937ca384155ac9eb14fa214fb8c48358c80c5d83ceabb1d67f4350ad503c07dc

Analysis

user interaction
yes
max time kernel
286s
max time network
261s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/10/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
txxxt.txt
Size 201B
Sample261020-m4llmacx5j
SHA256 937ca384155ac9eb14fa214fb8c48358c80c5d83ceabb1d67f4350ad503c07dc
MD5 7dda803e56877a5f1697743844348e6e
SHA1 6082a9073dba8b0a4b8a3d5928a9adf90870bfd2
SHA512 7a9981c63ce77690ed45fe159a3100d39ea8b8003a76693e65c18c12c4ca678b8f344efc361a8653ceb2e2d7909021337ff00b37dd4fff259f5d9634eba2f9ed
TLSH
T1F4D022B3B101D4622B0988ED1C2EC8A082661486968E8C008020D0B608887233885804
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery execution ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
13	1032	chrome.exe
102	1032	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
3288	17ad38284844374_decrypted.exe
2780	RobloxPlayerInstaller.exe
3236	RobloxPlayerBeta.exe
5680	17ad38284844374_decrypted.exe
4908	RobloxPlayerInstaller.exe
5352	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe

Loads dropped DLL 6 IoCs

pid	Process
3236	RobloxPlayerBeta.exe
5352	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 12 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3236	RobloxPlayerBeta.exe
3236	RobloxPlayerBeta.exe
3236	RobloxPlayerBeta.exe
5352	RobloxPlayerBeta.exe
5352	RobloxPlayerBeta.exe
5352	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\fonts\NotoSansBengaliUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\fonts\SourceSansPro-Light.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\AvatarImporter\button_avatarType.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\StudioSharedUI\RoundedRightBorder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\avatar\abilities\AbilityManagerActor_DEPRECATED_2026-08-12.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\comma.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\VR\closeButtonPadded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\icons\ic-more-create.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\models\MaterialManager\sphere.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\advancedMove_noJoint.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\AvatarEditorImages\Sliders\body-type-slider-background.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\StudioSharedUI\MeatballMenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChat\icons\ic-nametag.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\fonts\families\PatrickHand.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\avatar\compositing\CompositExtraSlot2.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\sparkle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\Cursors\Gamepad\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\MenuBar\icon__backpack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\LegacyRbxGui\Gold.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\PlayerList\NotificationOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Settings\Radial\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\icon_friendrequestrecieved-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\fonts\Oswald-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\XboxController\DPadUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\TopBar\inventoryOff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\configs\DateTimeLocaleConfigs\ja-jp.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\places\MobileChatPlace.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_jump.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\graphic\Auth\vn_agebadge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\MenuBar\icon_leaderboard.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\TouchControlsSheet.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaApp\graphic\noconnection.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\avatar\compositing\CompositLeftLegBase.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\DevConsole\Clear.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Settings\Radial\TopRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\textures\ui\VoiceChat\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-14x14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\avatar\unification\PhysicsReference.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\content\fonts\families\GrenzeGotisch.json	RobloxPlayerInstaller.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5172	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-11f155f3450f4c8e"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-11f155f3450f4c8e"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4f087c32742644ab"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-11f155f3450f4c8e"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-11f155f3450f4c8e\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-11f155f3450f4c8e"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1796	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
2780	RobloxPlayerInstaller.exe
2780	RobloxPlayerInstaller.exe
2780	RobloxPlayerInstaller.exe
2780	RobloxPlayerInstaller.exe
3236	RobloxPlayerBeta.exe
4908	RobloxPlayerInstaller.exe
4908	RobloxPlayerInstaller.exe
4908	RobloxPlayerInstaller.exe
4908	RobloxPlayerInstaller.exe
5352	RobloxPlayerBeta.exe
5784	RobloxPlayerBeta.exe
2000	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 1796	5172	cmd.exe	81
PID 564 wrote to memory of 3932	564	chrome.exe	83
PID 564 wrote to memory of 4516	564	chrome.exe	84
PID 564 wrote to memory of 4516	564	chrome.exe	84
PID 564 wrote to memory of 1032	564	chrome.exe	85
PID 564 wrote to memory of 1104	564	chrome.exe	86
PID 564 wrote to memory of 1104	564	chrome.exe	86
PID 564 wrote to memory of 3368	564	chrome.exe	87
PID 564 wrote to memory of 3368	564	chrome.exe	87
PID 564 wrote to memory of 1284	564	chrome.exe	88
PID 564 wrote to memory of 1284	564	chrome.exe	88
PID 564 wrote to memory of 4092	564	chrome.exe	89
PID 564 wrote to memory of 4092	564	chrome.exe	89
PID 564 wrote to memory of 4820	564	chrome.exe	92
PID 564 wrote to memory of 4820	564	chrome.exe	92
PID 564 wrote to memory of 5208	564	chrome.exe	93
PID 564 wrote to memory of 5208	564	chrome.exe	93
PID 564 wrote to memory of 5292	564	chrome.exe	94
PID 564 wrote to memory of 5396	564	chrome.exe	95
PID 564 wrote to memory of 4972	564	chrome.exe	99
PID 564 wrote to memory of 4124	564	chrome.exe	100
PID 564 wrote to memory of 1940	564	chrome.exe	101
PID 564 wrote to memory of 1320	564	chrome.exe	102
PID 564 wrote to memory of 1320	564	chrome.exe	102
PID 564 wrote to memory of 4292	564	chrome.exe	103
PID 564 wrote to memory of 4292	564	chrome.exe	103
PID 564 wrote to memory of 2356	564	chrome.exe	104
PID 564 wrote to memory of 2356	564	chrome.exe	104
PID 564 wrote to memory of 1168	564	chrome.exe	105
PID 564 wrote to memory of 1168	564	chrome.exe	105
PID 564 wrote to memory of 5784	564	chrome.exe	106
PID 564 wrote to memory of 5784	564	chrome.exe	106
PID 564 wrote to memory of 3712	564	chrome.exe	107
PID 564 wrote to memory of 3712	564	chrome.exe	107
PID 564 wrote to memory of 6032	564	chrome.exe	108
PID 564 wrote to memory of 2780	564	chrome.exe	109
PID 2780 wrote to memory of 3236	2780	RobloxPlayerInstaller.exe	111
PID 4908 wrote to memory of 5352	4908	RobloxPlayerInstaller.exe	121

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\txxxt.txt
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\txxxt.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2707c728,0x7ffc2707c734,0x7ffc2707c740
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,16765900200877194367,14015296644755403553,262144 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,17457051315798843508,17073316141012418516,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,1935680880274999028,15598303048954159569,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,1014363901429649390,14315612100174145017,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,2432732092963460458,549141745810712785,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,1158345117192536153,1869914692509815420,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,8210345662628711969,7437438734844545395,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4260,i,2961892379866853227,16037846599235627292,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,7369221073370680252,15542916591332699569,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,15070573466250856128,15916245869347620924,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,17935163587882659105,15128009060687287784,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,9191587684330065591,11150911592434805618,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,7249110203967991378,6854946761688052833,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6328,i,512462826638272196,8192485476774730806,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,8934439273110826776,3272778136982351132,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3632 /prefetch:12
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6544,i,11313034339152248690,8069431710655881667,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6756,i,16907821896697254811,12200670718492793832,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6552,i,12539696990779247178,10066722365105063095,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6900,i,14083792764328434807,1384020320259294233,2097152 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3644,i,11034748330259583120,18192142894857755790,524288 --field-trial-handle=2012,i,3063310461634987851,1495910800346155562,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1244 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6032
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2780
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1772

