10_1.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\ic-pin.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Slider-BKG-Left-Cap.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Slider_dn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\DesignSystem\ButtonStart.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\avatar\compositing\CompositShirtTemplate.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\IBeamCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\particles\explosion01_smoke_color_new.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\wow-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\MicLight\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\avatar\heads\headM.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\ic-chat-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChatV2\ic-friend-empty-border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\MaterialFramework\Grid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\ScreenshotHud\Camera.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VR\circleWhite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\shaders\shaders_d3d10.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\models\AccessoryAdjustment\Ring.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\DeviceEmulator\sim_rotate.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\WhiteOverlayAsset.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	erto3e4rortoergn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	erto3e4rortoergn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\TypedURLs	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "823"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "856"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\AppUserModelId\NotifyIconGeneratedAumid_10806980609616980897	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5a003100000000004b5d3224100056657273696f6e730000420009000400efbe4b5d31244b5d32242e0000006dc6010000000c0000000000000000000000000000006fc8ed00560065007200730069006f006e007300000018000000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\AppUserModelId\NotifyIconGeneratedAumid_10806980609616980897\DisplayName = "Windows Explorer"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-cec3ad5889b447cf"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 8c003100000000004b5d3124110050524f4752417e310000740009000400efbe8158443b4b5d31242e0000004c0400000000010000000000000000004a0000000000e333bc00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
436	explorer.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
5356	RobloxPlayerInstaller.exe
5356	RobloxPlayerInstaller.exe
5356	RobloxPlayerInstaller.exe
5356	RobloxPlayerInstaller.exe
5484	RobloxPlayerBeta.exe
4204	chrome.exe
4204	chrome.exe
5880	RobloxPlayerBeta.exe
1688	RobloxPlayerBeta.exe
4312	RobloxPlayerBeta.exe
5300	RobloxPlayerBeta.exe
4176	RobloxPlayerBeta.exe
4196	RobloxPlayerBeta.exe
2924	RobloxPlayerBeta.exe
3868	RobloxPlayerBeta.exe
1676	RobloxPlayerBeta.exe
1252	erto3e4rortoergn.exe
1252	erto3e4rortoergn.exe
436	explorer.exe
436	explorer.exe
3128	RobloxPlayerBeta.exe
1300	RobloxPlayerBeta.exe
2640	RobloxPlayerInstaller.exe
2640	RobloxPlayerInstaller.exe
2640	RobloxPlayerInstaller.exe
2640	RobloxPlayerInstaller.exe
4264	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
724	sihost.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4652	StartMenuExperienceHost.exe
4420	SearchHost.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
