e514d4d57cc79a2a4f8fb21ec3bcdd956d05611ea86caeac17f19558ac806688

Resubmissions

24/10/2026, 17:41

261024-v9sk5ac13l7

24/10/2026, 17:35

261024-v6ceqsbt3v7

Analysis

user interaction
yes
max time kernel
104s
max time network
106s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxPlayerInstaller-4R3CXWJ92R.exe
Size 13.2MB
Sample261024-v6ceqsbt3v
SHA256 e514d4d57cc79a2a4f8fb21ec3bcdd956d05611ea86caeac17f19558ac806688
MD5 f33251e4d51275b841bd94db4455bbb8
SHA1 2ff097c002c518eaeaa273060c3619c3f97d39e8
SHA512 f144c0a30f0760006779886cda103d436892f6a59bb302f638b00a7900f2aa098f0d03595fc2b33b0eeb96c076065c93976de33732a512b1a26a39241d05b823
SSDEEP 196608:xRrD9AeeBFMAzvtRrWvtRrDqtGsCCk075LAVTwMen+6wNA:xR1A5BFDRrW1RrDqEdCHAZwh+lNA
TLSH
T184D69D6AA2B800E8D4BBD17CC6465613EBB1B41503709BDF1AA046FA1F63BE45F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3148	RobloxPlayerBeta.exe
3424	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
3424	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-4R3CXWJ92R.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
48	discord.com
49	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3424	RobloxPlayerBeta.exe
3424	RobloxPlayerBeta.exe
3424	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\DesignSystem\ButtonL1.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Emotes\TenFoot\CircleBackground.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Settings\MenuBarIcons\CaptureTab.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChatV2\ic-add-friends.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.dll	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\avatar\compositing\CompositRightLegBase.mesh	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\avatar\heads\headI.mesh	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\fonts\families\LuckiestGuy.json	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\LegacyRbxGui\LogSide.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\transformOneDegree.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\XboxController\ButtonY.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Vehicle\SpeedBarEmpty.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChat\9-slice\modal.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio_6x6.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\PlayerList\FriendIcon.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ssl\cacert.pem	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\advCursor-white.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\places\VRFTUX.rbxl	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\btn_newWhite.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\configs\DateTimeLocaleConfigs\es-mx.json	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Input\IntroCamera.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Settings\Slider\SelectedBarLeft.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Vehicle\SpeedBarBKG.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\fonts\families\Nunito.json	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\particles\common_alpha.dds	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\particles\fire_sparks_main.dds	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Settings\MenuBarAssets\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\avatar\unification\AdapterReference.rbxm	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\DevConsole\Filter-filled.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\ExtraContent\textures\ui\LuaApp\ExternalSite\wechat.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\AvatarEditorImages\Sheet.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\XboxController\ButtonRB.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Menu\hoverPopupLeft.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\sounds\action_jump.mp3	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\fonts\families\Guru.json	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Health-BKG-Left-Cap.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Emotes\Editor\Large\Wheel.png	RobloxPlayerInstaller-4R3CXWJ92R.exe
