375c806396c33520a0a2f2f0b8a5cfba4bd837fc0077a34a02684332b082d67e

Analysis

user interaction
yes
max time kernel
1049s
max time network
1049s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Autumn.exe
Size 6.4MB
Sample261029-28mrtatz2q
SHA256 375c806396c33520a0a2f2f0b8a5cfba4bd837fc0077a34a02684332b082d67e
MD5 8340295a39d258952e5906181b5bdc08
SHA1 fddb2386ddc8914e728811e8d0fd03a4e4fdcbdf
SHA512 c820beaed2d3a78397b2fdb90b46bc02600344e665dbb29debe203117dcec3d72ca3268b7646a3ff1a48d26bd407259b475a053f44d8bbbcfd755e8722c4f135
SSDEEP 98304:1ollPm5MWylcDs2Xn+5feCVXTgPBo1N/GD+mCNaoIRsnOQ19/xu0AZNl:1+lLZSa1N/GD+nNXIa9YNZN
TLSH
T17D669C43F26290F8C52AC135D74A6232FA217C4A0B357AEB5BE44B353EA5FD0673DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
25	1856	chrome.exe
52	1856	chrome.exe
120	1856	chrome.exe

Executes dropped EXE 6 IoCs

pid	Process
1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe
5008	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe

Loads dropped DLL 9 IoCs

pid	Process
5008	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Autumn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-XY8P7H6M4Q.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	api.gofile.io
48	api.gofile.io
117	api.gofile.io