4420	SearchHost.exe
4420	SearchHost.exe
4420	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 6020	3340	chrome.exe	91
PID 3340 wrote to memory of 2140	3340	chrome.exe	92
PID 3340 wrote to memory of 2140	3340	chrome.exe	92
PID 3340 wrote to memory of 4688	3340	chrome.exe	93
PID 3340 wrote to memory of 1676	3340	chrome.exe	95
PID 3340 wrote to memory of 1676	3340	chrome.exe	95
PID 3340 wrote to memory of 4336	3340	chrome.exe	96
PID 3340 wrote to memory of 2236	3340	chrome.exe	97
PID 3340 wrote to memory of 4336	3340	chrome.exe	96
PID 3340 wrote to memory of 2236	3340	chrome.exe	97
PID 3340 wrote to memory of 916	3340	chrome.exe	98
PID 3340 wrote to memory of 916	3340	chrome.exe	98
PID 3340 wrote to memory of 3896	3340	chrome.exe	99
PID 3340 wrote to memory of 3896	3340	chrome.exe	99
PID 3340 wrote to memory of 2820	3340	chrome.exe	100
PID 3340 wrote to memory of 2820	3340	chrome.exe	100
PID 3340 wrote to memory of 4692	3340	chrome.exe	101
PID 3340 wrote to memory of 4596	3340	chrome.exe	102
PID 3340 wrote to memory of 4476	3340	chrome.exe	103
PID 3340 wrote to memory of 4596	3340	chrome.exe	102
PID 3340 wrote to memory of 4476	3340	chrome.exe	103
PID 3340 wrote to memory of 3804	3340	chrome.exe	104
PID 3340 wrote to memory of 3804	3340	chrome.exe	104
PID 3340 wrote to memory of 1420	3340	chrome.exe	106
PID 3340 wrote to memory of 1420	3340	chrome.exe	106
PID 3340 wrote to memory of 1956	3340	chrome.exe	107
PID 3340 wrote to memory of 5180	3340	chrome.exe	108
PID 3340 wrote to memory of 1956	3340	chrome.exe	107
PID 3340 wrote to memory of 5180	3340	chrome.exe	108
PID 3340 wrote to memory of 4264	3340	chrome.exe	109
PID 3340 wrote to memory of 4264	3340	chrome.exe	109
PID 3340 wrote to memory of 1140	3340	chrome.exe	110
PID 3340 wrote to memory of 1140	3340	chrome.exe	110
PID 3340 wrote to memory of 5304	3340	chrome.exe	111
PID 3340 wrote to memory of 5304	3340	chrome.exe	111
PID 3340 wrote to memory of 1208	3340	chrome.exe	114
PID 3340 wrote to memory of 1208	3340	chrome.exe	114
PID 3340 wrote to memory of 4464	3340	chrome.exe	115
PID 3340 wrote to memory of 4464	3340	chrome.exe	115
PID 3340 wrote to memory of 3192	3340	chrome.exe	116
PID 3340 wrote to memory of 5368	3340	chrome.exe	117
PID 3340 wrote to memory of 3192	3340	chrome.exe	116
PID 3340 wrote to memory of 5368	3340	chrome.exe	117
PID 3340 wrote to memory of 124	3340	chrome.exe	119
PID 3340 wrote to memory of 124	3340	chrome.exe	119
PID 3340 wrote to memory of 4304	3340	chrome.exe	120
PID 3340 wrote to memory of 4304	3340	chrome.exe	120
PID 3340 wrote to memory of 5696	3340	chrome.exe	121
PID 3340 wrote to memory of 5696	3340	chrome.exe	121
PID 3340 wrote to memory of 4812	3340	chrome.exe	122
PID 3340 wrote to memory of 5304	3340	chrome.exe	123
PID 3340 wrote to memory of 2540	3340	chrome.exe	124
PID 3340 wrote to memory of 5424	3340	chrome.exe	125
PID 3340 wrote to memory of 5356	3340	chrome.exe	126
PID 5356 wrote to memory of 5484	5356	RobloxPlayerInstaller.exe	130
PID 3340 wrote to memory of 4204	3340	chrome.exe	136
PID 724 wrote to memory of 436	724	sihost.exe	188
PID 436 wrote to memory of 3128	436	explorer.exe	195
PID 436 wrote to memory of 1300	436	explorer.exe	203
PID 436 wrote to memory of 2640	436	explorer.exe	206
PID 2640 wrote to memory of 4264	2640	RobloxPlayerInstaller.exe	208
PID 436 wrote to memory of 4228	436	explorer.exe	213
PID 436 wrote to memory of 4020	436	explorer.exe	216
PID 4020 wrote to memory of 4380	4020	cmd.exe	218