C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe
"C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe"
1⤵
- Executes dropped EXE
PID:3288

C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe
"C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe"
1⤵
- Executes dropped EXE
PID:5680

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4908
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5352

C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1236

C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.2MB
SHA256 8b27af84f33c8601dc7cde7433c2577e04063b6a409dd1433676e02984f50af6
MD5 5a23330004d7411eb5c80f311ea4a35e
SHA1 a5183d66cae27bfd3193121242ed1d8eb92a4b13
SHA512 5d5519a8c7abf556bea1796c045eca61d3769494aed70ecac617e83aa6c28ca3b5128ffdaa8ff614b6ba2a0aac963ae756ca99911d61462c8c94ed4bd0488bbc
SSDEEP 196608:FzZ5rN7QFXCCoIjdWIc0ZbVK0T9eSO5U4O6:FzRcFLjdWf0ZbVhT994n
TLSH
T1A6D6AE6AB2B800E8D4BBD178C6465617E7B1B41603709BDF1AA046FA1F63BE45F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\RobloxPlayerBeta.dll
Size 16.9MB
SHA256 097c8ba9c5bf455c8241c9ee6a6e16298f35bf93e2caa755a14df5cba710181d
MD5 52698ec67c5541736417a0304c4da3f1
SHA1 eecb31fb6b91d7b5e9804723e31ba70897ba0c92
SHA512 46b6bf1dc79596684b65ce5366a0ad71764a4a1eb6658289bbc10a8bb46f279daf4fa9c5219f13942a42ec8ee0ced46eef3ef74ae3dba597107e9408aa7580a9
SSDEEP 98304:Mas5rNPwe0bsX6oj8fej5BbePSeSl5q2iQW+sCuoTpXeA7NsZ/Iel9aLjD5UYX86:MTssXfhjXr/N72IeyrsL9hArt
TLSH
T17F07C08EF5E606B8C5A15070D16F83F3EA22304C4A786EFB56A502603A336CD6559F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files\Roblox\Versions\version-11f155f3450f4c8e\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 6f800d161d9724d5793852c45e79b23f3ec6ec19302fa200161caf36c23d684f
MD5 44c73ccd6ef4be3bd4cb21174fdbdfa3
SHA1 eea77aadc6ef181df79c40980da34f1c9fc1d283
SHA512 e3db0d8d2fe6314f587a133427e8923360661e091467d875a5d958638af3d62e353b1e7a26ea2ee2e8eff4951f43f0a2c2741a6ebbf9239aa4754c84721436d7
TLSH
T10F21EE101BE60726F1E2463778E01662E7327C02AF5E5F3E55C723C804250106C69F7F
MD5 SHA1 SHA512 TLSH

Submit Download

1e826de3-88fa-417d-9e04-f0773b69bb60.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1e826de3-88fa-417d-9e04-f0773b69bb60.tmp
Size 131KB
SHA256 c09826775a38d37bca6dc225ceb46ece6a67e2bcce7c947b7901dd1b5e2503ab
MD5 08b658846adbf519c58ab583bcaed1dd
SHA1 2489843b16073377669ab80aa4d876725eb49959
SHA512 7cf2f2c8c9eb36e498631c99bb628e1d95b6a2fca2a70967011faa0c0e55d392c65b8d85244aa586092ebb835c5adbe492cdd3cb0d778f32d1e2edac7828774c
SSDEEP 3072:H5yH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJj+:H5it4fLJ0L6nGJxi3bzqapJj+
TLSH
T1AAD312F0D5A06C7ACBF7EE4145756E908EB1D5C289CDBE2405F9895806CEA344E13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ad4098b-14c7-41f9-a66c-d9734176afe0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5ad4098b-14c7-41f9-a66c-d9734176afe0.tmp
Size 349KB
SHA256 d5d13913db200d6a150645d83c620a00fd11f097bbe4b55c4f807be628604761
MD5 800485602b862ef84f540c649a7b7ab2
SHA1 670a1149b3f22507ba4a3360644fa48b99e2fca7
SHA512 9f4b900f23efcc7dd1846ea8b784eb53dab0711573fad68d52b60d686ff405aaf80dc84f4704e4ffe9fe7b953200ee1e37eb072e6c448e2d7fdd7ff6c847d606
SSDEEP 6144:ps01QY93oEO1apUcQjJX7crZp09Wq220HsGht4fLJ0L6nGJxi3bzqapJje:JoPapDQjdwZO9Wq22is6WXUx8zvpJa
TLSH
T19B7423F0D1B86F3383FBDA4298375D808D36C8CA468D6E991BF1468936498614F57DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cf6c8ae-61c3-49e9-8fc9-6473cd0aeb84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8cf6c8ae-61c3-49e9-8fc9-6473cd0aeb84.tmp
Size 267KB
SHA256 4ea0186175d00b936c982a9c1b4c274d18034f8b3f82654769a9bb1b15f0b80d
MD5 a7ab76400ad5f905ec369e14c3006103
SHA1 c5df8d23a11dc44b3cdd1c71204c96f8a0324a10
SHA512 dc134c024e015ac4a602215f567d7b942efcb48007b30c7a412f8142749f74d4db309cd674cf75e215ca92558a103a802f7034944ed9674dd586177d57db6a1b
SSDEEP 6144:W58apUcQjJX7crZp09Wq220HsGht4fLJ0L6nGJxi3bzqapJje:WqapDQjdwZO9Wq22is6WXUx8zvpJa
TLSH
T1B64422F0D260AE37C2FBED0158779E80CF37C8C5498DAD545BF68549668A9320F52EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 552e42bbd588f80b13dcd54fa12063d4f5f289a0800d3752af3913e0a92581f4
MD5 80c2b76ab4cc18f0fb52b1c738bcfc04
SHA1 31ddb07b81b8930c21511ee885eddcbbe9126299
SHA512 148c85abd0d653a8c6cc7c3c1584bc419605a23e4ca3bb572da19e3e9409e3696373e2ee73825c4fa3272bdb9992bf469f3e6d7587074723be00eff2db9fd088
MD5 SHA1 SHA512

Submit Download

6963a2f2-34c1-4ed5-a283-3f2ae41b3d60.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6963a2f2-34c1-4ed5-a283-3f2ae41b3d60.tmp
Size 13KB
SHA256 a686ae61c89fd374fff6d5da64e1abaf576d6c71171181bad4d06ecc4f6ec5fb
MD5 bb9017019c6111d121db39632384b45a
SHA1 c2a83dd401a92c2a304b3f16145d003a31d2b41f
SHA512 702e7a4c1db06449f1581334f4b554d1bb67ab8240f31171b996148b9b6eda7e7cbb2fac55c6cc5c27fb62f9c8cfb79ac7717b877b7d9b1b59a055c17de73223
SSDEEP 192:VR/cBzORJmCk5s0v7fpAPRp2XOk29UHsb+WNqfoP4iZ2ce9V4kweDfMVyIsnAUge:VR/mzOvzwjUX1Wwrv2cGV4Uoe
TLSH
T12B52C52AFE206A3BACEBD21AFD567B27E2F5102174941E80E6FC8D2C15E75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