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 15 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5008	RobloxPlayerBeta.exe
5008	RobloxPlayerBeta.exe
5008	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
4592	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\models\Thumbnails\AvatarCyclorama.rbxl	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\advClosed-hand.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\ExternalSite\twitter.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\GrenzeGotisch.json	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\BuilderIcons\BuilderIcons\BuilderIcons.json	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DarkThemeLoadingCircle.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\Unmuted80.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-10x10.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\meshes\leftarm.mesh	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\chatBubble_bot_notifyGray_dotDotDot.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\StudioSharedUI\ScrollBarBottom.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\account_over13.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Camera\CameraToastIcon.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\advCursor-openedHand.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DeviceEmulator\sim_rotate.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\PlaybackAppPatchConfig\PlaybackAppPatchConfig.json	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\LegacyArial.json	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\LuckiestGuy.json	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\SurfacesDefault.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Input\IntroMove.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\SpeakerDark\Unmuted20.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\SourceSansPro-Bold.ttf	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\LegacyRbxGui\Aluminium.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\MenuBar\icon_seated.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\Cursors\Gamepad\IBeamCursor.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Players\Unmuted-White.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Radial\Top.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\FlatCursor.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\DPadUp.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\SpeakerNew\Unmuted40.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\starburst_center_classic_dark.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\TopRoundedRect8px.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\DpadDown.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\PlatformContent\pc\fonts\NotoSansCJKjp-Regular.otf	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_purple.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DefaultController\ButtonX.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Emotes\EmotesIcon.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Menu\rectBackground.png	RobloxPlayerInstaller-XY8P7H6M4Q.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller-XY8P7H6M4Q.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller-XY8P7H6M4Q.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-XY8P7H6M4Q.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a21b87bbc2641cf"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{3536B5F1-13DE-44AE-8735-535EF4F581E0}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a21b87bbc2641cf"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7062aec9dbe74b14"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-XY8P7H6M4Q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller-XY8P7H6M4Q.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerBeta.dll:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerBeta.dll:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe
1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe
1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe
1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe
5008	RobloxPlayerBeta.exe
1124	chrome.exe
1124	chrome.exe
3392	chrome.exe
3392	chrome.exe
4592	RobloxPlayerBeta.exe
1788	RobloxPlayerBeta.exe
1648	RobloxPlayerBeta.exe
3784	RobloxPlayerBeta.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4052	msedgewebview2.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4052	436	Autumn.exe	81
PID 4052 wrote to memory of 2212	4052	msedgewebview2.exe	82
PID 4052 wrote to memory of 1636	4052	msedgewebview2.exe	84
PID 4052 wrote to memory of 1636	4052	msedgewebview2.exe	84
PID 4052 wrote to memory of 1636	4052	msedgewebview2.exe	84
PID 4052 wrote to memory of 2432	4052	msedgewebview2.exe	85
PID 4052 wrote to memory of 3196	4052	msedgewebview2.exe	86
PID 4052 wrote to memory of 3196	4052	msedgewebview2.exe	86
PID 4052 wrote to memory of 2160	4052	msedgewebview2.exe	87
PID 4052 wrote to memory of 2160	4052	msedgewebview2.exe	87
PID 4052 wrote to memory of 2160	4052	msedgewebview2.exe	87
PID 1124 wrote to memory of 2772	1124	chrome.exe	92
PID 1124 wrote to memory of 2044	1124	chrome.exe	93
PID 1124 wrote to memory of 2044	1124	chrome.exe	93
PID 1124 wrote to memory of 1856	1124	chrome.exe	94
PID 1124 wrote to memory of 2784	1124	chrome.exe	95
PID 1124 wrote to memory of 2784	1124	chrome.exe	95
PID 1124 wrote to memory of 1524	1124	chrome.exe	96
PID 1124 wrote to memory of 3408	1124	chrome.exe	97
PID 1124 wrote to memory of 1524	1124	chrome.exe	96
PID 1124 wrote to memory of 3408	1124	chrome.exe	97
PID 1124 wrote to memory of 5064	1124	chrome.exe	100
PID 1124 wrote to memory of 5064	1124	chrome.exe	100
PID 1124 wrote to memory of 1924	1124	chrome.exe	101