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\erto3e4rortoergn.exe
"C:\Users\Admin\AppData\Local\Temp\erto3e4rortoergn.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc1253c728,0x7ffc1253c734,0x7ffc1253c740
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,684453852941413585,12365452448357442038,262144 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,17270080879028218808,8109061420395226515,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,7771377091624608708,6563073407376300595,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,5144347048741296631,9831915264915785299,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,15152830871795917753,15316201480366694516,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,5516038569425877921,9601629729257418942,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,3975041394564846545,3323836602179362829,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4520,i,13397747076050224418,16932621021567647541,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,6148899704794672329,12601288945706475719,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3944,i,10054497538863347963,8842034707657681123,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3756,i,12407674901009527091,7694882724128558742,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3768,i,15035638133516207765,3718983707364300175,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3644,i,7470144455905009651,3862399303841007660,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,3242432724108888426,4011016547615110925,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5972,i,17244844466802289129,16229876116689382550,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6248,i,17657472583184850572,5474988295402864712,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,17170964993992385381,10480200650132400090,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6484,i,11429537968464293082,915566551774967372,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,17064578008704774323,3869884177195946993,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,11643035282268991811,3814054346278029945,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3564,i,17035146443934311755,1107031579404706097,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5620,i,6584904508503951162,1714300656220372115,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:9
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,13075432959264571171,8804808738896958195,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:12
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6784,i,16048070165842646396,13702708461306445131,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6752,i,11666149302668993864,6291585783145178779,2097152 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,6071661810246329136,16978574235803334777,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,5179059359606633350,867141907420135990,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,3611871280753961325,17312249842448655037,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,10896888884330077057,17393273932097472633,524288 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:5424
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5356
    3⤵
    - Executes dropped EXE
    PID:248
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5356
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6400,i,5654977681220634799,3123423924891787861,262144 --field-trial-handle=1968,i,6826934366863930594,4770156119285926778,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4564

