70f7b1248fa829a6be5c7af852e7f4be44d2ac710f1d3505b4383cf0b97704db

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxPlayerInstaller (3).exe
Size 12.8MB
Sample261011-rd2mdaws9k
SHA256 70f7b1248fa829a6be5c7af852e7f4be44d2ac710f1d3505b4383cf0b97704db
MD5 75d64f7255417033aa4709757cda4c4f
SHA1 60374e7cf20ddb812dc154881b9b1b96b3088416
SHA512 1de5d4fbddeb36f17f730a655cc5f1c05b92785c51c52e3f05cc130e9d12829b5c84ea44258314920de8aa59451b33ac2cf7288b299a1599962909893aca85b3
SSDEEP 196608:zF83SVNvrVUwr8WjxpcLcyXVG/YP/wP5Dq5uaJ:zFdDVPxpcQylIYP+qoaJ
TLSH
T1DDD69D6AB2B800E8D4BBD178C6565613EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5292	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
5292	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller (3).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5292	RobloxPlayerBeta.exe
5292	RobloxPlayerBeta.exe
5292	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\LegacyRbxGui\ComboBoxArrow.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\models\Thumbnails\MakeupLighting.rbxm	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\SpeakerNew\Connecting.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\PlayStationController\ButtonCircle.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\leaderboardOff.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\Misc\UnmuteAll.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\ExternalSite\facebook.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\ic-search.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\models\Thumbnails\Mannequins\R6.rbxmx	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\NotoSansDevanagariUI-Regular.ttf	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\collapsibleArrowRight.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\StudioSharedUI\Help.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Chat\VRChatBackground.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\localizationUIScrapingOn.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\Animated\wow.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Settings\Help\XButtonDark.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\ic-more-create.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\avatar\compositing\CompositPantsTemplate.mesh	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\StudioSharedUI\RoundedRightBorder.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\DefaultController\DPadDown.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\NewFollowing.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_20.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TixIcon.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Moments\Reactions\Animated\heart.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\PlayerList\ViewAvatar.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\Gamepad\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\Discord_large.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Menu\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\DenkOne-Regular.ttf	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\AvatarEditorImages\AvatarEditor_LightTheme.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\xboxLS.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\LegacyRbxGui\Granite .png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\AvatarExperience\glowDark.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\families\Bangers.json	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\SelfView\SelfView_icon_camera_enabled.