PID 1124 wrote to memory of 2540	1124	chrome.exe	103
PID 1124 wrote to memory of 2540	1124	chrome.exe	103
PID 1124 wrote to memory of 3972	1124	chrome.exe	104
PID 1124 wrote to memory of 3972	1124	chrome.exe	104
PID 1124 wrote to memory of 772	1124	chrome.exe	105
PID 1124 wrote to memory of 772	1124	chrome.exe	105
PID 1124 wrote to memory of 440	1124	chrome.exe	106
PID 1124 wrote to memory of 440	1124	chrome.exe	106
PID 1124 wrote to memory of 3620	1124	chrome.exe	107
PID 1124 wrote to memory of 2244	1124	chrome.exe	108
PID 1124 wrote to memory of 2072	1124	chrome.exe	109
PID 1124 wrote to memory of 1632	1124	chrome.exe	110
PID 1124 wrote to memory of 2400	1124	chrome.exe	111
PID 1124 wrote to memory of 1524	1124	chrome.exe	112
PID 1524 wrote to memory of 5008	1524	RobloxPlayerInstaller-XY8P7H6M4Q.exe	115
PID 1124 wrote to memory of 3392	1124	chrome.exe	124
PID 1124 wrote to memory of 1536	1124	chrome.exe	132
PID 1124 wrote to memory of 1536	1124	chrome.exe	132
PID 1124 wrote to memory of 1880	1124	chrome.exe	133
PID 1124 wrote to memory of 1880	1124	chrome.exe	133
PID 1124 wrote to memory of 3136	1124	chrome.exe	134
PID 1124 wrote to memory of 4656	1124	chrome.exe	135
PID 1124 wrote to memory of 4656	1124	chrome.exe	135
PID 1124 wrote to memory of 1296	1124	chrome.exe	136
PID 1124 wrote to memory of 1296	1124	chrome.exe	136
PID 1124 wrote to memory of 4360	1124	chrome.exe	137
PID 1124 wrote to memory of 4360	1124	chrome.exe	137
PID 1124 wrote to memory of 4820	1124	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\Autumn.exe
"C:\Users\Admin\AppData\Local\Temp\Autumn.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Autumn.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=436.4236.9460626010584787769
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0xf0,0x7fff5574b078,0x7fff5574b084,0x7fff5574b090
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView" --webview-exe-name=Autumn.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,675272152088478290,3467198738839078461,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:2
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView" --webview-exe-name=Autumn.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1356,i,675272152088478290,3467198738839078461,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView" --webview-exe-name=Autumn.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,675272152088478290,3467198738839078461,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView" --webview-exe-name=Autumn.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,675272152088478290,3467198738839078461,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff55b8c728,0x7fff55b8c734,0x7fff55b8c740
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,8014338197256108245,5338370072876640490,262144 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,13647422157340584906,14837292162496009690,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1673300587944396816,17389059780207274374,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,13309769499688420511,9254379785452960116,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,12858769413008440299,11100892413764247794,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,2014332398749557845,1227803666399480633,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,14678433196314467224,979332767393759066,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5460,i,945473788999688603,13322176127087438083,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4636,i,6055833039050624602,10499340591574943081,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4588,i,12496942345685326617,9480239026737765632,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5936,i,4417266060289419227,5136327598109099388,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,1159838068296575736,11594963437889728165,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,10895270398745153118,7975507957453068686,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,4784103265575611511,1794799685823473380,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,1397207860956865779,18142445771758268593,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3924,i,10785467972453726245,7455199126218347349,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4616 /prefetch:14
  2⤵
  PID:2400
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-XY8P7H6M4Q.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-XY8P7H6M4Q.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -personalizedToken XY8P7H6M4Q --deeplink https://www.roblox.com/download --webBtid 1793315740182001 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1524
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5536,i,454468045421203803,10757349928004772219,262144 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6608 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5264,i,3441225258773145136,5561393535611417301,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6652,i,3097135977231050222,8747202019948479968,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,11859095219185625842,5016108190958027629,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,13813244618289687923,1766219579247947860,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:12
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6944,i,2411626763715697160,981444221870270383,2097152 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,8876371872857626785,794318558959762643,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7244,i,1684148749044092834,15097295292323600958,524288 --field-trial-handle=1968,i,8183332246526513241,6001722685979883617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7248 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:568