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5824

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5880

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2348

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1688

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1872

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1104

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5300

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4176

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3760

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4196

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1088

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3868

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2140

C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3952

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3896

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    PID:2964
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3128
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    PID:6056
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1300
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerInstaller.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
      "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2640
      4⤵
      Executes dropped EXE
      PID:1468
  - - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
      "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2640
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4264
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    PID:1096
- - C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4228
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4380
  - - C:\Windows\system32\findstr.exe
      findstr /i RobloxPlayerBeta
      4⤵
      PID:1096

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4420

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 12.9MB
SHA256 cb66149bcba139135afa26de2404bb5867eaa509a48ae1e0abe74a88a1b185ad
MD5 8aba555d30ff6e1dabdb40e48d9e802a
SHA1 ddccff1345686df3325d2737821996fac5ac08b4
SHA512 57627478be7e1d7ed017d26800a1f2c8cffbc664a907dad99098a2a76a6e6d306fbb686ee1340d4cf0466fce29e7754e8ef2a04e8e86b3f53f878979551ce173
SSDEEP 196608:VusOdRps5ViNhK81sA3Z65UGRpnN4685cZMK+bO8:YzdIV61sAY5UQnN9ZR
TLSH
T17BD69D6AB2B800E9D4BBD17CC6565617E7B1B41603709BDF1AA046EA1F63BE01F7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.dll
Size 21.5MB
SHA256 dcafbbbaa2a9cd7168b18dfa1f37f58ed5bc448781b2bd40c8855f53227a468d
MD5 2a43ef1622f33c50ce7c415f6709f0b0
SHA1 5175a4024fce6579e94a7b3964b7b54913f962f8
SHA512 efad7304a35128ffd7593fbe15e1924d2c64a98610fef9d71f3142b78520c30cbaa8b64795e4e04df34efcd3bdeb4d74824d8354948c5232df10fa7e301dfc36
SSDEEP 196608:zXOaXitmN74wcFO9NloeetTPfv3ZcmjKAma5:HSt8cFO9PAXqbAma5
TLSH
T1F237BF4EF4D10AE4C2B25070E15F57E3DA72304C0B692EFB8AA51250367279E6699F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f4bf0d1-a0ba-42b2-82ca-ef4a95212a55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4f4bf0d1-a0ba-42b2-82ca-ef4a95212a55.tmp
Size 142KB
SHA256 b140b18bdfe35b8f8948801f11c008705450ad1161a5570e7e8db4e004ea7719
MD5 3c07aa3a8ef8c8d08cbb66e070942ade
SHA1 c0bf1313c30fd6ef2962a216779e91d7996b6395
SHA512 4cb3491a6c6a6c2a3cb59e7b874bee1845d31044ed50a37e66ad9ae1aecbee3e9eaefe5764be393cbd7c3fe6d258599d75eb433ddf24c5a8f1edc980f710b337
SSDEEP 1536:37PerhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfI:LP2COfTORr3x7wQFtDDmyYFoTcze
TLSH
T1E1E312719E3C8B2BDBB786AD924F36130DF0211BB2508A8CD1DDACCC53AA49D5257C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c331b78-9a4c-4561-b861-4a24d4e764b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5c331b78-9a4c-4561-b861-4a24d4e764b3.tmp
Size 142KB
SHA256 16834fc2c36b5e2ec34321baea020e0ea9e9cf10937edd551ef8e47f8f0a7df1
MD5 527555463a8a6dacca4c26b1a6fe691d
SHA1 28c9804d8eee674ec69b8656b4195999f12ae50c
SHA512 f3a260f9d5013d731a0c60a2e1f44d041f66cab700e4dadca866c95dd35294b76b9017036371368de83a3cc5a53de487c9e4e33f797315cf66f2e137f82bd7af
SSDEEP 1536:3ErhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfWKI:ICOfTORr3x7wQFtDDmyYFoTcze
TLSH
T188E31271AE3C8B2BE7B7C3AEE34F361706F0101772514A9C82DAADDC536549E5252C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b5795b7-e244-4609-ab37-19aaac10da45.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6b5795b7-e244-4609-ab37-19aaac10da45.tmp
Size 143KB
SHA256 e214639e50660fdcb538d6b2d198f0bbfa879239b5908cf6f31339d86cc3b041
MD5 16b5faf504764da1114a20ce90016238
SHA1 55ace8721b229cbfdc4be4a0f832d57ce21fff32
SHA512 f966828470dc8a12b585db7393486ffb4e776eb9c7557ba06d8f10f388b15cbe207716429bbbdf0daacc111969bb820df8a4b8208478c9484b464f87dc6532e3
SSDEEP 1536:3IGOrhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfI:YGmCOfTORr3x7wQFtDDmyYFoTcze
TLSH
T167E312729E3C8B2BDBB786AD934F36130DF02517A2518A8CD1DDACCC53AA09D5257C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74e8f1b4-8179-412f-9389-38820e39f2b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\74e8f1b4-8179-412f-9389-38820e39f2b1.tmp
Size 4KB
SHA256 c54cdc34abd31ea6ce2272006d293f41dcdc063661158628ca1aa013cd2756d9
MD5 6453a8053383dbb899d95bf4a502e755
SHA1 438a313a48c7c83fb7980902159a1c45e2068c04
SHA512 417cd2ea39ae75d52a6f7f7ab39141607e90abd383c57cc260ba0d0380eb2a2b3ac31ff48c690007cfa0f1935952dc4d173af0f5395247c86eddde7c0dbac577
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok55p0cDLB6vGyvtBWG0c83bOv4a:CC0oWqNVVxi+9oP8DUDj0K1DeW9c83bQ
TLSH
T1DCA12931A869997789F2D485B1422E538FB870ABA621DFD4E8EE1D1C20B30EC0343227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f5fa889-0ea1-48a7-afd9-6996841d33d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8f5fa889-0ea1-48a7-afd9-6996841d33d8.tmp
Size 143KB
SHA256 296728b9d71c808c225a9a4cff48b94c2de273ea31f163efe90a7eb522cb9364
MD5 195b943b00688e358d47015b239cca44
SHA1 6f69d16cbdb2d345d166a06eddcbe14f3a2cb639
SHA512 44b8ccb8602a0053acd155641532f959005e0f33529d78d0875322915251c8c384e399af6cb8409c0a488febfe45e13f7ca739022493782aebb95b461ee2c954
SSDEEP 1536:3pW6rhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfI:ZW6COfTORr3x7wQFtDDmyYFoTcze
TLSH
T11CE312719E3C8B2BDBB786AD924F36130DF02117A2518A8CD1DDBCCC53AA09D9257C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
MD5 0a5be5c7ba33a6c408691d82d7affa3e
SHA1 dd80476f918154cb44942aa2c9ec051f46116136
SHA512 a8a03053cc90b92445b36b42d8981d02fe131d68edfa6911d6a648f7e0a1f636527df56b572083d39d96fc22e9ad9ddce1f824c8f584aa04165b938020cd20fb
MD5 SHA1 SHA512