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\SelfView\whiteRect.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\TouchControlsSheet.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_4.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Modal.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\ExtraContent\textures\ui\LuaChat\9-slice\search.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\textures\ui\Settings\LeaveGame\artAssets_DownArrow.png	RobloxPlayerInstaller (3).exe
File created	C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\content\fonts\families\Zekton.json	RobloxPlayerInstaller (3).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller (3).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller (3).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3900	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller (3).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller (3).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller (3).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller (3).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller (3).exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-cec3ad5889b447cf"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-cec3ad5889b447cf"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-cec3ad5889b447cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller (3).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9b554450a0fc4e65"	RobloxPlayerInstaller (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller (3).exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
1056	RobloxPlayerInstaller (3).exe
1056	RobloxPlayerInstaller (3).exe
1056	RobloxPlayerInstaller (3).exe
1056	RobloxPlayerInstaller (3).exe
5292	RobloxPlayerBeta.exe
564	chrome.exe
564	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 3976	564	chrome.exe	98
PID 564 wrote to memory of 3900	564	chrome.exe	100
PID 564 wrote to memory of 5088	564	chrome.exe	99
PID 564 wrote to memory of 5088	564	chrome.exe	99
PID 564 wrote to memory of 1220	564	chrome.exe	101
PID 564 wrote to memory of 1220	564	chrome.exe	101
PID 1720 wrote to memory of 3024	1720	chrome.exe	104
PID 4760 wrote to memory of 3280	4760	chrome.exe	106
PID 564 wrote to memory of 1896	564	chrome.exe	109
PID 564 wrote to memory of 1896	564	chrome.exe	109
PID 564 wrote to memory of 852	564	chrome.exe	108
PID 564 wrote to memory of 852	564	chrome.exe	108
PID 564 wrote to memory of 1580	564	chrome.exe	110
PID 564 wrote to memory of 1580	564	chrome.exe	110
PID 564 wrote to memory of 4052	564	chrome.exe	112
PID 564 wrote to memory of 4052	564	chrome.exe	112
PID 564 wrote to memory of 5168	564	chrome.exe	132
PID 1056 wrote to memory of 5292	1056	RobloxPlayerInstaller (3).exe	116
PID 564 wrote to memory of 5364	564	chrome.exe	117
PID 564 wrote to memory of 5364	564	chrome.exe	117
PID 564 wrote to memory of 5840	564	chrome.exe	126
PID 564 wrote to memory of 5840	564	chrome.exe	126
PID 564 wrote to memory of 6140	564	chrome.exe	127
PID 564 wrote to memory of 6140	564	chrome.exe	127
PID 564 wrote to memory of 5172	564	chrome.exe	129
PID 564 wrote to memory of 5172	564	chrome.exe	129
PID 564 wrote to memory of 5224	564	chrome.exe	128
PID 564 wrote to memory of 5224	564	chrome.exe	128
PID 564 wrote to memory of 6120	564	chrome.exe	136
PID 564 wrote to memory of 6136	564	chrome.exe	137
PID 564 wrote to memory of 2844	564	chrome.exe	138
PID 564 wrote to memory of 2588	564	chrome.exe	139