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
MD5 18f405651d9446df3579f785ee96034b
SHA1 2dfa42893bef7f8277339dd44a412780db67aa36
SHA512 9d17596e911fcbe3e2870b6477c00c4ef63b9ed5a1b2e682b4c411cdf155283a6cdb150a4729264274cc1778898ee40a7f0428177e0af5e7aa173037e8f25a6b
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IK:jVs1F/YxKDozA3/4VdMrp/dK
TLSH
T160D69D6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1AA046F61F67BE05F3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 16.9MB
SHA256 b5e81e0cf070efa2ee8024bcd180156a5bdaddc56d0d1f4a9bc620b8753761de
MD5 980b49493bad518eef7e0c1ef65b031e
SHA1 ee5d01897c67d557c4552b3731a1c74cbcd1350d
SHA512 453218cdafb5ad9d8c506ebb80e46fbfdb359daf750f1c21383fc037cd43c5dc87732eba294ca17c63f46bcb9d5dc9ff22a60d9dd894e1cf088c1979da3120aa
SSDEEP 196608:blIMWAqLfs3M0aicICjqSiy788hVQcRO8wYXGK:K5L03Hajriy7nhVi8uK
TLSH
T11107C04EF4D616E4C5635070D26F56E3EB21309C4A682FF79A9502203A6378E3A19F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 107KB
SHA256 cf3037ec11a2e1747bea312bd5104d9831c839e8b652ce08bb460d7af54de315
MD5 b657e0b4be487cb14bda7f1c03da4fd4
SHA1 595cc68921322f0433a98169ccb0dd323a406439
SHA512 f5222bd82462ae9c1887c4b007136b2705720a74a4df61b2c33d7181c6abc42ba13c9d2c166c71460f9c9a6212276cdba4b8b07ac0b17fa04c2cc80a6ea3efad
SSDEEP 3072:bZ8+AZtMDGtbcYtrkpDdWCfZFJCdleHo+jO:WtMitbzkpDVC0
TLSH
T1B3B35C5BA3A900FBE136967D85A34A46D772B82507219FFF0360425A2F237D59D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 12KB
SHA256 8a3f84503072b898031cb7fdcc06eaafd3ce3b8e043b89fd2885bb5dcb7571a4
MD5 61a33f052445be3950c7de747e075462
SHA1 2ce2d2be1ca7892ad2f22153a1dba07f122650dc
SHA512 8de88dd8b3d98641e479ff36df089180f72d9d352878372f4d82ed321b3845ede82975bb6bf9f4d028877a76d733f05594b0ee373f973cca9d8cfa74bc29660e
SSDEEP 192:Hc8jwIYr7XqyqF/L/I15z1UsJJ33DYJElD2QAGrkFGH:HXjwxiyqdLA1RaJEF2QAqk0
TLSH
T11F421A8CF7650CFAD527427AC8B38B0432A5B5201B6227CF03A095A82D77BC5A37F5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38688226-7d1c-45d7-91d8-3fe84c9dd7aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\38688226-7d1c-45d7-91d8-3fe84c9dd7aa.tmp
Size 271KB
SHA256 2b2e2fadb7d1224406c328fbcc5de11bc062f7a876f6c82d2013f5923e02b5c1
MD5 28c87b55f7606cdb70454ea7bdbd98fe
SHA1 03fe59fe16de520185f1d22e7136cbcb2466a07c
SHA512 d865fdade7f6cfd65197a6ba0262c47b64f58d5b9535ffb52aedf40e7dfc026bcb28c4d850c32678a49de5d933fd7b7d135756fc74c02a0665971c3a79c6632f
SSDEEP 6144:Ng3fYHZV9EONkgDLrKQ6087qtBzpiBkzAMQjmvaFezXEmLOMzexYj:SwHr9EONBPDxztBzp8Gn2FezpOxx6
TLSH
T167442334A87F9CBE9368591DE08DBA0A3D905AF788DD9A9C600277CED143BF40B87D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46de1dd3-b5f8-4605-b076-47b644cae867.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\46de1dd3-b5f8-4605-b076-47b644cae867.tmp
Size 271KB
SHA256 86fd4ebb0175481b7d50085ae25fedb0680077cc0f4df6ac1a10a016a50f03e3
MD5 614bb025e3c763c09625c965434638cf