Submit Download

03dbd015-8665-495e-82a8-54d14f9035a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03dbd015-8665-495e-82a8-54d14f9035a0.tmp
Size 11KB
SHA256 a42dc489459d3f309bc6dcb8c56472b7d7c51dc87c7aeb1f97543e8af9ee8f98
MD5 75a42b9a5e2de0b7938436ab0140713a
SHA1 2c3118e4a9f36488960332747fd1e4bd4bc89c3a
SHA512 2805e685158061c8e77ff4de0c2fbacad0f8a5ac28ecc6ccffdab70f91113ee161837d4a76b845d99622c5981b7ab789cba589868427e872f1a9212cb19bbd33
SSDEEP 192:3R2xtDv7VAPRp2XZdIXsb+WNnsD4kD2ik29EbiyIsnAUge:3R2xt7kXBXwQj2TKe
TLSH
T18842A52DAA10B63BACDBD219FA627B57D6F5103234D01EC4A6FD892C25E79CCA217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11f86a92-4076-447f-b392-50e462e07497.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\11f86a92-4076-447f-b392-50e462e07497.tmp
Size 13KB
SHA256 5f0585c9378f518a8a653855747838f14b8b8582e81d0e8a9931bd14e3302b05
MD5 7e873c102d1b70ad324654874a0b0261
SHA1 58a8c10fee121216c971a8f0d646b465ae6d63c5
SHA512 a0520176c80c8d5f7fd1585b0ce2c34ed82886baffc93f2e60fdef53b158981886d047609a00f5e0f22a6dc955a1b4a059a62a9c7005f5033e89af0bdda70ae8
SSDEEP 384:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFXODYX+ErU3wuHG8xMkkwlF+x:ugYb7KxkXqKf/pUZNCgVLH2HfgsRBOEP
TLSH
T1AF52F86B644C9A3F0FD8DA4DDC177F4FACB502566668096457FB8C1803A57CE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bb4a2f5-b474-41f9-9140-8bcf44f70bdc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2bb4a2f5-b474-41f9-9140-8bcf44f70bdc.tmp
Size 12KB
SHA256 ce6b31a8f0a3293be41f5bb46a99b8a90d8ff25cf6e8fe9f95361aaaae43097f
MD5 1a0074b1c5954eb31562f1f8c8a3b4d2
SHA1 d1c3e3f5eada661d3c9eb2f6df8bc05fb50dfb95
SHA512 aba3dc3e11cbf3b56673623657a199ee581e0fe716a39a8dddc67c3f5cfeccddb8544e0d378ba67b42b7bdce09d510bb5218eb50eaf35e638007a74d6d9c30e1
SSDEEP 192:3ROcBzztHv7VAPRp2XjG6Xsb+WNcusD4Hse0mk29EniyIsnAUgE:3ROmzztPkXkXwAre0vmE
TLSH
T1BA42842DAA10763BADDBD219FA627B57D6F5102224D02EC4E6FDC92C25E79CCA217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92d3bf33-a5b3-4d0b-8d0d-061ce5ea800c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92d3bf33-a5b3-4d0b-8d0d-061ce5ea800c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 473f926d3c9704a512ae56b3583570e21a255174f9a4017a48fbfb0fa6280fbc
MD5 49279109b7a34315e9505b235cc05fd5
SHA1 f1ef9c5645aeb87651d5dc796f826d31f233f300
SHA512 664403feb63f7a51a6b88d9650c2f4854c8fa7fc02039c9685e859bfa2d55964e4078906e99219ca64d9d874c47d6bfda194d401d2ed9a54b182d36016c4a312
TLSH
T11721C9D6B4ED20C4CF88B172F4D4D81435B8109274C1D61A7398BE1EFBA3BF1A0A5025