PID 564 wrote to memory of 2588	564	chrome.exe	139
PID 564 wrote to memory of 5260	564	chrome.exe	140
PID 564 wrote to memory of 5260	564	chrome.exe	140
PID 564 wrote to memory of 2516	564	chrome.exe	146
PID 564 wrote to memory of 2516	564	chrome.exe	146
PID 564 wrote to memory of 5736	564	chrome.exe	147
PID 564 wrote to memory of 5736	564	chrome.exe	147
PID 564 wrote to memory of 4424	564	chrome.exe	149

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (3).exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (3).exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1056
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd951fc728,0x7ffd951fc734,0x7ffd951fc740
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,4953625550316305856,5215590418990305349,262144 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,17444971292118646522,4473646817431617669,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,11170471590835049394,5997160325651667786,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,2888063798296017402,1842543098823739407,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,6737706878686070169,5765855379996955154,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,17067862122679004745,14904132585976721555,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,955171752769306067,12483445385674003327,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,15796568930619963721,15498556697789842637,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,15506664302985876077,17628784317406473420,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,8999896940885582774,18265590440376969986,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,11168896737039507253,18115508525311140821,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5748,i,738181717035931499,13487110412059383513,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5704,i,1570954795966973182,189501039542454713,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,16640017694372001663,12879489705328476868,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,10844484734596925031,8201085806508006786,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,8642050218963409997,9430664526743083498,524288 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5056,i,12795928633255076200,13763581134610496788,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6532,i,12336512352065334897,15813841554109540456,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5684,i,8923108318140281516,4449400555720422459,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5776,i,8063725820109467315,1533571228700524471,2097152 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6592,i,16933620437891328252,14870894932916705203,262144 --field-trial-handle=2020,i,17748567982125683218,1926055622891243515,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd951fc728,0x7ffd951fc734,0x7ffd951fc740
  2⤵
  PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd951fc728,0x7ffd951fc734,0x7ffd951fc740
  2⤵
  PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5492

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 12.9MB
SHA256 cb66149bcba139135afa26de2404bb5867eaa509a48ae1e0abe74a88a1b185ad
MD5 8aba555d30ff6e1dabdb40e48d9e802a
SHA1 ddccff1345686df3325d2737821996fac5ac08b4
SHA512 57627478be7e1d7ed017d26800a1f2c8cffbc664a907dad99098a2a76a6e6d306fbb686ee1340d4cf0466fce29e7754e8ef2a04e8e86b3f53f878979551ce173
SSDEEP 196608:VusOdRps5ViNhK81sA3Z65UGRpnN4685cZMK+bO8:YzdIV61sAY5UQnN9ZR