File created	C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\content\textures\ui\Emotes\Small\SelectedLine.png	RobloxPlayerInstaller-4R3CXWJ92R.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller-4R3CXWJ92R.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5764	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-4R3CXWJ92R.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-9ac8595712b447a7\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-9ac8595712b447a7\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9ac8595712b447a7"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9ac8595712b447a7"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{B8B73EF1-B60F-45CA-9A23-52F9D9070165}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7aaa6838d36c4448"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-4R3CXWJ92R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-9ac8595712b447a7\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-4R3CXWJ92R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-9ac8595712b447a7\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-4R3CXWJ92R.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3124	RobloxPlayerInstaller-4R3CXWJ92R.exe
3124	RobloxPlayerInstaller-4R3CXWJ92R.exe
3124	RobloxPlayerInstaller-4R3CXWJ92R.exe
3124	RobloxPlayerInstaller-4R3CXWJ92R.exe
3424	RobloxPlayerBeta.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3424	3124	RobloxPlayerInstaller-4R3CXWJ92R.exe	92
PID 5528 wrote to memory of 1464	5528	chrome.exe	97
PID 5528 wrote to memory of 5764	5528	chrome.exe	98
PID 5528 wrote to memory of 1056	5528	chrome.exe	99
PID 5528 wrote to memory of 1056	5528	chrome.exe	99
PID 5528 wrote to memory of 2252	5528	chrome.exe	101
PID 5528 wrote to memory of 2252	5528	chrome.exe	101
PID 5528 wrote to memory of 5508	5528	chrome.exe	102
PID 5528 wrote to memory of 5376	5528	chrome.exe	103
PID 5528 wrote to memory of 5508	5528	chrome.exe	102
PID 5528 wrote to memory of 5376	5528	chrome.exe	103
PID 5528 wrote to memory of 4656	5528	chrome.exe	104
PID 5528 wrote to memory of 4656	5528	chrome.exe	104
PID 5528 wrote to memory of 5532	5528	chrome.exe	105
PID 5528 wrote to memory of 5532	5528	chrome.exe	105
PID 5528 wrote to memory of 3756	5528	chrome.exe	107
PID 5528 wrote to memory of 4872	5528	chrome.exe	108
PID 5528 wrote to memory of 4872	5528	chrome.exe	108
PID 5528 wrote to memory of 5748	5528	chrome.exe	109
PID 5528 wrote to memory of 5748	5528	chrome.exe	109
PID 5528 wrote to memory of 5452	5528	chrome.exe	113
PID 5528 wrote to memory of 4936	5528	chrome.exe	114
PID 5528 wrote to memory of 5452	5528	chrome.exe	113
PID 5528 wrote to memory of 4936	5528	chrome.exe	114
PID 5528 wrote to memory of 2076	5528	chrome.exe	115
PID 5528 wrote to memory of 2076	5528	chrome.exe	115
PID 5528 wrote to memory of 3272	5528	chrome.exe	117
PID 5528 wrote to memory of 5300	5528	chrome.exe	116
PID 5528 wrote to memory of 3272	5528	chrome.exe	117
PID 5528 wrote to memory of 2972	5528	chrome.exe	118
PID 5528 wrote to memory of 5300	5528	chrome.exe	116
PID 5528 wrote to memory of 2972	5528	chrome.exe	118
PID 5528 wrote to memory of 388	5528	chrome.exe	119
PID 5528 wrote to memory of 124	5528	chrome.exe	120
PID 5528 wrote to memory of 388	5528	chrome.exe	119
PID 5528 wrote to memory of 368	5528	chrome.exe	121
PID 5528 wrote to memory of 124	5528	chrome.exe	120
PID 5528 wrote to memory of 368	5528	chrome.exe	121
PID 5528 wrote to memory of 4660	5528	chrome.exe	122
PID 5528 wrote to memory of 4660	5528	chrome.exe	122
PID 5528 wrote to memory of 5972	5528	chrome.exe	123
PID 5528 wrote to memory of 5972	5528	chrome.exe	123
PID 5528 wrote to memory of 3012	5528	chrome.exe	124
PID 5528 wrote to memory of 3012	5528	chrome.exe	124
PID 5528 wrote to memory of 4976	5528	chrome.exe	125
PID 5528 wrote to memory of 4976	5528	chrome.exe	125
PID 5528 wrote to memory of 5536	5528	chrome.exe	126
PID 5528 wrote to memory of 2084	5528	chrome.exe	127
PID 5528 wrote to memory of 5536	5528	chrome.exe	126
PID 5528 wrote to memory of 720	5528	chrome.exe	128
PID 5528 wrote to memory of 1660	5528	chrome.exe	129
PID 5528 wrote to memory of 4900	5528	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-4R3CXWJ92R.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-4R3CXWJ92R.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3124
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3124
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7fffae6dc728,0x7fffae6dc734,0x7fffae6dc740
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2703003330996472966,9338389502338338962,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11985601290964844868,9925496454190180599,262144 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,15168023340051744525,1207861064856308034,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:13