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d453dcc1-33fd-495d-b5b0-abe905ebaac8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d453dcc1-33fd-495d-b5b0-abe905ebaac8.tmp
Size 8KB
SHA256 84770d10d86792a90341d06f9442502b4fdb14e1aeca853e0d5655b39a193048
MD5 6502aa14304c4712302db7637f39f0bc
SHA1 16f94172cb67b66d40a487cc6c349ac6cef0069c
SHA512 cf429c13f0bcb489d517966accabe86846b6c5bb528f7b8582a4cb4b2f3f4d4ee7def941f5c91aeb16d5f76d86c6d61622b6a9c25732be1819eef8d83d381c10
SSDEEP 192:DrQGkZu3Ds7aJSwGBkwShlcP/JIiIwI5NPhaaPzv4xfPuNkHxl5Hq:DrQGkZu3Ds7aJ5GBkwShlcP/JIiIwI5f
TLSH
T15A02BFF7C3D9C62D890156F49B25AF2FCE290A2C432C3C66C8D8AE5B93E2471D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db670270-4a67-4f3a-85a5-1fade4f57b82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\db670270-4a67-4f3a-85a5-1fade4f57b82.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ef0ce725-36d9-4e91-9c86-a3aed5d6c692.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ef0ce725-36d9-4e91-9c86-a3aed5d6c692.tmp
Size 1KB
SHA256 8c4e4e659a1d05de24077f105f485c842072e3ec65548166a7783591b9df942b
MD5 e09586e348f258629b09b01484d5745d
SHA1 13418b884871cdfea9631940be1f148d63b1611b
SHA512 8c5b4afdd5464b3d376e7e42f3a6e019e19b6c438eada0d0cd04244dff7e6f21cb00f4c6e21140fdef01179ad22930d666e536360f791112ab2ffbc49fbadaa6
TLSH
T1B421AFDBE67E743B20298A771D10B8065EB694334250B4F8DEDB422CB0C90F357520A2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 e9ba0ea2bb29e932dd6622fac5056122f4363bf7b79e1e35eb9a9c2ad2dfa16b
MD5 ba52865d1fcaa37b279bba16516b3a57
SHA1 00bf4705ff2c961aef05302f11029ce7c09c87e4
SHA512 846c28e874257f3c9f111696406fa06f83a0281c29e384364935d045ff974c24445253c5258fb94a6db5f458e90dcdb4773111c13a6bb60bb6360bb99b6aaf5a
TLSH
T148B0222A28003C23E8000B38CAC228C233202C083383A0C3A2F3002C8802EC2820B280
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 9c87c4668bf65c9f5ad8deb72bdc98aac09c4040a57b1296429e31bb87a4f235
MD5 c543ad84854c8ca6676cd5d03584b0f5
SHA1 be6ecab4442457a3e1f46bcac6b43d46456d5cde
SHA512 ee3cbd37ef4ae6cf78ccfa5f59c42110bb7437455e8507d39fa8f295c4707d6386a319f79e1c6b17df53b9317b5ce87685ae4231ac4b392264018e213c19e7b2
TLSH
T19EA0021091D12815CD00C278A161464222A65A142953D7175AD21895D97F6C18917204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 878bc5d4fc7fdeab79172565c8c6bab669fedc7c40cf094ba0af8e791f1db511
MD5 b11ecc3ebc293b737ec1a4539e5ec304
SHA1 e76f0fe908e0ab6131c13a6679dad784cd0e8d90
SHA512 a7663acaae3567496e2c5453371c7ae14a9a0c98db41c923ddf76d97d8f0c019c68938213691951d103a666342f006ae4a2ccc8b1c3b861f886943e1e35b8dc1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