SHA1 b8e1121e3b7f75984dfdae68ba29567c64bc55a3
SHA512 ac4c6c26520b1b5e77dba9f77f9c8d3dfe78fa650a927a08fd4226c7139cb637b5a2af905c6c9795ebf6638c91b765d1bf35467338d680295cdcfae00dc4eca0
SSDEEP 6144:ag3fYHZV9EONkgDLrKQ6087qtBzpiBkzAMQjmvaFezXEmLOMzexYj:vwHr9EONBPDxztBzp8Gn2FezpOxx6
TLSH
T15C442374A87F9CBE9368591DE08DBA0A3D905AF748DD9A9C600277CED142BF40B87D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84f937e1-5d24-4b52-a558-0b54fa469a78.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\84f937e1-5d24-4b52-a558-0b54fa469a78.tmp
Size 130KB
SHA256 d327e2adf61e53f8772ecc0ae806ef6e22c2a0cda198a8b1bfa4b6faab6e99e9
MD5 15b09aa5e4a4b2177932f463c13a255e
SHA1 e00dbcbae947e6a8ad745cb6dd9f423a68b206db
SHA512 5840d5f4c1eddd752d1459e518845a24eaaa696d8c3d06ed952959d1d2a67c8e84852b0cb6848744d926cb42a9d98d5fa731aa98014d1480f3bbfff2c438cd41
SSDEEP 3072:rPKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:WzAMQjmvaFezXEmLOMzexY
TLSH
T1D8D312B4657EDCAEE334E51EF9D99B4A3DE125E724D453EE3880A6CD88B37E801C0590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dc68b31-0bc9-4d1d-8ad4-0d6015fc148b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0dc68b31-0bc9-4d1d-8ad4-0d6015fc148b.tmp
Size 13KB
SHA256 6ff935975e4c54e9b8ca3ab735e2a7fb59f7130d233082bc52e28d3e1f0ae3e3
MD5 f95e45f1f372e8e7d73a3a7f2bcda4cf
SHA1 81e68b103183e7d7666a5b485c38b9fab5a66944
SHA512 55c8fe51ce97dc755325c039655d29b45f22b637ab8382aa47c8c02ee0300d89101c32f8dc083c8591cf3488f615e4165213030077feb94d9f81852ab56fee51
SSDEEP 192:5Rip7V9v74pAPRp2Blc693Hsb+WNm6lD3kaD7R2WRNl2ouaVQVyIsnAUgraJ:5Ripp9UUX0xwf9R2ONl29aae
TLSH
T11E52A62ABD10797BADDBC25AF922B757D2F5202120942E84E6FCCD2C15E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ba0c846-cb15-45c7-aee6-f8f126a5881d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ba0c846-cb15-45c7-aee6-f8f126a5881d.tmp
Size 13KB
SHA256 4293a59890851f6e157ab8ae5d1bcfa32e9c8e86e8820ca8d97edd39c0eec14e
MD5 b095f945ef2cce789e3b6347a243c8c7
SHA1 4a4e9f541ff9bc315232762b75c0554dd9ab5597
SHA512 e652c40c29006b441d70aa4fe7cbf2019aef78d8b1d5ca8939ccdca76e9a3ae2e108e46ac265424f91fc8f6b7b0f472a69308ef864ae9988ab754c2ba60e17ec
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3luHGCUbvTiY:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsw
TLSH
T1E0520967688C9A3F4FC8D94CDC26BF4FACF601566168482453FA9C1903E5BDB014A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45f3e41b-58bb-4344-9151-c72fdbef7419.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45f3e41b-58bb-4344-9151-c72fdbef7419.tmp
Size 414B
SHA256 8bfe8fae76e80de643b072c39419ddf4432390bca9533b8b5a6dc9bc304c06f4
MD5 8828dbaca360303d903ae326a3b771b1
SHA1 0d9695f54b68ea4d91bd8d41e6a58484ae84c29d
SHA512 93a0850d0bad5dc167d992a8e42520e8a277beed368d1de3003d3d05f7ffe10199270f21cb85d8f576e88745b288cdcd4aed61753166c76e488453e92ac4512f
TLSH
T17AE02B9AD9289C370DFC4B6960554786F74513472680494F3A3CC51D8F702775696C6C
MD5 SHA1 SHA512 TLSH