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,14531617202806324843,5983749475316422344,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,2474089269434537855,18440656706398293353,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,9610610325991644044,18119690339851764777,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,2499701665423266289,5218328310554978091,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,12935493351675581621,5589509602633164627,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,16505671890703789590,4577774750459769050,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,11175778800814754719,2626951667375905325,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,13551443525424268519,6087956459429921162,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,15945233351658890763,8697456228361169553,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5532,i,18418136533058509130,3901490796059875281,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6248,i,4637478534661267111,12170615283141132792,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,16006830735216442894,2883370878085139433,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5504,i,2206730612590884744,15816751021314082911,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6244,i,14584297689849419387,11233933438642060657,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,115589850289136985,17966229676584635453,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6220,i,1556537799768382361,8973558263003642359,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6140,i,8863711440448754584,16407640562978656530,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4684,i,9091282037306788476,3080760278170630326,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:9
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6064,i,4250910524259730317,16180687780768803552,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5412,i,17894712781359082433,11731505360405135046,2097152 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,4992027580666059627,13548553932663865074,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:12
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,6978443469307314280,16120385083027653150,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,14485649625014292327,16977516512591254782,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,17950515267059415295,15956141082014813397,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,2952089092253242442,10663659085961887419,524288 --field-trial-handle=1940,i,6933268060135649584,9833823405664943029,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 7fc528a09551781945ec8698d81f86e74326cffb0f14268fda7a85c5278aaa02
MD5 dc42ebe1150096d9f60dc007d30750e6
SHA1 98ecef8317776e893bca7cd6057aa3eac0979d9d
SHA512 e654da2b84e88dd0763c0a1bbd3300432cddcad5d175c2a5fe69ec8773800b985f4416531752521d79e5c9674748fedec097917a17b237494e94600c384cbf84
SSDEEP 196608:0TQfd9FhbFDdOtkUARXuXawTLimOsYG5KeOp2cJh:0TW9FlFBUAReXaw3rOreuJh
TLSH
T123D69D6AA2B800E8D4BBD178C6565613EBB1B41603709BDF1BA046F61F63BE45F7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.dll
Size 17.5MB
SHA256 88d8f6e932c6a946cb792524eb2ac12185560d940f938de817c703ff46de3302
MD5 6d22e503a625ec9c79e806c4026cf0e4
SHA1 c3b5f973bdcf2bb7183bebf65c83255571bee651
SHA512 1b592725cca584cf15e80294fd21568b7aca14146ca5d847093f81bde8e4414f5a682da0e7abb77774a297bb4dde71e869f78c5cf177c4e4f7cb0c72346b7f0f
SSDEEP 98304:sKz9PvmqzZ7PkKY69oOCKiClB5uAzQwrK/LGGOL12aSuPYGfOJgaKIaOIrrU//an:+G59o7KiC7Djp0KZCPi8m2YVYeG2AKB/
TLSH
T1C807BF0EB4E30AE8C5715070D16FABE3EA26314C4B6C6AF387994161393368E5549FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cf187c8-535a-43d4-86d4-a5121704f3b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4cf187c8-535a-43d4-86d4-a5121704f3b6.tmp
Size 143KB
SHA256 15444a96276558d7af8f84667b384dd58f0c9d9c5f9ec14687d4a48ee73aef24
MD5 213b32a7ab1a14c8c4afc5da0ae1ac36
SHA1 6561ab9bb92a05075452691aca15747d571b63e9
SHA512 e69dcec04cfcd39311dd12266e22d518a16e4484b43dab2d935e58a2977e04fbf2c2c6920c638550c36bb58cc719ce3c011b0cd09361a6c6a0bcf75a5c002624
SSDEEP 3072:CHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzv:CHCsUfw5u7eC94LUX4rY7Q/Cv
TLSH
T1FAE312F19B6F285A3EF88A1B7527330F0F7DD5A2AD481585C0DA391731AD3E2825B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