TLSH
T17BD69D6AB2B800E9D4BBD17CC6565617E7B1B41603709BDF1AA046EA1F63BE01F7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.dll
Size 21.5MB
SHA256 dcafbbbaa2a9cd7168b18dfa1f37f58ed5bc448781b2bd40c8855f53227a468d
MD5 2a43ef1622f33c50ce7c415f6709f0b0
SHA1 5175a4024fce6579e94a7b3964b7b54913f962f8
SHA512 efad7304a35128ffd7593fbe15e1924d2c64a98610fef9d71f3142b78520c30cbaa8b64795e4e04df34efcd3bdeb4d74824d8354948c5232df10fa7e301dfc36
SSDEEP 196608:zXOaXitmN74wcFO9NloeetTPfv3ZcmjKAma5:HSt8cFO9PAXqbAma5
TLSH
T1F237BF4EF4D10AE4C2B25070E15F57E3DA72304C0B692EFB8AA51250367279E6699F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerInstaller.exe
Size 12.9MB
SHA256 bbdac8da525c3e266a3ef84c77f15bc84b1df2cce40aa27b99a50d9df37ca401
MD5 62c76b67b4f53fc033317cedaed84c12
SHA1 b7d0f7b88539e526873a0cb27fc6a40945a765f7
SHA512 080a55489e6ea7bb245bd5de8c88b536a451d7b2055fb8db5b91e0da8616a58dcb284c0acc9978cfd1835ba85f3cc35991f460eed491915c4ebbce74af6157f4
SSDEEP 196608:XH0yYacW2V9GGRiHuSfMGg5OgvbM9vK+5tF344XEdK1:XD+JV8uS075OgzM9HF+K1
TLSH
T197D69D6AA2B800E8D4BBD178CA565613E7B1B41603709BDF1BA046F61F63BE45F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

481df91d-01d2-4687-8e1a-eb86d000b499.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\481df91d-01d2-4687-8e1a-eb86d000b499.tmp
Size 269KB
SHA256 66ce64cc138a936a297b96ebe1305e478964b519978aaecb2d64fcd8f89c35f0
MD5 dc60a4a2b324fd98d5a94e3ea69c58a4
SHA1 139fff27333a188ec979ddea950583490f56afed
SHA512 a21361314ad01b52eb87c19723699fd920ce4d376488f99c0e38ae62a0888baf9ea40c5b30f228faacc888ba15e486507ab7ef70f4e2aa1514a460ca79f83f11
SSDEEP 6144:R1mrVQGSGkEZ2rJDyOqrKjb/+hFD+7t56OD9ZfSApprn:R1rxxJr9b/yFSXD9ZfS4B
TLSH
T1454412337D868DB38ABE5205D1BB6704CDB5B9E78A99A90940528F87624FC4E0737E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61b645db-8edf-4a81-88d8-450209700df2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\61b645db-8edf-4a81-88d8-450209700df2.tmp
Size 131KB
SHA256 16f43d4a0737617e767c615da85deb1e5631e001508514f49c39dfcfa5eff992
MD5 8ee1000243f5e6b8cd33fd9d344f2301
SHA1 122edd02cf0621225477548540d35e65926120ce
SHA512 af1f79e415ea8edb61252744d8b3b6adbe2e514b4141af4f3dd252a11cf069600a9404ba3336c6d22aa9787836902720587aef613bf22c8a85671ea77461c5eb
SSDEEP 3072:CTt+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gG:CTt+hFD+7t56OD9ZfSApprG
TLSH
T1B9D31232AA95D8BBC9FD6541B257A304CE7268ED51DE3A09444A5F8ED09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

08385e12-f989-497e-bebe-115c34f63421.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\08385e12-f989-497e-bebe-115c34f63421.tmp
Size 414B
SHA256 1f7991b18a53e468bc316e9a5bb80c83fb4bb0860c7785bbc19174a00f383e09
MD5 65d9b96b15a655bca754e7df0f23d5a4
SHA1 dc910b64643be77e75ce665d4ad2079003edf7c2
SHA512 cfd19aff1b762fe7e1a447b00da8c9929ced1b9a72e1a51df08ac6c0459eb980a3cf428f01d44a901bd1f2176691b2fac723fb233f3eaf28ffa39869e8f93cd0
TLSH
T192E02BE9CC35ED3718FC17181094874AFF8013172681554F363C850D8FB52BA458691C
MD5 SHA1 SHA512 TLSH

Submit Download

39f275f0-c257-4f77-bb2d-b253ccf3c49c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\39f275f0-c257-4f77-bb2d-b253ccf3c49c.tmp
Size 12KB
SHA256 c498a6ba6053598960cc037bc6c4f8547960d5f9f4f95b62ab0c1883db953960
MD5 8c2c95a8dc6359e67c1e6925fd3f01cf
SHA1 34f1a0a6908104cc2bd50af8c03e2373af22c022
SHA512 e6fbfd5a8be799d358b813a366048b6cdff4a4bc74fa66b728e6d126ce3e8f85804d078d7f4e7e0b29955fec7060720cff54770a180fa376780211c1676b3861
SSDEEP 192:wRacBz8Dg/v71vnPRpWa4A9IHsb+WNnjnqiueM325Mi8e8qa4VyIsnAUgE:wRamz8cX53X12wbSeq2WiTacE