788bfc77-b5df-44b9-98c5-53ffdf9c5b8a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\788bfc77-b5df-44b9-98c5-53ffdf9c5b8a.tmp
Size 12KB
SHA256 be86306d6ced593432ee758b97786be275ad07f261602d7808953af99e3d42e3
MD5 da50319d4a37437ab371142e80f17696
SHA1 18671c31eea9931d4336048882c445de58cf82b2
SHA512 6ed1885ed2c74b1b37907255c77263d15fb1161f4cc78f3a2df2ecd5ec71e139f6fbdf9e5beadd805450810392ae8c68b0a8a206200300c5b00332ee2a531d7f
SSDEEP 192:VRIORJmCk5Izv7fpAPRp2G9UHsb+WNnoP0pe9V4kweDf0VyIsnAUgtaJ:VRIOvTLjUXBWwY0pGV4Uw8
TLSH
T1C742A52EBE10753BACDBD22AFD667B53D2F6102174A42E84E6FC892C15D75CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c25bff1-cc36-493f-a9c8-ca85e2fc5d87.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c25bff1-cc36-493f-a9c8-ca85e2fc5d87.tmp
Size 14KB
SHA256 fe01339276cfceb776ad7dfd52667c42b1d3c63832fe8d1273d60a5772bfd7e0
MD5 49e1f2c75d2a2739f9a5785dd439c211
SHA1 c9142dca76ea61d1f230b1d3c5c3cb2ba1796b29
SHA512 92be703220c77fb281b143297629a82bdb0ae4763f4de8aca695452debad86f9ee3778991c9bfcd3c2113bd861a1278d59250d3d6903d235872d40d5e32afbf9
SSDEEP 192:VR/cBzeRJmCk540v7fpWPRpkIxxK/9UHsb+WNygvoP4r4Wye9V4kweDfOVyIsnAq:VR/mzevTwjaXWWw6rWyGV4UGe
TLSH
T16E62C62AFA102A3BACE7D22AFD95BB57E2F9102174A41E84F6FC8D2C15D75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ac708dd-0b50-4c88-8048-8dad1d2b2f3b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9ac708dd-0b50-4c88-8048-8dad1d2b2f3b.tmp
Size 12KB
SHA256 b8be9f2656babf4b2510fe435684f76ce780075c6709b5521671af355dbcce76
MD5 90026d402a98ea030c1733b6d34c496f
SHA1 009e8550ede6ffa7c3f7d65fd7516acc4f98bf19
SHA512 b125291fccb2273a7bf01b35d5d8a0ac99e23f752aeb1cb8b40728a8838881e871c151e5a9974bf01202e4978eba7b0c92c33fc08bf0b183c6ba1e4f7770e2cc
SSDEEP 192:VRDORJmCk5Izv7fpAPRp2G9UHsb+WNnoP0pe9V4kweDf0VyIsnAUge:VRDOvTLjUXBWwY0pGV4Uwe
TLSH
T16142B52EAE10793B9CDBD22AFD667B53D6F6102134A42E84E6FC882C15D75CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 66KB
SHA256 8a596a17a35458078954c00a62f5d0275b9d34d53b4c9a43660208fc0384efe6
MD5 40bdaa2e081f891c9eacb499a8c65c95
SHA1 0beeea6fb768abdbf226ae628fe175421d4852d0
SHA512 f17d84e6d85de98edd99ef71b06c52af6c07de8d1876f5a5e00cbcb8f37c4942d4eb5df2227bf8d957f95889d123832534af58572e24c4272f46a75d5949e16c
SSDEEP 1536:WDkdlwIWip+WpHzQfIeJURmzbmuTHDeqGc+OXg:WDkL3aseIoURmHWq7lg
TLSH
T1E46312EA5BCDE465FFC962DB3B7B911140348F44F5ADCBC82B4C0A88DDA1A6C6AE0141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 529KB
SHA256 6b606e3e7f690062c3868a22d127e3b6453d74a778591b0970b319da3b995fd6
MD5 e173921f952fee5cba00e9c160251559
SHA1 ecdd7ca147c12cca9ff0e3111d5cc9dc58a78dee
SHA512 adae31fad7ba1980bf878cb01683a4be44e11cd840a2985abe44c6f059de72058fda72ee56de9ae08898c06710f5cee884a2c2e62f863efe13b14cea6d3e9b03
SSDEEP 12288:TWdUU5sdssgSIWJBlKSTKktmc0ecrA3+D+K+:TWdfsdXgSIW7lXuXc0ecrAAB+
TLSH
T153B42352C478F113C997B15C43D889ECB667C802A95CEF21FEE39E1F2A285BA4371479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 91KB
SHA256 8a34db3dd801e719ab5db4f74644c5023418d428fdcd06fb32f9639cb9edb863
MD5 0e86bfe60747f0253ba5d1be1c66a306
SHA1 e031901e8ba78340eb48cded82028ccc5e591d09
SHA512 0b4412c28cb2f2eb2328df70ffa9e272ea1d79f81859eb66593640f496f4191ee5dfe66619ad4ed90293d3d81caa4013c7214c5e9d20a4ad7c30e2461c660d11
SSDEEP 1536:GWfTd7U+0Q0+a9ykEK7B8W9b/JPK8p0h0J2dXIwoJyOj/3kc0WD7:haPxyshC3dXSJ5j/3YWv
TLSH
T1079312E3916B3EF9C0F11E3CE85B4272EED3A24F77DEA4158900A501FE57D61A2D2A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061
Size 125KB
SHA256 ff3ef115db488addb98cd3b90b1e1a709fcb99725ad0b8d78dce3ada07fba1fb
MD5 bbc182ff3d647d607726ad21d92b8828
SHA1 9839dfb1d2737716381d95b96da88679b33aa978
SHA512 62b43a42488dd7ad873c372d484dd06e681432d9430c45a460cb7274c50f6921b90085caddd7791c98d5763a541c10f5ff3b66eaf0c62a7a949a068b4ae8dd70
SSDEEP 3072:yHNoNYHAl0yOUch+lM+r96cc5Od2gq4Ib:yHCNYgLOHhijr9Vc5Od214s
TLSH
T19FC323A1B972F926937851F24DA6B250CFE09DC4FAA0C89D3002D2AF7223F0C46D55D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062
Size 65KB
SHA256 be0b4efbdad0a9027b90c860e6d31176699ca3b56a0d9aadc45d4004d2f5ceee
MD5 4853911a0f03fed7d3607bfa1b4c084f
SHA1 5e08c92299de544e3034568ef53970a3e67b908a
SHA512 36b6210e87aa68c13dbcae19ea1f0a9e0253edd1373a99985d0f20c14007bb91ceab307e813c97ede7bb9d43d4fb36bbf4fc8995d50dd54c2e2d2614a4328c93
SSDEEP 1536:iujaaoGJqaZv+TSPvjkXsypzPFP58W4E9kL7T7e/oh8:iioGJVv+TSAdhh8WGLa/3
TLSH
T16F63023BC186BB0D1DF50315B1224980EBF64E692BA6D75D0370C792D8EC9CA1575AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000063
Size 56KB
SHA256 5202e90f4e89a25681ce1762af9e64acad63a63fc021dfd6dd186a244e846c54
MD5 7aeeaf83cbbcf1d4d0d790226974ffde
SHA1 3e89925404a1e5eeee864751c725ce6ca5c92545
SHA512 ed8a3326fb1ee1ec1faf32b2004fc230801107589f96d6ee26be0377ad2972b510f932bc1ec827a6ce911d64f807ca87cedead354969dba26bb89e3c322a7997
SSDEEP 1536:tc6evPRDI7KnkVSqgtBaE9jI+bChrnfJN/MwJkTehR5oEAM:eT3UYPqE9zbsnhJMrTI5V
TLSH
T1654302BA4E28EB96D730C08F8F125769E9661A0372DD754E8CF5808C72C6F58A1373C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000065