866f1cf1-7fca-4d18-a8ca-6312e28d39e8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\866f1cf1-7fca-4d18-a8ca-6312e28d39e8.tmp
Size 4KB
SHA256 18b9880ec77a15b8eeca7a9e7f145638083217655bcad16ac061ce16df73cc98
MD5 a6d25fe18a949e6214ff9134c45fb574
SHA1 6db6e246257390692015d855ecaf0222b125b100
SHA512 730878179c1e1b79b5fd9520c76b1c90c90222461b15d404c41d9d6cc943b8bb87a7d5d1717ac9b0b6a6418cb5662009e9b7b02bf1a385bbf3cc108035f80cbc
SSDEEP 96:lC0d+hK2ilc3fBgqho/LyVRDotok5PREDoB6iGyvFrGPFbmWav4a:lC0L2ilYgm0QDUDJycyeGPFbvE
TLSH
T1C5A12A31E5A999BB54F39584B0837A43CF68B1AB5561AF84E9DD2E0C11B71F80343927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c73fca3-d7fc-42a2-a75b-e7ed410cb3cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8c73fca3-d7fc-42a2-a75b-e7ed410cb3cc.tmp
Size 143KB
SHA256 75daafd1cd2b04ed1ee4dec088ead16e8dce1649cf4b36f85bb65bbf2a2ad2fc
MD5 2461772a3062998254678e25db6befdc
SHA1 324bd482b3cb246c7796f2ba17f13bb854f2198f
SHA512 ec2bee2c71c37b0ad13384c62ef6c94fd84d3e759bc6fa6ca2624878c83e6e058ef9426ca71ac3a57327b2c314317d9bbb2bc9ed3d10f3317684ac1910dcf8ab
SSDEEP 3072:HHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzv:HHCsUfw5u7eC94LUX4rY7Q/Cv
TLSH
T147E312F19B6F285A3EF88A1B7527330F0F7DD5A2AC481585C0DA3917319E3E2825B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 9d2727a8b628d32b0b0e2e570f6cae1ff423b4fdbf88c2fe924bc647ba08cace
MD5 3a378e68f79fa41faa181b886f8e86d2
SHA1 28512744172c8b91cd8dcd697f0cfdfbbcfbc9c4
SHA512 55c16681233c1785a58fad8bbf8cec26b60266260fafb5eda5ffc102e4e75bd53054aa3ad9d0360c57030b112f49d09bb5dfd6adfa266ba5d3c119c298a15d17
MD5 SHA1 SHA512