TLSH
T1D442B52AA9203A7B5DDBD31AF965BB57D7F5002271943E84E6FC893C15DB9CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d4b0122-bfa3-4a4a-9114-e2a75ad44b65.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d4b0122-bfa3-4a4a-9114-e2a75ad44b65.tmp
Size 11KB
SHA256 647372826d7f32f63dbe1a1227c688206b10fb4f24efe87d0d8a941d5abd8209
MD5 603efed07a1d67054b42c3a2d9fc7f8e
SHA1 34ef501eec3e330888bfaeb207223a131765054a
SHA512 9c48017660ec2df064ca12f6575e953e3b4db8d1cf893f4aba257230121567982742c75da8b5eda44dc01c7597bf50b06fddf83959f4cb47fcf17ded0b91c5f5
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9/VS27SS0U:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLK
TLSH
T1B032C927A44D9A7F0FD8D50DCC12AF8B6DF502527368092457FF9D14039A7CA214E5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47797f98-9280-4835-a8d9-10c584b8108c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47797f98-9280-4835-a8d9-10c584b8108c.tmp
Size 12KB
SHA256 991d6692178c39596af160e10bd6bdaaf324b1f06ca2cbdca06e066c70ca5ea8
MD5 47446fbb526b88fdca064f9c05e6b8b5
SHA1 1a76b8bb90804fe73a32dc3dc6d3f6041ae4d509
SHA512 aefb3388a5d98a1629d9ede70fe1c68b52d1f5502c0970b701161d003d0c0f5cff8c9474ab4855e9ead5f78b3f69ad0e2d6f868a9fde2864ad562abc7ca0430c
SSDEEP 192:wRa8Dgqv71vAPRp2a0q9IHsb+WNnjnqI42j325Mi8e8qauVyIsnAUgE:wRa8cm56Xv2wba2j2WiTamE
TLSH
T17942B52AA9207A7B5DDBD31AF965B75BD7F5002271883E80EAF9893C14DB9CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5921510a-9694-42ce-a61b-8922e990de87.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5921510a-9694-42ce-a61b-8922e990de87.tmp
Size 9KB
SHA256 f285c097d650a5753a6e7850cf0428bec1010b7687b306870786b4fb488b07d1
MD5 81e21a6feaa9515e6be06c5db79bb346
SHA1 cdf166508e750238a4f79112ed97d2a4a8543549
SHA512 b90dad41e872399aa0c22df9563607ea25a6ba68cad5eaa0bc80997c20c801f660852c53782e00cc622243859859abb6e9dbedb49854a259de3f5d9125217a24
SSDEEP 192:wRE8D/mv71vAPRp2Z9IHsb+WNnwYSX4VyIsnAUgR:wRE8DS56X62wbSsR
TLSH
T19622721EA914767B9DDBE32AF925B757D3F5002235983E84E6F8893C14DB9CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82053cb6-1b57-4228-a0d9-40b07c1cf3ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82053cb6-1b57-4228-a0d9-40b07c1cf3ef.tmp
Size 13KB
SHA256 b5b4716e7086df84470c07567903647ebc3c9aa164f9cc291eef7359b69c4a0f
MD5 8f31d6d089d3c3eed15ee59570f31283
SHA1 b6b29cf17570a67d07edfb366f246e4895829a3f
SHA512 df782aa82c739abcb705abb19a2b06f556b4d6aebc9c65e91de7bf97796b5c89a2e701c3f4628b2fb769d9913fa4cf8784eec02ea3313d1e61f95b4c8c17e6c0
SSDEEP 192:wRacBh8Dg/v71vnPRpW0LmigGbY89IHsb+WNyOjnq52Y/325Mi8e8qa4VyIsnAUr:wRamh8cX53XxmiL2wlhYv2WiTacv4
TLSH
T19052B62AE9603A7B5DDBD22AF965BB57D7F5102261842E80E6FC893C15DBACC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 24KB
SHA256 48ee55bcca98b32a5e05d98fb1673a76449c35261ae0007e93a7cd7e95b1b7fd
MD5 e69515c3706adba2a9c1ce297d85cef6
SHA1 f2f971655fc69432d41afc6126de205c014a17a4
SHA512 6e11cf7eb45ec4633a3e9ec667f0c58ffefcc802f686bc8a48eeac1a691a38b000c7d876d2ae5d6a192494e5121909aca47b0035e80b3d07bfa3eaccd5dfcb8a
SSDEEP 384:r9tYHHbmpsXVaUeX7DDSe9atjG0vpMJWP17NqDY5ZYxG3rSa7A3oH1OrRgjYSrNQ:3qbosFISewtjSMP1JqDRa0YHiRWu
TLSH
T137B2D14E5E18F49B6FBF40F5FF35411E9B9F1005B9F9CB69282D01051A1DDA20AAA2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 123KB
SHA256 3e8def8613402b499a20e2975598b9f4e86c3fa0c197201e1ab5856c96fb6b15
MD5 8e6c9a2471c6ff388ed2cb8a924788c0
SHA1 0c52e7b14ac56ee7ad2518711fbf1871774541ad