Size 58KB
SHA256 93883edcf1afd73ff36b1013f115343f90ab8e7dc97fb392104b85dcd8a81bb6
MD5 40d21a5199394b92e9ed0a6ba11a4619
SHA1 df2030af0bcdea2cbe781025f3fc6079e1cf46f8
SHA512 c84f4781b10084e28fe8ea4d349a7ce636890701d7356fad374d05ffcad3e1598c5928880fbd3f5814ef53ea0c8b4d6581ad591e667c2a38a830a947a07751f2
SSDEEP 1536:M9uVj5HeNYuk6JN9bVylY1RQGpUK9cnNGxIDi:M9uVjuYukON9xCuRQGp1IDi
TLSH
T12C4312202B9BAA57C009F72F9F6F5EC84092B35C8E4C96A2934229556A5304CBF61F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000066
Size 72KB
SHA256 b8e1ca8ead96dc5662643b63865da2d493e0aa67af3645e859eff1057404002d
MD5 b80c2f5d3dc312ed8661f00c9afb3f73
SHA1 0354b637ff22728943c946c15ee353a134ab605e
SHA512 e0ce9d89dc65cd7a5aa609b5c791232f34472ceb585d42635f6edeccf3e28f41458291a77260e572f379f6782e2325d13ab2f9c966dffba22fa394b616608287
SSDEEP 1536:R9soBVFlAeWw15TeuoQILPloUWZtuFbel/5i2tpnQcuFsRqB1/HM5:R9sUFaFw7T0RRov805tpnmnHQ
TLSH
T11D7302AD899D9011B6D041E58D235A6EF1012C150B3B3EA4CC72A47B189905BFFBEE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067
Size 82KB
SHA256 04d6678daa0ad6ae739e1a974d8853532b286b6ec9ac0734a65e0edc38fbbb85
MD5 a07fbcafb77d86736ef8fb01f9352263
SHA1 08c760d307e9615d00c856df55b26cbbd9bbd249
SHA512 b62ad8f2de50a579459577a44a1eda54168846a154fa7f1de064d1b97402f090869b8f5ee1fced64614d98699f4c5100d15ec653ef70db27557519c798db6582
SSDEEP 1536:kulTYCAy6Izc9oSzoFVIbcaX0a8dcEklOXIh3sI/P21hFvCPQasEue:zlTT6IKRzeI5yXXUD/exvSTue
TLSH
T14F8302A163B9BF017AABC5A364B285FF2D50433ED8B17E1066A93D1307D0F1A77047A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068
Size 427KB
SHA256 a7b2088ea058f5a2e8d87925a59a6c911a9a356e6a26c745b069dd0f5cd9ffde
MD5 bc0915e9c168b3fdc8fc418e0ddb45e3
SHA1 e9f727c4772c52fdc7073b18f8e9121024378bb2
SHA512 16f3ee8bb2b3e7972063d93476186e43b6649c1004184f0598788f88b124e4e55cd5042f580c6495d7f8fef596d9058f5bc9a79c433fc69e15a75a409e53e78e
SSDEEP 12288:ZXlVecEWhSahKhD8a4H/l/UItlEAZcB6B:Zn6WhSnAa48IDY6B
TLSH
T1EF942376060C515DBEA0EF1346E116BBE2325D2F210075FD34220BE612362999BBBF97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
Size 277KB
SHA256 1a1fbd0328b73cb81f7e24311ca6e3cf64a85f4c39141f00a06a87b3ecec3f2c
MD5 fa1e930bf94cc6c492aee6ce80d80111
SHA1 3ad2b9b803042177eee7484055ab7580658218f5
SHA512 240c5423e87594749a78ba555fd0aa9a3f3914d55b564a15358410587cf10dbdd231ec8b0a2a12c3bad69a87c4d33ad36848f5d23bc356d47c75cad53dae06e3
SSDEEP 6144:RFCIQQYB3FqtB7dbNk+RQxupm2+cxCJbH4vjbNsXuI:RB3YebNkQioCcxCZYrouI
TLSH
T13D542315AF667CD8A68C5FA77D266FCD8352F372B7BA32C2993E41F00997B751020242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006c
Size 34KB
SHA256 95795831365e2d809f5800ac14d191b74cbe34f5b1bc756d2badaffbaece963a
MD5 3e886f90af804326c5a578ef2262d4e0
SHA1 8f5a3ef4891e21301ec62e5d5b02471babae98cc
SHA512 fd8a15f4526f7bac6663c10ce7f4145d5d8b9025729045b2c085d748bed09b424b04dfe650506820d0ad9e77f01292c0999a88a34757a914c8cfac3f6f6a2da9
SSDEEP 768:KmfpEhdRkFiveOf5WhApnfB+TLbZrr7MFjLUFP8YyFPr8K9CyGfgEVfgnM:KmfpEhRmOf5bnZ+THtrwe8H+vfgE+M
TLSH
T154F2E1DAFD54F203EA292DC111BDA08C6DDD35B979EF95F52668CE0935A6D08C00AA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006d
Size 34KB
SHA256 1a5f55a95ecd7bb13261d765c57883366ef18f480746523bd6d1263afa3133e5
MD5 0fee9bca7b95eb8f86336bfece97c6ff
SHA1 93108ae767bd45bfd017e50301558742dca142b9
SHA512 28a8cc8dafc2b2ae2bd108041d13979ff03363060f0a02c75bf3994e162b82f12f2938eb593932f74b0203fe6e57d43f28c7eb2051b4d497263a2f5b172837f6
SSDEEP 768:0Ppm11YyP3x4tnHfJ1CrqynVc343iwjwCG2m2p:0w11YY4F/3CrqynG343iw+2t
TLSH
T167F2F173765A16C8DE788131BE0A9C223C49E357A2C5D7E267892CC03AB1DC1A33C636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006e
Size 34KB
SHA256 e1938cb55e6f1fabd08218dd1876cd4498341dd577cceca1e40e94b295c319a8
MD5 0e651db015baaa2adfb96ae73e5e3ae1
SHA1 2b7ce1d6f7ae7b4dcea6ff2d54aa67bb360073d1
SHA512 8cbcde1ebe508e8edfb8587642f073942b5a3daefc3a5bf25a7473c0a03c8791b55fafd4fe115a27b4fcbd6add652505f929d871d033c196657e84f320fd1616
SSDEEP 768:T3yCKXsDxMHmew4dI4cry7G08ehYuRQeIrapoctY:TJKX4xMHmew4c27R8dFeIra6p
TLSH
T1ADF2E1D6B5C91C29E593A7A140E41324A436BCB40CFE7C8EF750A6784F68E734191BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ea0fc0e79f560a2ea1e1456e74c6a462ac373d20caef66e0b014231c9658f2da
MD5 cac8588d98d480744294a4070a237b67
SHA1 83b0ecc61072c1fa209717159569db5912661048
SHA512 8dcf5919e45b0fcf43f365b5bcd23052554f04bbf12a932c73e13ffd46181a4f55c1e60f47e675994664e9dcd52a20c783408b55d599ccc5997f4a3ba0733f6e
TLSH
T19581C617CFC2A024CF641EF739AD8D2B251C14AABC125B0B425436D2EF139EBF6E4854
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Size 347B
SHA256 e8bd0c91d28669b54fa8582a44686fe1d1cd589b0469d7ce3923efeaf445b341
MD5 5bb6f7a054387be99cbef5e0df270cec
SHA1 f685f342da4ba7f08cba998adb8d99e3d4c1ecc0
SHA512 2bccf83e2919f3507721a5f8c94e8d4bee2c8d49027ef1b8d9074c4285d86ac9831ccf99d822ba3c871b0ffa7b0d9dc93e4225fc3596d6953cdf5daed1ea511a
TLSH
T1BDE0687881C8C22F2058C0662328770FCFA3051EA6CCAC864F81F42031C940C94A82A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