a48051a3-24af-47d3-be16-ab8d83fa5e48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\a48051a3-24af-47d3-be16-ab8d83fa5e48.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

dde9c6dd-79ce-4a3b-9812-99858bf6974d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dde9c6dd-79ce-4a3b-9812-99858bf6974d.tmp
Size 13KB
SHA256 db134f97978b21d797c953455196014247ae62389690c9e09a5f0c9e69416b24
MD5 0391165567a3a65fe932a59d367b7b3c
SHA1 f6780783b0463cb81063c731668ca47a6a301e9c
SHA512 41931d446e227490942683cb36d52ddc7c7d4d25f4320931148cc71ab4a5d714622c8394e1e642051346084fc8b1e89b9e7627408a2a14df2dcd5fb01a1d089f
SSDEEP 192:3RncBzztOv7VRPRpVXjG6Xsb+WNcusD4Hsrhn2Mddk29EhiyIsnAUgE:3Rnmzztq/XDXwArR2MdSIE
TLSH
T15D52A62DAA10763BACDBD219FA62BB57D6F5103234D01EC4E6FD892C25E79CCA217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dff1cf58-30d9-4a74-87ff-a0996118ea98.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dff1cf58-30d9-4a74-87ff-a0996118ea98.tmp
Size 12KB
SHA256 824a59a25e276ca833d7ed6a21ed867cc8d59178af63fc0ce05b2d752eeb9d6b
MD5 061bdac016245e7b3393f952d67aa15a
SHA1 a2ddc009b7eb988fbe5eece742d933834984a3cb
SHA512 29815cdefb1b7edb18d4521717a0a804b288fcc1994e95917b271bb03793c1937f9f329a47ab4f62b28b7753391e36bec0f10d18d7eb988da9dec5b8af8a2d2f
SSDEEP 192:3ROcBzztXv7VAPRp2XjG6Xsb+WNcusD4Hse0mk29EniyIsnAUgE:3ROmzzt/kXkXwAre0vmE
TLSH
T16742842DAA10763BADDBD219FA627B57D6F5103224D02EC4E6FDC92C25E79CCA217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebc56978-50c0-4354-9656-e973732ee0cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ebc56978-50c0-4354-9656-e973732ee0cd.tmp
Size 12KB
SHA256 15a6aba0ac187236364e2e0bc68d9ba77ae9068333ec2ed5ad6bb2efdc39630c
MD5 ddb217fc0d317096463927f4513e98d8
SHA1 e110eba0d459dc8acc21790167d0170843c67136
SHA512 c523112a92b7ede3f9317401feaa5da7ec5cfaf8ba8df90b5088119ffa1c9071ad98e104dbc02b88bc99834aab49ddb1421ab3cc3fcbb81898a3cd78f0a0743d
SSDEEP 192:3ROcBzxtHv7VAPRp2XjG6Xsb+WNcusD4Hse0mk29EniyIsnAUgE:3ROmzxtPkXkXwAre0vmE
TLSH
T10C42942DAA10763BADDBD219FA627B57D6F5103224D02EC4E6FDC92C25E79CCA217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4cc1620-0236-49ba-b255-7c68dc875a09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f4cc1620-0236-49ba-b255-7c68dc875a09.tmp
Size 12KB
SHA256 76833b27918473a8bf2eae12fb1a08b8fcbf5fdf76928cac23abce0fad38c83c
MD5 bf729b1805267703378a51d307ba58e3
SHA1 2cafbfac670f99ef836dd746c1daed4229b03d13
SHA512 d291ca9b31b8c5f38d2f72aa1cc443cb43ce93663aeb7c77923043ba9d51452b5592d1caebd9a62c0aec5822191376c792cd3e7b009251cbe69ddf3b8c06d36c
SSDEEP 192:3ROcBzztOv7VRPRpVXjG6Xsb+WNcusD4Hseqddk29EhiyIsnAUgE:3ROmzztq/XDXwAreqdSIE
TLSH
T15442962DAA10763BACDBD219FA62BB57D6F5103234D01EC4E6FD892C25E79CCA217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2e80e5b-60a1-4c08-8f9a-f7bbc3aed0b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b2e80e5b-60a1-4c08-8f9a-f7bbc3aed0b3.tmp
Size 142KB
SHA256 0765600ca77ca06952abde67c74d4203e0c4cbb529bf656a5df463fa0da14fca
MD5 6f48a02b15ae1b5f22e38a508c68dc8f
SHA1 2a31cac4440efaaf6e062f471ec641c5913c56cd
SHA512 3391f50557231d30bb33f0deade05183a05aa450164dc7fe6ecb42541ebf461d2b1a0479a6adbb5f96f70c007f60b49b660c59f2663f3cbb9139a573c30fb346
SSDEEP 1536:QErhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfWKI:bCOfTORr3x7wQFtDDmyYFoTcze
TLSH
T165E31271AE3C8B2BE7B7C3AEE34F361706F0101772514A9C82DAADDC53A549E5252C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a7024f6-bdcd-4ce9-b18b-c10884b88653.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a7024f6-bdcd-4ce9-b18b-c10884b88653.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3340_157718010\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 602f4cd4a29e5ea477a4850c93598dd40d8fffeed8697f86588474ec772dd265
MD5 c5b2d8d5599a0fd451f7ca25ac72c77d
SHA1 61e8eae2506fe2d27bf2b6ebb5014cd9fbdae7e5
SHA512 00a0254d0149192f85d496e32827a5a5cb59d389798d241c4d12b717308f4a27d862a45458046d18a4b22116066d5fb09922a2e0c870d4ef9936a572de6c0e99
TLSH
T1AF21E1528EEA532DF5B6463A74B21A81EB313C00BA696E6FC0C153481A71100ADE8F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Studio.lnk