SHA512 1611a1e7b8e5c363a3c57867c569c38e12df91296428e381233e99427e14016886ef0d6bd767a2b130f773f261f130f1b918520f961e9ccfb701fbda22b29bfb
SSDEEP 3072:dBHk3Gy4RBVRVEvnyi8ilerRUj9qUS+IOZ32xCVrrfqKxm8:d50GyWBXmvnyvil6RUjPZ32xCBlm8
TLSH
T11DC312513ADE4453021CA83B5CC456B636E1BF9A5C829849D6BB07511083FFFA2AEDF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 70KB
SHA256 93e8d0676ea72e6c5e1059e4d0d41713ac7d6d09725b5aa05c7d51660483a32b
MD5 7f871c52e5022d2554c7b3b61df24629
SHA1 064e692c1e593003c949528b68d122d57b665e07
SHA512 ff751de02a6f3f2e91a588bf20ceeeef84212b735499bf5d60f8a6f4c9cac06c1a55dc6bf9dba4b6aecb3bc59c4aa17f6267adf132a7884f9c4460b04a967354
SSDEEP 1536:0gf3f/YyDCpAMyafNU9I79ztWhi4YwwaraYKlgIgIbohcBFe/gI:04YKCpHf179xWjP2Y+g4ScBgYI
TLSH
T11F630292ABB96F79C3DA1D14D7B4A2388399C992FE01D3046D922D1CEC127A073691DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 76KB
SHA256 e06ac82c8f591420ad8647863ea5b3609975e1d2a0a9edc90a27f17c72cc6cc7
MD5 c3b70c694d44ea2608285c29749775c8
SHA1 d0cd390953928b718b2d25d5a05276d864d23634
SHA512 8e3a6514973916cc0eacb69ffed99fd44b88c851033311550d94b7c27f49b20a6687d9ab7a191363547c323be8b027f30fa7d0a242b5c6e9c15425d8b1dffc69
SSDEEP 1536:mfCvmyEluxIq4Y1xm0dDv7AAc3x/+OCYJrgfdIwCsR09JQE6SsftrzbZqSQSWw:mfoHvxIq4Y+0dbc3sOCYBgFwkmQE6SWJ
TLSH
T1A9731217A5F168E1508029F8B17DA87441EB981BB715BF4D1BF80E5B0978A28CC35EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 424KB
SHA256 33f72da6e0f4ecef695f1f1b3314772392540a155c9e29e550847d04d72bd1f2
MD5 6ce87ec8822a30028fc0fef4b6a1edfc
SHA1 868bca0fa1ede7d53cc128e353fb53be7210fabc
SHA512 0af45f0129ebc6c429da721a2b76202786853a34e39b979c5cdbb9ae10e6fa8c5b5f06b016fa166d7ea2cc2f09a1f5b32c95ce659b85240269c6a9fb933e4df2
SSDEEP 12288:A3V7S2Dx3iG+bxuXeWW4rdKOowrW6rJIxDO5p2vqu:AF43xz+rqiHV4DO58v3
TLSH
T1F39423B4D5807352FAA754B1B10207BE935BD940080D6DF992CF3AE7E3EA17B9178C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 f3c3116d260fd83cfc495a3162a3c88b3fe779d6a702746ec3558816141d8262
MD5 ffb8d4b950a1e373a7ca4b8eb4e58c0d
SHA1 e7da0a701c0b0df2745258482b94c776a65644c7
SHA512 cceef7b9e283340ba56c89b86c01a35744ea8b78207be7dc788360bf1e0733bf9ac9df3b62703f462579b3809f1c6f397ec46b571535966d06aa24f6a19ead7e
TLSH
T1E7419A503CFB7964F7602F3B8BDA1CE01568606E0E461A3B487B78240CFF22971B51D6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0918052c-fc9d-4dfb-bf14-3ce87cfda321.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0918052c-fc9d-4dfb-bf14-3ce87cfda321.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4e74bd88-10c2-457b-9dd5-41b9ec8a8f2a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4e74bd88-10c2-457b-9dd5-41b9ec8a8f2a.tmp
Size 7KB
SHA256 390f69e61fa7d4ca8296e17da3f16fd2cfc2f6b19017695ffd364cf6347a0c00
MD5 19cef2ea288f5e593a9c6ab21b331ccb
SHA1 cef0b511a96c3af427016f74249ab12bad4d565e
SHA512 d009ebaedeba5f58e1162e9fa73c12f672b5657b12d4e24d68400a5dea7f8897eb247e2f8f8f0e9ccf655b4b46c443527e3bec295f1764e70ab4994443726363
SSDEEP 192:DuGxFFsa4zJL0UczTIqJzl/Vwq+aPpv1/IyIw/fPqSXUNPSE:DuGxFFsa4zJL0UczTIqJzl/Vwq+ah9/m
TLSH
T15BF1AEF7C3D8D62DC90156F89B25AF1FCE2D0A18422C3D66C8D8AE5B93E2871D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 393d2af45e245898440e357e734942aeff52584ef546241d26a47afab74405c3
MD5 a723a884d8c24aa3bb4396d2a70e99d0
SHA1 e09628b93344073fd0081ce25950df17d7f835d5
SHA512 08094cc470d6880959bebab2834ff72332004e950527a2cae9867c8ed6ce2496a396322a058230d04a60f2cd970555a7a839ba2aabd78bd3248b4a9cf8d1827b
TLSH
T17FA0029596ED2A16F00002B0968502C123606E5017170AA2C0D4088898741529515B80