714b1c0c-0915-4f83-a83b-e1f59fddae71.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\714b1c0c-0915-4f83-a83b-e1f59fddae71.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

942128e6-3529-4a0f-834c-47f7763a6a19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\942128e6-3529-4a0f-834c-47f7763a6a19.tmp
Size 2KB
SHA256 60da9fb23667e35518cb14b67ee0428257855d6b3beb5a5cd9f354eaa5bc6e10
MD5 d36b8d751b19688af7093f9ab5d2adc9
SHA1 b9069a8b0b4b8a7f21192184f66b5d71998b3922
SHA512 78d588a557b3d57eda879fce1db32a786d41dec45968e6efd8ad1423d76698625bd8fa2ac6d7a591d1b24f99168a8599ffae63e7d22ddf75e72362bbf235e912
TLSH
T17F51CEAF967F752B1029997B1D09FC0A57B6B83A014260F8CA57C22D70C59F74B928A2
MD5 SHA1 SHA512 TLSH

Submit Download

d72496d1-34e6-4a7f-8527-ccb16d234a0c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d72496d1-34e6-4a7f-8527-ccb16d234a0c.tmp
Size 9KB
SHA256 8728c9cc1000a1ca9d1762dda9969d85383dbc5b8121193fe8771f6d5a88af43
MD5 098f14c13e507a771d093ed7b95a8001
SHA1 217db47ba85a8413b6c6830732d7ecb899feff3d
SHA512 8fac9869837a85d80ec667d61bb1d3e51981c89c264e8357d8edb351c019e25105fa53833a7936ec194eb7aa981b6510a42a62f26ec3ead2257366ab4741bf79
SSDEEP 192:Dx8c9bTNO0q+YIazaIPw591tH5ZsIeI7tiNPiMulg98Xf/sQmYZIybRZlhnNHA:Dx8c9bTNO0fFazaIPw591tH5ZsIeI7ta
TLSH
T1B222CEF7C3E8C62D895156F49B15BE1BCE191928431C3876C8D4BE1BA3E3871E211B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 4c44404736e24c820486585b10a4b158bd73282297e1df73ba1c1a8be224d0e4
MD5 fc66ebfd887b842753300dbd68b49151
SHA1 215d63e093a9cd63e1c63ad4eb0713495f282700
SHA512 b0ba560197fe147c675959013842f1664b4c235fd18679c532253d92b3ab590e610741d710994c1fe72d5905e424c55e2afd66123a7eb69ded5faaf1dfe8964a
TLSH
T1AAB0128680862701C04503B1219090647370DF34E51213C646E01D119C39170461B24C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 49afd12f1d7015655b5ebff84158e4e22dcb77d3bac7a4a823d1a93211743283
MD5 64a6294435a8aef66da0f0b6d9ccb96a
SHA1 7e368142cf383f7173e7d9f8ff86d0a88d6a5b97
SHA512 950d7d7a55f958f598aff5563233bec1c0f54a9f92006ab5e8f6e033e1a0a49c6554b9e899b5d343cf8859bfbaeeb9b7d7a7230813525cf0469a933bfd0c6983
TLSH
T1F3B002ADC147B212C1A243B039A5A5D9B560DF26CB03171A92F06A7BEC35A684935560
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 fa118c2c28666432dc465d209892d0c1cd0285585fbfe853e760a92934b78f2f
MD5 640758551c52a76c888a64d7c730dc41
SHA1 85701ab4779a87ab4aec0038e4bd3cd41b4c6292
SHA512 c4ff8a90738cc5d0a690a61e22f04f519a8b23293f4d2194e93563a16387a377b8ea5e3bd61db67e0dbff0972f1a83ae8126f9dc7b6b91aa21a2ef2f280eb172
TLSH
T15AB02230E2000320EA3082B02EE8A0C3230AFC002B23C02B00F00C08C00B0BAC300320
MD5 SHA1 SHA512 TLSH