Submit Download

4a85d5c2-02dd-4469-84ea-9e6fb49a66db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a85d5c2-02dd-4469-84ea-9e6fb49a66db.tmp
Size 12KB
SHA256 53fe16256cb1789e7df7344ecb24d85d5a851ace666bdf29c09bb0b854c85be4
MD5 e30a5ba47872f822caef9376e82b666f
SHA1 dc85741cfd90973a47761a3061825a365bb91b57
SHA512 824d44e0770086b7781790c2f67f714ddde41e949f9ce71116f830920042ad3dbb3f00734618caee4433e6a4edb89279a85ea7243591b35e428ceba240609364
SSDEEP 192:uRT9x9Hfv7tOPRpMKF29QHsb+WNn8Ulq+i2jk82FpzskwmEVyIsnAUgE:uRT933SXDkSwflO2g82FVsGAE
TLSH
T14A42C72EED10697B9CEBC215FEA67B63D6F6202221911F84E6FC893C24E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56080b40-9f63-433a-bf21-508eec4f4a6a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56080b40-9f63-433a-bf21-508eec4f4a6a.tmp
Size 12KB
SHA256 18b88a4b9dbc7a07c9fc85519ae8da154b83630b52b3424b7dedcc16f125e93a
MD5 980ddb4dc2674f8909c7138d8d1e4398
SHA1 5edf109dcc03b2981fab0df3c5d5b9665aba1ed5
SHA512 848f7e5e1f9b4978daaa771b4f1089646140050c181e3091f51569f343e5fbb183d0cc8daeb7c451352b8bb2e21c3edbbd354569df99516d1f80d651f5c4b216
SSDEEP 192:uRT9x9Hlv7tAPRp2KF29QHsb+WNn8Ulq+i2Qk82Fpzskw0EVyIsnAUge:uRT93VUX5kSwflO2p82FVsUAe
TLSH
T17542A62EAE10697B9CEBC215EEA67763D6F6202231D11F84E6FC883C14E75DD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e53d770-46f6-42df-a5f3-093a0650b46b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e53d770-46f6-42df-a5f3-093a0650b46b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 88134a2f91a368e896e561ab9ed6bd5603b900c8db7ca874f01e03be962c59d0
MD5 9d166b2f71990e294dc018a26d14cce4
SHA1 028756827f78bab4796d387e0785e659b519214d
SHA512 0a5761aa240502907fd44b1dad4f36fa8618790003f6722a95a3687c539e796b812254a1cb2c3239024db964d52ea93d3dd1fc8f3fa19582710c038751e23023
TLSH
T14F413D41D1C8982EDFA909BA2CE13D603A7CCE5884876F7766C591B9924FFDC2AC0070
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2cd18959-20d7-43c0-b32d-8480b8c1f7a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2cd18959-20d7-43c0-b32d-8480b8c1f7a5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e9d08ea8-5997-4be6-9358-8021023669d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e9d08ea8-5997-4be6-9358-8021023669d0.tmp
Size 5KB
SHA256 ae2d8d47bdb20caf1208b1ca5a8771b5e080a99711a35ef8cbb553aed96a6f24
MD5 bd6414f4c204353e080773d913454b05
SHA1 4edaa25606560393238cbf03490b00c2bec91530
SHA512 5cb5c8d07fdaf488ee6abed30d5a9903adae99cef23b0ae96aee360d6ee82d62a84f983c358f057259423d67f3406e8896e0a534d3ecd6e14cb3111546fa9616
SSDEEP 48:YALlqFqChZaCEMa+a2Maja7XYfoKsPRsz14smfsgosM7CHssurzsk6s5bmswCsvJ:Dq/3REMDDMAIIkyml87kKJPbu51kJb1K
TLSH
T17DB1FFF3C7E9992DD55669F49B14BF1ECE29491C53193C1A88E8EF4B93D2432E20074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 87c40f6a1d42e214d34a55efd704d0440915d94fe1bfd6a9a3d2eb463aef8fab
MD5 36c47006a17819b09ee3c21c9c0da6cf
SHA1 b3ab240954e5fc5b48c1d001bd69a107f4c3e51e
SHA512 cc3acc081ccd3c49c170ffa321c7766aea7a535ea74301413562ac868c632dc912c1af0508785c98a6226a2a187f6f8d8ba80c954c1b5985ac05254a2031277c
SSDEEP 384:+0jCV7KxkXqKf/pUZNCgVLH2Hfgsl3dXODC1+ErU39FHGpgr:+YCV7KxkXqKf/pUZNCgVLH2HfgstZOm4
TLSH
T1AF52F967944D9A3F0FD8D54CD8166F8FADB5014761A80D2852FB6C1803E97DB124B2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab04575731e12fa5cd8332f242105cac1ee17ed8\912a84a2-f8db-4c45-b2fe-a0b23e65792f\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab04575731e12fa5cd8332f242105cac1ee17ed8\index.txt
Size 182B
SHA256 3ae30f1f24d50ec00733facdf8fddf9dcd8ea4a2a1a2ef5d76ba5c5956bf3be6
MD5 3e7bd61a07057dfae68c482491c701af
SHA1 4329c057e6078bcbaac16cce25fa4e92970451d1
SHA512 0f551b090693393dda55eadcd7176e364ea2a3b3094c1ca2b94979abe51ff9b3b578b1aa3712ec0bd9c348dd4d2da56cb556421cf46dffddf64ba235c802c848
TLSH
T1C0C022B3B0C1008A2BF018458E344D38180A3C804890908DE362B82030B0809501DE20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab04575731e12fa5cd8332f242105cac1ee17ed8\index.txt.tmp