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 b0f687815aed97aa070dede612aaddd64de76ec4c4f3512cec1858a29825da3b
MD5 131c5f883927c0621cd6b4424a6d16ec
SHA1 a6c90d2bbebbb40ebda0e53a8b06cc8192e372d0
SHA512 589a6e97a585937ac15079426715a3c40071d0c38a9d77f398d3ff546ecc4cab3c746d0469dcab17316fcf5c65eb9d4536fc9fe3ce0874d1b974557fca556f67
TLSH
T18CB0220800C8280FFC00CF3082CA28C233A0AE0AAB0303F3C0F020AC882B2828A02B80
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 76f995435157f48560cc024642e1e0bf91b11d514d83d4701ac9f552808b8200
MD5 f39aa433194a5dcc5a94002a7f49fad8
SHA1 782157208d3acd8a4f21f97b2ebe2097ddfcca44
SHA512 d7a51225ae96d32e8ee1f4467134257decdcc1d80005dbc0f225755abd360c5e8c535dfcc6eeb150e5eb97703d9cb8119599c521895e38753d497442946f9626
TLSH
T17CA0021446E0A811DE0096B160750541275148152A55534769F65895D85B2C94111540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 85fdbb05bc8ee6dbac903c2a5e46daccbb3fdea3033980fbfad097da193671bc
MD5 f85721424a139f817f8ecadc74e9d0d8
SHA1 cda78ca6e70690d52c5bd3e0859a65842005ad1e
SHA512 7c77ac42df3d166ffd929372e3e9525834360180063f95554ea432ed640136c714e329b0e3229889c044979b55b5d5559f10db6943b402fcf75d4f0dac13d4d3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d148c84b-6af8-4812-8340-4152ca4cc690.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d148c84b-6af8-4812-8340-4152ca4cc690.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dc324e87-11fb-4534-baeb-84bff27b790e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dc324e87-11fb-4534-baeb-84bff27b790e.tmp
Size 11KB
SHA256 e61fcb215c31fa77b6990d43186e09deb90d9b299db5cc2cc96b90e21d0008b6
MD5 b8e1a6585f818440bf11a6c9e35fd775
SHA1 5ae7fece7ba49eeb777eef16a29a3aeb1795e873
SHA512 c5a67c95682f36ad8a8f430fabdaf2c515a5702c419846588e91b1fb65303ce7935b44c0af87132c51f83cff7e01e1f351fa6119790a8ac30fd9c89d8d36169a
SSDEEP 192:wRa8D/hv71vAPRp2Z9IHsb+WNnwYSX325Mi8e8qa6VyIsnAUge:wRa8Dx56X62wbSn2WiTa6e
TLSH
T19D32B52DAD20797B9DDBD32AFA657757D7F5002261983E80EAF8893C14DB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8a49099-0af5-47c6-ad52-304b8929e86a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8a49099-0af5-47c6-ad52-304b8929e86a.tmp
Size 130KB
SHA256 570539b2c2041dd6867380c8053faa2020edb4bf3c462be6129ef33e241e59cc
MD5 a73722470a623a71d33a6f1b8888f690
SHA1 cd87dfcde3360ca7704917a3c3bf86f0cdcf2f22
SHA512 4f38c067896ccd8fee8f2400e7ac2f8fc199b324746234c61ec31678aa809683b4a1ca69abd37a4de96d0c51b46e36e54d316489e652cee483c9dd17a7dd3048
SSDEEP 3072:dDX+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dDX+hFD+7t56OD9ZfSApprr
TLSH
T160D31232AA91D8BBC9BC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da061c9c-2bdd-476e-b474-11760440a05f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da061c9c-2bdd-476e-b474-11760440a05f.tmp
Size 268KB
SHA256 3f18ba5a1e349175b1b1e44dcf4b28dbe68ddd2c0a641c7eccfc89aa24b3754f
MD5 c5b2dc64847e61f7f6249d8782f86115
SHA1 122e6834ea9076665581391521cb411076ac29ff
SHA512 e4c4df9e119befa21e8e626de9ed5524c45066c520fd44390256f76d90c4b99dd5d55b273ba0b134345e22aac46abc4a56a6755fd599118d93a5c9e152e5aa89
SSDEEP 6144:RTCVQGSGkEZ2rJDyOqrKjb/+hFD+7t56OD9ZfSApprn:RThxxJr9b/yFSXD9ZfS4B
TLSH
T1D54423236D868DB78AFF5205C1FBA705C9B579F78A99694540528F8B524FC4E0333E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d222be57-ce56-43d2-952b-168dc1d32bd0.tmp

Path C:\Users\Admin\AppData\Local\Temp\d222be57-ce56-43d2-952b-168dc1d32bd0.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir564_290944515\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download