Submit Download

ae81887f-0f94-428b-ba5c-6ce908398cc9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae81887f-0f94-428b-ba5c-6ce908398cc9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dc561061-1f7a-41a4-a5e2-80063067cbb0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dc561061-1f7a-41a4-a5e2-80063067cbb0.tmp
Size 17KB
SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
MD5 4c845b2618eefdd47280df258df1e5fa
SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
TLSH
T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1058a3d-de21-46be-a073-f05926a5d009.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f1058a3d-de21-46be-a073-f05926a5d009.tmp
Size 414B
SHA256 8f22bc59e54786364fb282117cad8ed1604fbde91a7bb9e8cd80a91399098b50
MD5 5bdc3eabac875faf3092c2beef5a7db6
SHA1 c3fb419af088719568beeae99bce15de23e7ce49
SHA512 34fd728dd9b92bed61fc072136caa9fea32bda7e8ea57ea82462e3398b69674a0d3b4969eb1d25f2418a75fd6e645b5d8dd0571a5588df37c282ca7a82e1dde7
TLSH
T17FE02BE6C921ED2B58FE4B1960950B06E75413172E40450F373D951C8FB0A370595C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5cac1ea42f8a8f140b1146d88fe370d1521138711139e4914d7bceb7237f1656
MD5 7a6c22603e7c3ef43586d4e8c96f6491
SHA1 8dda968e09be294cfd674fd632475c78056aaa01
SHA512 6010c2acc7be1751a759c59724041825d37dc8fd31907508572804df6d7572db9e07a45ee5189285c5cf2100ed92c2f01818f4ee838a0692d307e2e8769633ab
SSDEEP 3:MsEllllkEthXllkl2zE/ltWZql:/M/xT02zU
TLSH
T18B4402046B800407C6001130506183501374D8200A125743285394229DC9A810D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e30848c1-083c-46ce-9f92-d10fb84ecea9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e30848c1-083c-46ce-9f92-d10fb84ecea9.tmp
Size 130KB
SHA256 f402e8f2faef4aab8d1ab5963a590f8b3dac3ca46e07b83800058737d85167ec
MD5 66830e336ef6652d889ba92d5e97d08d
SHA1 0b57326161a6fc1fa0cdcf449b93b1031799edf7
SHA512 4bb755ca34ddc2dd7d0703767a4014bab72befa84e8d206ee67d4412bb7924442a464e3b9217fba649f66d5c7dc00e8c775288e3819884457f8208023618b6bb
SSDEEP 3072:T7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:TZt4fLJ0L6nGJxi3bzqapJjP
TLSH
T120D312F1D1A06C7ACBB7EE4145755E948E72D5C289CDBE2405ED8C1816CEA344D13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05ad996224bf0ecb21cd232070fbbd2b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\05ad996224bf0ecb21cd232070fbbd2b
Size 596KB
SHA256 16cd03787910fec0340c58cd4efd4ba47d1f00d61395c76693cd5db695db58a4
MD5 05ad996224bf0ecb21cd232070fbbd2b
SHA1 6cdfe9d46d3269e9e6f02883db3d1d14f0183af7
SHA512 f6cea90b1282aa0ac2554cb98335a5817186ebf4327458333ba1b160918b6e37c66ff6e4966d95ca11461017171900e4b1eb5e5324ed805c32537386f5dc7e36
SSDEEP 12288:Btj29etcNztbhDOlam2l03KHsvwyjwLKqneiAKWBTd+lPINsbtrOqefzK:v2U4jDKa5K3kByjwOqePjBd+jY7K
TLSH
T110D423A413287960EAE768E78E143C0E7511DF347F0737970A9097E17C6D7EACA609E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13bd4d729bed81aaed788e7904476fbe

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\13bd4d729bed81aaed788e7904476fbe
Size 5.5MB
SHA256 9ee8b87863cdf22aa83cbb7410b5762720faf24afac78be37fc72f52a335bdff
MD5 13bd4d729bed81aaed788e7904476fbe
SHA1 6a45af5f77147d16a476a0254b94851884cc5cc7
SHA512 a791bcae19a83772bddfa165a9bbadd820030f4ec7363d0082cb96d579ca3f4af74270b936a631fe605772fbf50a40a71adf61dbd8c11453311e7f9e7fc33b55
SSDEEP 98304:N0Tdul0TFdExpV/Jc5fqP6PP58ynUTufW7MAtUcHoY4zx6y:N0gl0RYfitU6PB8iUT1RUD
TLSH
T1F44612FAFF7D493DC1779739920388129C68641A9A2C650F09296CB599C3AC7DB423F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

154b9840854f37ad3fe8f78f21eeaa0f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\154b9840854f37ad3fe8f78f21eeaa0f
Size 758KB
SHA256 504e47b0a00443ac00b74b292a648cd548c7d8d89a17f8c811f160af2f4195e0
MD5 154b9840854f37ad3fe8f78f21eeaa0f
SHA1 437b257261d858e2ad1958ced04778fc9263be18
SHA512 54185a575bb9c7debdcc0f688f0b823144609dad83f3038dc7c02012343ab5e770ec9b4b6a50d0b18bc6309d1fdf83fdc21dc972e4905f6d2d869669e81e5b1f
SSDEEP 12288:tMyCA486ATd7EC1KzMrJkYnZEmFwlmgHTGs4ro5pvonOM2pI2cVWf8tq/d0yW9gy:tZA86AJVIkJttFAmgH0ro5yOs2zfhPWB
TLSH
T1CFF43356E76E13CC88723E55164858F351C2CFF896DDC1C29E3B82E1663C1F884AE96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

227e7e36132976d53a7a2f0c7a256203

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\227e7e36132976d53a7a2f0c7a256203
Size 2.7MB
SHA256 fcd44e8a02fa69e93d280d8ec2cecc88651d0095a22902593b28b88a7e2438b2
MD5 227e7e36132976d53a7a2f0c7a256203
SHA1 c9cb701457b85e5a8e5d5272e243234d19c91cf3
SHA512 7be758b101730a942530805bff21e8082713a91267d340acf6d474aefb6540f718e33f48a7ee9a3822cf07a6347b1dd916721cc7c197ad66f439d982bd388f9e
SSDEEP 49152:x5/6j0vnXr6T5U440dGco+ESgTaJ/O19N3wswHS/9EZGoZII:x5/6j0vnXO74OGl+EVG2ZwH5ZGouI
TLSH
T128D533D5DD55308DD0B7323383617522D8A50210F8B5EB4B6BED82F4A449FEB8A2A7DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67226d220b3c234849b54be9f0813a1e

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\67226d220b3c234849b54be9f0813a1e
Size 299KB
SHA256 05cba50015de1924108c8cb1bdbbe5e4e2d65f09f2c83977f59e1781a2498d8a
MD5 67226d220b3c234849b54be9f0813a1e
SHA1 887173742e50c4da92a5a42b09cac239130077de
SHA512 fb7ecda3355b040246c87dac3a53e2a215409f99f0288f40b9917b761c4dd5b9f5c2e66daf080e31edb52630bdccb5410a70e130054b317f21080fd7c55c5e58
SSDEEP 6144:j7bhY6n1UVvdL3rfcheGji5cPVTLpUB7b7ZwV0zejicnmZppWKOwYjKUTsQR4:vxyrYJyc1Nq7b7ZXzejiwmrrYOUl4
TLSH
T19654122BDC11064FE84C67FBE4AB4123983807D2492668BB26ED25E54DAF5E37377183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ec525f840c1d9a4be0ab4f6097713db

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\6ec525f840c1d9a4be0ab4f6097713db
Size 81KB
SHA256 64a777328e60502399c3027af9c429887daae573b3d48b9145244923562fe6b9
MD5 6ec525f840c1d9a4be0ab4f6097713db
SHA1 abe2ee039bb8367ff9c9dedd59715002f1040c37
SHA512 0c49d568989871bd7e3ea2574bec3de23726dd7804c82f4d3edffa0f2588b65287e081337da351140ffbe891c8ebd0a01c5e60f8e388eb46271d4fb8319bd3b8
SSDEEP 1536:dvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHK:NP9Z3Qb6+oj2oCv2UQ0e6DPK
TLSH
T19F83125DF690E4BCE54759FA88208130C8DBDF9838DF51C0BBDA7695D9C4208F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7071af81f7fad1d26ec29b7699f2d96f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7071af81f7fad1d26ec29b7699f2d96f
Size 5.7MB
SHA256 21f2759a5148c427118911ae402be2a2def56f29bedbd33ace3ed2ed714422fb
MD5 7071af81f7fad1d26ec29b7699f2d96f
SHA1 0b0d2efd7915cba61b677389858e4a1b3d896699
SHA512 966824925a1446316197f19616854318a76047c1a20af4bdc34f41dcec60f7a93d68f2c69578be830c886610d094df90cbb757450549daa5e7a3ac43665e0fe0
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA/owp7PcA1VyzKSpPd7ibGGg5caGctpTc:Mg94jwoalYarlrG9P3VEkx7PcHf5xiai
TLSH
T16F5633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D25D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aead7c29ad16cd54c0022c6bb6fbb7c