Submit Download

60dc5680-9d1b-4592-b83a-7786072008bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60dc5680-9d1b-4592-b83a-7786072008bc.tmp
Size 12KB
SHA256 f691946fe5bd60993646980a09d41f27b58ad9625605e35f2d568df9d4ecc4df
MD5 7f9cb7de88d4b7011efefeaa71fd7ca1
SHA1 891edb1f9800e280f39e835fc97bf6457f86b076
SHA512 ea91b7907fcdac07934798edccac4c49785ca3350c1127e074a44c65bc9da49450073a9b83ecd3a27c973dd5a686d82243159c0a802dd343456b48e9d7660c74
SSDEEP 192:5Rip7Vlv74pAPRp2k693Hsb+WNnlDt7R2RRNl2ouaVCVyIsnAUgtaJ:5RippVUUXixwVD2TNl29aE8
TLSH
T13142B62EBD10B93BACDBC26AF966B757D6F5102120942E84E6FCCC2C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

701fa3ea-c70b-4e78-94eb-801a01a82bf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\701fa3ea-c70b-4e78-94eb-801a01a82bf1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

762495e5-3cb9-44d2-a239-211d524b0236.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\762495e5-3cb9-44d2-a239-211d524b0236.tmp
Size 14KB
SHA256 b8512b679a5770baf559c2a26922bb0a4d3a5e855ba36d11e327fa683c4a4ef0
MD5 00cd65a1c640e6ae6eb2a5c166d2a1a8
SHA1 6aa7f1d9a06874f2dbd90a08508673133c236607
SHA512 b07194cc01c46d460fb43c54abddc0770994373a8b256dbe1cd08fe5d434cfe1aab19f708021aad9166948e379cbf9070e12c8b35c2b22d8766771cd4d5102c3
SSDEEP 192:5Ripqwnv75pBPRpdLzlc9j93Hsb+WNm6lD3wOAM7R2eRNl2ouaVEVyIsnAUgraxL:5RipDvFLXGxwfFAW22Nl29aG6L
TLSH
T13052C72ABD10793BACDBC25AF912B757E2F4202164D42E84E6FCCD2C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

772b891e-a810-420a-94d5-114595060395.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\772b891e-a810-420a-94d5-114595060395.tmp
Size 13KB
SHA256 ffe58a3184ed2464e1abc18924fe4de07bc8cd7955f40eeacc1d0ef8eef52ae6
MD5 e4da7d32a7f146063da0562525a55a83
SHA1 6b3fc6c1e25f5d3ade1ce7f50cd76e0546bd9e91
SHA512 050d4611a83af205348b6e1f48f25118d831cdfb4efdee670ab2fa29d68a5107623de15b2b723fc20823d938fa110482e88d1d6b7713f22ce46c89690379892b
SSDEEP 192:5RipqV9v74pBPRpdBlc693Hsb+WNm6lD3kaD7R2qRNl2ouaVEVyIsnAUgraJ:5Ripa9ULXFxwf9R2aNl29aGe
TLSH
T19552B62ABD10797BACDBC65AF926B767D3F4202120942E84E6FCCD2C15E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