Path C:\Users\Admin\Desktop\Roblox Studio.lnk
Size 1KB
SHA256 b2594d30600d73a1c6b551a95ea61ef9ac53cb12df84a5b1e9dad7f40c74bbab
MD5 91283152a4bde1b843ad1d8cebb302c5
SHA1 f6ced2c8c48195f67870b593b03e01ce341ed67c
SHA512 dd0a4f80d12165bd3aab85bf4abf853d96aba332acf4942e4b79266ed2af72cbb4fd53fb2dfd130f21a3285fc7a56576ae9ad61191741547a343a1cf2c3158a3
TLSH
T1412192555FB6032DF6A2473678620A82D7357C01BB585F7BC0C153492A35100ADE8F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 68690.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 68690.crdownload
Size 12.9MB
SHA256 bbdac8da525c3e266a3ef84c77f15bc84b1df2cce40aa27b99a50d9df37ca401
MD5 62c76b67b4f53fc033317cedaed84c12
SHA1 b7d0f7b88539e526873a0cb27fc6a40945a765f7
SHA512 080a55489e6ea7bb245bd5de8c88b536a451d7b2055fb8db5b91e0da8616a58dcb284c0acc9978cfd1835ba85f3cc35991f460eed491915c4ebbce74af6157f4
SSDEEP 196608:XH0yYacW2V9GGRiHuSfMGg5OgvbM9vK+5tF344XEdK1:XD+JV8uS075OgzM9HF+K1
TLSH
T197D69D6AA2B800E8D4BBD178CA565613E7B1B41603709BDF1BA046F61F63BE45F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-0-0x0000000140000000-0x00000001403EE000-memory.dmp

Download

memory/1252-1125-0x0000000140000000-0x00000001403EE000-memory.dmp

Download

memory/4420-1148-0x0000029FAFE90000-0x0000029FAFF90000-memory.dmp

Download

memory/4420-1174-0x000002A7B5730000-0x000002A7B5750000-memory.dmp

Download

memory/4420-1163-0x000002A7C57B0000-0x000002A7C58B0000-memory.dmp

Download

memory/4420-1162-0x000002A7B5360000-0x000002A7B5380000-memory.dmp

Download

memory/4420-1149-0x0000029FAFE90000-0x0000029FAFF90000-memory.dmp

Download

memory/4420-1147-0x0000029FAFE90000-0x0000029FAFF90000-memory.dmp

Download

memory/4420-1415-0x000002A7C6AB0000-0x000002A7C6BB0000-memory.dmp

Download

memory/4420-1193-0x000002A7C5BB0000-0x000002A7C5BD0000-memory.dmp

Download