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7aead7c29ad16cd54c0022c6bb6fbb7c
Size 127KB
SHA256 61b34ad4399a3058a40861aa400cfd8649d59820d95929f3ab0bb3948c1aa99b
MD5 7aead7c29ad16cd54c0022c6bb6fbb7c
SHA1 e23c293ed4964aae80847a87a9798b21e703cbd3
SHA512 4a4c839355fbfe2b02004c2388e4763264df46787c45c4e1cfdcaf7f326599a6f9d84f0d00a38871bc89d50cf4d1c24c7bc8a5031db3aa3317ffa28ea55f1e47
SSDEEP 3072:lV2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuGq:lYBqPRsnRq7Ybl+wX0kd
TLSH
T18FD313783C789057E617E00621AF5233F53BC9D4A2F023D99A93D79725183F25733AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b51abc8ab8054a9eb519b3408c7bd1d

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8b51abc8ab8054a9eb519b3408c7bd1d
Size 5.6MB
SHA256 03f2fc94185a0c8c7d5c4f653a30793cd5436c47ed2828b19d9547ad4ca935f7
MD5 8b51abc8ab8054a9eb519b3408c7bd1d
SHA1 e1d7ac5189c312c1686e53c89f4070b41894c7d1
SHA512 c6fba00999cd65c953d1ab77110dcd43814aab8c217c604d1c22c2a8e1b0baa4b8b0bb2f22d46e9135eed9eb589a418a85233bd8e131eb231f2f3c568493b700
SSDEEP 98304:sVd+l7l7dCsnCavaYbq4fQXxhpLF/ciKysKLmd7YfSJAcEsnYdTGWax9sESu8hTj:XZZ7Rvm4Y1p/NK3KqufSicEsnKJDHmh+
TLSH
T1104633FDFE74093AC223AF367101985268268F56CA14511F643AA474EEC33979F436EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0981f86f5aa4b998353be448b4b24a2

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b0981f86f5aa4b998353be448b4b24a2
Size 26.0MB
SHA256 5c0e7ee2251b36321c0fc452ecd11f9db50fb4ea6e1f99694583f53903c69112
MD5 b0981f86f5aa4b998353be448b4b24a2
SHA1 8b1d6e562c5a53549fdca758323c40460a7931e1
SHA512 48502c32983a71ae51445664471bdea9b90970d40010defd09ef9a0d4fc5dd7cccb673a2d85f900dd62f6b080f825b03e5c13e19b785aa8ba916496e4400a2a2
SSDEEP 786432:F+5Ygqc5tojtCjIf01A2Q/RPbpJlDG47/znxUYW:F+5YgzYjtQIDxPlaAznxTW
TLSH
T19F5733C46111E7FEA786F9A3DA31F740265F85C5CEB2D27DE0C4110B2856AE30A9B5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0eaea6e38883c2f552ebfc3c49a66a7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b0eaea6e38883c2f552ebfc3c49a66a7
Size 605KB
SHA256 bd9d84b18399042e0478ccdc989081d48a82279a498b36efaa197a317e01df76
MD5 b0eaea6e38883c2f552ebfc3c49a66a7
SHA1 1b60707348ac83d958ae17b165d073e5b2ac6743
SHA512 87fb0c3590563d24ec5c4f3400f586f5222588b3c221727b1ea7e90a84dc9f6188fbd5bc6f240b7b14409670b6780bb9c1401260ff48f95db27ac2a9a0eb745e
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglT0w5pKmWTXU48aUB05C2U/JV3IPBxhKOTqzi:kWalwpnZfyoJMCgl4ApKmev8aUBQU/fc
TLSH
T15FD4234C1EB1ACABF456D3F9CD74DA888A10790E8F697F0F25F6309975121B11EAD08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6728552adc0631741832b9b8fef8df3

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d6728552adc0631741832b9b8fef8df3
Size 294KB
SHA256 154b328d28592dcbfe1f1ad36069ae5f8704f0c99ecd9840ed540fc41bd03923
MD5 d6728552adc0631741832b9b8fef8df3
SHA1 3943cda753de7a49d6d043c29f28c8509c7daab3
SHA512 dab44d810adabe882b14ce6701a3de0a1fbac034836639bc2380861662744186393e95caaccff1eef41dbef1f29978b19bd27a895e036a6bb9d50b0855b84e95
SSDEEP 6144:HvREkFlF8j41W6K+uvUrx2lDiDWVVNydcjlgMyRWf2/1O:Hv2Qz8p66vSyVLgNMyRWd
TLSH
T1C35412FFC412406EC173F77B33B96A1242186876420AD85E6F6121B83F6B0C76B5B5E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4777783652cac408a27b7c864709d26

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\e4777783652cac408a27b7c864709d26
Size 411KB
SHA256 38748a06add4f77d0d64406ebd757250743efcfa58f490f6356a316d317958e4
MD5 e4777783652cac408a27b7c864709d26
SHA1 fa6d90364c44905dccdf012e5ef543a893036a37
SHA512 e75d8959405d6bb0a978ea589c5c8e43a23122e78ddc07540a7b7fe892e9b127c1f4785ad671f6f55a4364974f12a115b2de50c9759ddcc0f8807865e7e718bf
SSDEEP 12288:+zBqvHdaaBGUD+rLlOqS226eCvGoB8pLhfdP:+zOHs62E8DDeoGhf5
TLSH
T1E0942357DA3EB5ADF2D5836FC814B04766E74C186F480B6762928CA7EC98672D0C4C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edefea49e7603fe9b7aea1ee419ef57a