Size 270B
SHA256 6eacb5fef092e25402d29da38b863609993cf301a7a4912ad1515cdfc213d2e3
MD5 26a2cee23c4b3f28a6f2fbd44bfbe3a8
SHA1 1fe06f4025f641f3b69236fe35ea0ecd757cb299
SHA512 c6891f226dbe77df3314b285a6ccc42d6d23d0338d50c7d8f1a4801eba89153fcd3e247e244fc81963b649f74fcd0d0cfb0fab22d2ee8cb1bde8bf8d6f16a9f4
TLSH
T16FD02BB3B0D240C67EFA1E454E340D3918153C8060BDE08CF36158257C905499029E2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab04575731e12fa5cd8332f242105cac1ee17ed8\index.txt.tmp
Size 277B
SHA256 ed5f7c59161116a14f5609649f822a3815c60c6d37076c3f76ecfd1e28163df7
MD5 981808cd280fa3a52784200c0affba71
SHA1 a45f588e9e514435a81fab2bd82f0004ce530895
SHA512 26ace505ca14e355bf6dcb7449fd9db948f1d271053cfe355214ebf89f918f3cf01434a49a7b5c7457b0e69b78ede89c2a75484c28813f2d7d254e06d891de3a
TLSH
T14ED02BB3B0D200C6BBFA09464E340D3D18153C8064A9E08CE361782938B0549D139E2A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 9155347a233455089ed8656266762538e847768f48eff8b67454d72a7c23acab
MD5 879c47b078975cb6bf3292153c5ec708
SHA1 2adff803ee4186ddf3484899fb73bb10a0001de7
SHA512 23d38d8c03a1231e6779bc9779d9cc6099a71270ca8115ccc0a210517b9d31fa28a0ee1478415ca90348c1f9401ac87b0a62577d166093c44a2ff6e9b7b2532b
TLSH
T104A0029682D66B21CD5046FC60A616512E514D251A91C3735CD114B9895F1D84E05200
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 06b02950e2372798283d25f70e70588833b16e18f2b2abf1b363149c68aac00e
MD5 f1e20dec566cba7cf89ba0595e3c3c06
SHA1 5fe099865f061c649e1f71599f1c7394c4b9cb9d
SHA512 6d06c93e70acfc21db133d4e61d0fc6eedfcf89b1e27be658f030fcc3f6f7fcc6e6d118358d666d903167e75a24c9ba1f1cca242983943260e118db4e056ad34
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6894746-eef4-4c57-8660-d49cba5c401a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6894746-eef4-4c57-8660-d49cba5c401a.tmp
Size 11KB
SHA256 3c2393503ff08a22d00e8c2cb8c0add303b847cea61b336fa436f4b5145b58ed
MD5 9e46fee36dcc0d5037f23508d59c93e9
SHA1 c83b86e192a25c94ecf1789c0957ae2840af16f6
SHA512 b2146bb32d92822bf05c3e6b09450b5ad5512fa85c1763d6f935c8a6768245c46e8ca7a5f7bf4e20d6226cb5e0d905fb238bf6c77aacb21424e773496c6b41c1
SSDEEP 192:uRT9x9Hlv7IAPRp2H9QHsb+WNn8UdGk82Fpzskw0EVyIsnAUge:uRT93VVXQSwfdP82FVsUAe
TLSH
T12D42B62DEE10697B9CEBC219EAA67753D6F6202231D11F84E6FC883C14EB5DD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4c98e83-fd45-4630-85de-ae0c7d2dd11a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a4c98e83-fd45-4630-85de-ae0c7d2dd11a.tmp
Size 144KB
SHA256 cbf0bc1233436bc3068c113e94c191eaabd05d4a39a61582db4430c96fd4aba0
MD5 2491ee3d89bdec23fd59afe667087113
SHA1 ebd4e0c936ebab6ba615e56c8b19fb68adeba615
SHA512 8983c33acd8bb92c8417cd530703975ea2fe3e0ae175d40a90e5cd8dcfd8b2ef45fd3b8e9022a2f3d5a9e3dd367a3bef5a457a3d97d6b6357f4301559cc775f0
SSDEEP 3072:FHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzv:FHCsUfw5u7eC94LUX4rY7Q/Cv
TLSH
T1ACE312F19F6F285A3FF48E0B7126370E0F6DD5939D0C2989C09A3917219D3D6824B617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc5cc54b-2fb8-4d21-8b56-eaf2a364050e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dc5cc54b-2fb8-4d21-8b56-eaf2a364050e.tmp
Size 143KB
SHA256 cdcd13ec87495f8e0f20362b42cb3c78b9b36552d58b8aaee80a895407550a1f
MD5 07e06c4082e3eee8f0a087c2f92824b7
SHA1 4881f30a78ce015ac08a3751eda222bb0fbd100e
SHA512 319b35cb0691549e8ef3beba449f52b1059ac014426ff3dd529a4fdf2f3f33a2cc517c6eae9649a1cdd38b65dc7cb9142a058c3e9e272b1a9ed768e6451d4c08
SSDEEP 3072:7HCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzv:7HCsUfw5u7eC94LUX4rY7Q/Cv
TLSH
T13FE312F19B6F285A3EF88A1B7527330F0F7DD5A2AC481585C0DA3917319D3E2825B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

813e651b-19c1-4b3a-b126-29d93030fabd.tmp

Path C:\Users\Admin\AppData\Local\Temp\813e651b-19c1-4b3a-b126-29d93030fabd.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5528_1541484565\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download