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\edefea49e7603fe9b7aea1ee419ef57a
Size 13.2MB
SHA256 d6a0053b3be67f38284cd4e27baf670afb9e93de30030df76ec89a2c3a8e4fc3
MD5 edefea49e7603fe9b7aea1ee419ef57a
SHA1 9fd32cf6bb2c969e952133f3c399de5ac705a632
SHA512 b7dfe05bf2a819ec287480ce2852991c19383c19c88e2e0207a61c60e274e1b131b786a3332e9016af68828297cfd72d93a2d0672ce2cacdf8dc88b42b28ad73
SSDEEP 393216:wwKSBHknn9VSoiCi0/bcRyBq+vZ8BCeoT2A0OGXon9Tm7EbRNaY2A:5Be94oiW/YABqGiAeXhWznaYv
TLSH
T1B2D63396EFF63D06F53280EC96A9BE8AE6D70F05D051C1354E7B79D20AEF048C85869C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe7b3ecee91e83f9fade72e8b0f4d47f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fe7b3ecee91e83f9fade72e8b0f4d47f
Size 4KB
SHA256 80e94cd6207f71b8a703037cbc769c43f00a211c94f37df49f8dbbf52ff63736
MD5 fe7b3ecee91e83f9fade72e8b0f4d47f
SHA1 6fd38980954def6f3ca4205ff35bee0c234d059e
SHA512 536fca5bf509133880e39491d8907ab36a83529825f935e759ae95dee80e25c769b566a30431ff8dac5e556d728278204b55e874cd583e684bea50d143fcec9c
SSDEEP 96:CQtNO44onbAVGlNtNHJCAIeZWEfnZi5nsjDzezMVT92Yo1B:C0U44o8VGlNtJJ6akCXekwYo1B
TLSH
T13DA15DCACC46061FD10B953A140A95A999FFAF2FD006308F2410981E8A06DEE764D7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 3c1bcee930995d8dfd74646c51770eae9dbf3076103ee0c9ba7649da9af0433d
MD5 d6174b662819b561d839326756867db7
SHA1 4f6e8bc7b33cefb4ed885ac133ed7f31e6d3d535
SHA512 7d655fb44583558d07568b3b3d62afa0596f6d74d4b06dc6cea615370c3abb01c76bf89f2e8553e26304009fcc768ac8b3b325b42c85aa93db67f9647809504a
TLSH
T1B9A022EC08A83308C3E388380880020CA0B00033C0FC2A8080000F000CC0330CF02302
MD5 SHA1 SHA512 TLSH

Submit Download

RBX12489C9C8B0F4775808FC561EAF9B372

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX12489C9C8B0F4775808FC561EAF9B372
Size 64B
SHA256 fd51f297ffd083fc1ba630421633c9fb3dbb1399da50e37f9f488e7725864e8f
MD5 331c2ad9581bee9831cd0b2623dc040c
SHA1 e8f5616d56b559529104726f13c8585983d07c33
SHA512 7d01e010d3762397c3a90c9b2b3451ab516b5c7b9c5269eb8dee2351dec16c62b7b33605aa44630466e31c3f57369f78a10b464a72a245353383d71ae2489e26
TLSH
T17FA0029D6E9E37C89382907555D4026CA4D8106591DEB65910018B209CD9774CB56A93
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 4099bc1e5bd818e714c2265127e6b2557fc1351e23792d87db7a3d32ef4f8cb0
MD5 24377b7daccb05f6da2c6388ede07e6c
SHA1 a3f27c11c5f5c7f50da079d1408d0a1a817279ac
SHA512 654f5cb75aa6d3a6952602b61df31a945f6621a81aecceae901a5fb7e1e517b8710c8b08a40aa588fd0148457d203fd3a78493a8efb3664d0737085612497b9f
TLSH
T18A21BB101BE6032AF5E2463779E056A2E73178426F5E5E3E56C763C804650106DA9F7F
MD5 SHA1 SHA512 TLSH

Submit Download

17ad38284844374_decrypted.exe.crdownload

Path C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe.crdownload
Size 148.8MB
SHA256 c6c1ec27bb9515e946f9ca2e233b6b8ea51d8764315315842a4e05ebd27f7534
MD5 bf23b2f85b11f3c77ea84adfd62a7936
SHA1 3dadaac8f80b7416f15a1b355898a37f66c61040
SHA512 6fa9befe2255d7c9c39f54dcb7dee70faa44e095eaf1610666b23728e74212726a792990ce6b2f70e2620ea7d09fe57a4e7fea370fe7e36beac08e6fb6324780
SSDEEP 786432:JLtaYLQcRgeXwm9wqsa3PVm1DW+mN41zig/dKYxCj8Yl/3A:dwYLQheXwmn39mdW+34gjxCB
TLSH
T17C78BE5AB1E940E4D1BAD078DA1BE927F7B13824032057E706E0866A6F73EE45F7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17ad38284844374_decrypted.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\17ad38284844374_decrypted.exe:Zone.Identifier
Size 237B
SHA256 8c270f8c7635dc7af42a297124a5c23f82d0d15c42a9bd60a3cf4de49c9dfb40
MD5 63ab96aac7edf7f9feb37749497207ee
SHA1 fb82ffcd742b7cdcfd59e92db29dacc7f07fc065
SHA512 8af1f546b9dc69d1eddc9698c9571234f84ef1d1c3028248afd51b62c0caf3559cff55e3f3284af335169b4eae36ae3b1edf9d6b917c6dc5097cc9a649c27b95
TLSH
T108D097B37000D8221B0964DC1CADC8A0C11E24828A8E4C00C850C0F7088835B34C4805
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.2MB
SHA256 66d43624ecd072b51a21b90acd70ceace8da1f1b9a1d90cdd938d7e168a18396
MD5 4339275c67af8d0c0b42492c710e28e2
SHA1 f167123c6888ff1e42308ce836a2eef0fdc3d5ed
SHA512 8a67d8dc5ccb3c364f79c7d14b3ee808f6ecb516f6c0aa6db2d12b4e5fd0a8a37f7bc8c6a7304c17d67053947b5dd3a145c1670aad538ed8a843143c00a2e528
SSDEEP 196608:GQSUDMmsFopEY1SG20WfPyFFZz2k+5r82I0g0:GQShvFeSG2jPyFXzE8yg0
TLSH
T140D69E6AA2B800E8D4BBD17CC6465607EBB1B41503709BDF1AA086F61F63BE45F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
Size 171B
SHA256 58ec75b0131395d2343d4afe5d8ffd79d5468b72ad72163b3ab27ca6e086419f
MD5 fc7656609e9e6e7155ac93c00af9d3f0
SHA1 2edae2fb0de53976ef465f7e85c82782f4753002
SHA512 46509407a7da60dc67d7ddf1f2050b18448ae6c815703e1cecdc5bd0c58856e1ff15400f50ca6aabbc2e0cfce703b71aafa932e0793a051e6e6132131997c1af
TLSH
T12BC080D6D7058090364013DC23BDD4EC77075555454DC3C4D544A497560485E7660557
MD5 SHA1 SHA512 TLSH

Submit Download

a5e235c7-ef6b-42b1-b6c4-656533ce497f.tmp

Path C:\Users\Admin\Downloads\a5e235c7-ef6b-42b1-b6c4-656533ce497f.tmp
Size 12KB
SHA256 3a17210b387086805e7c3b828fe702148695b2e5ad6aa056a6a85b28e15685ca
MD5 cec69aa67d4fa9b26de5d40e12644121
SHA1 47f0e0fc162a4e0fcfdb55b23679cecdd5574a43
SHA512 9073606b17ea281189e66c20d03ff4307871760eebe03607b88ff785af21cd9d6747e8b77b8b4bdd633450a51fdf208b77ef34b1b44af4a3fc251164db0e71b8
SSDEEP 192:zGCbgqwK2a5OVDrlWjtxo9XjXPXG2cV9TNJL:rgqn5Omjtxo9XjfXV+9TfL
TLSH
T1EE42C9339292A9B4D518D33D4382787BE075788B437190DF1A0A07A7277B9E95B7E3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download