951b17df-eb10-41ce-8700-4b71bc14c18e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\951b17df-eb10-41ce-8700-4b71bc14c18e.tmp
Size 13KB
SHA256 d3f0e222e6de334e104f42b3893d681f399c311b2b5bd3da4e0b2c3626184b62
MD5 962509a04b1a01b7655615d481320c94
SHA1 13c512d200d1f5467a5badc4ba674caaef50f181
SHA512 591e42805be785b05104295225e298ca6eff630eb158e892628d82b1b09a7132ba8cf1f88421a49fa1b44bbe87cb9b9199d6cfd10bd8baf3832af5c1c58e38d6
SSDEEP 192:5RipqV9v75pBPRpdLzlc9j93Hsb+WNm6lD3wOAM7R2eRNl2ouaVEVyIsnAUgraJ:5Ripa9FLXGxwfFAW22Nl29aGe
TLSH
T17252C72ABD10797BACDBC66AF912B757E3F4202124942E84E6FCCD2C15E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a96200e-19a8-4e54-8e30-982ed3e21df0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9a96200e-19a8-4e54-8e30-982ed3e21df0.tmp
Size 14KB
SHA256 8d158506392c794129d7a1ed3cb60b783e2e0d81e1b086e36111ff002a2ab3f8
MD5 b10540642930979f1cf291084e9b88aa
SHA1 9c8e13950246597f8e364cba3acb90f215ac13dc
SHA512 32e3d637d9200faa4a6e256bf85dd988ac6f133c586d5befd98bb4b272b13c6447d41cd46d259b821c1e5350f05bd254f363b0ab093d45f723da488085e41ede
SSDEEP 192:5RipqVjv75pBPRpdLzlc9j93Hsb+WNm6lD3wOAM7R2eRNl2ouaVEVyIsnAUgraxL:5RipabFLXGxwfFAW22Nl29aG6L
TLSH
T17E52C72ABD10797BACDBC25AF912B757E2F4202164D42E84E6FCCD2C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cf3478a-dbca-4466-98ff-ed0a89d50258.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9cf3478a-dbca-4466-98ff-ed0a89d50258.tmp
Size 13KB
SHA256 e09975a86756b3595f22085bba40a03e8be229f34c7cd31c077b6abf2fe5dd68
MD5 b9b91f5c79f2db2493a0c854cd157e5a
SHA1 28335fae384cc979637ccd36527b3e3cbbf7afc6
SHA512 7c814d44c0704472b0b7287d50caafee2b937232cee48bfa72090f0cc9f30f5ada8ba28c9cbc4c2c441c881fda890398269d32f84d3b2b7ecbaf02a385db6739
SSDEEP 192:5Rip7V9v74pBPRpdBlc693Hsb+WNm6lD3kaD7R2qRNl2ouaVEVyIsnAUgraJ:5Ripp9ULXFxwf9R2aNl29aGe
TLSH
T13A52B62ABD10797BACDBC65AF922B767D2F4202120942E84E7FCCD2C15E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 20KB
SHA256 cfde44d5f86bfd62622253fc8e1090162756b25ccd15fc3d881e1cbae5e374f1
MD5 22cc079b4472dc5fad5e657f343f3d39
SHA1 18a0aa683b6500ff83f84201c6de670a95c8d5bc
SHA512 88a8aaeb830c0bb35eec256c61879ca64ebb7aaa0f844b3c49b3cc2d7ab494bb22a7dc596d33a475ff64d96fa9b94fa9773ee0de3b306153e22964a88c739cb3
SSDEEP 384:j+rGoAr2UOxWfQwypaVjGH7HtDza3Yp1yls/fVcE65REWD1dRiwjH:j+rK6UxypgSbHtDG3NlNfnECfRnH
TLSH
T1F292D104F7560B8955B590AA0F15F4D536DE6C378B0678F9F7D8AE490378432AF85C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 26KB
SHA256 8bae24100d94d7f155a18c49dd4ec762e114c571d020da056e6fd01d0b8c866e
MD5 aff568d24ea6a84160ffa14a0783bd70
SHA1 3933c191ff8f0608d72e5221d04b9e4c351f56f6
SHA512 50fcb97555cf533fd91550d155bd853d8652599965bbb3ec1113086995902c5eb94332174913a30e044f5a08fe85be7330d3e0a8bc50463f5b71ee22caf60561
SSDEEP 768:bjcUIucdIuTV//1Po7n0w8qxoR9vrJqY2zSmzB64yU:/dcrTV/un0ASjVqLzQ4r
TLSH
T1CBC2E1812FF5AD82CDE99BA95437FB87FCC47548653DD6F88E80415EB9A03833704A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 17KB
SHA256 e3353a5c76505dab79177ee2d2778523edaf012b508f3fca894a9d965206dbe0
MD5 55d9b9a42b170e2bac53a66f5d2452a2
SHA1 8365b4cc389f367a317b80340a4230a9727032c5
SHA512 60c0f474de4fea0546bf334bce0b5b8e9cd82aade1a0d93aa54a5d4cba8b61749c76e356fea69fa4251739d906053202743f3435a52e9278f33127dc2af66357
SSDEEP 384:P+Ky4SMlUswGoM1t6Vb3BtyBU7Vmsll2HLPzbUt5uHB61+hW1:P+1MaJGoM1tEbdJm7zbUtwhQ1
TLSH
T1E872D1F96A0FC4B05EA21481BF855DAC2C219B1C132A08C2A467A0F9595458FEFFF5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 d5b60d14786f59e24d065f7c1c0d6262c83e6787de2ed2c1aaa4647b9d1603f3
MD5 3a22c0bcdd4c7a789cda7e2d77554382
SHA1 cb40f1c1603722b462bc612a5531de5399e19dfd
SHA512 8986dedded8f128bb61f77a663f3046d28d99496f8afeeb58b0a78752bd68f6fdb79df555fee2c4c36b886baf029c348bbdc7a3aeeacd46ada774744ea86f464
SSDEEP 96:VuBH9DSCEes/87IHuHlooKicrkng6gFsRIXC:kHACEe487D1SH72RIy
TLSH
T1DED1C6ADA9901BEBCB70F47190D5B428F5F50D40492BCE579FA676742B33BD3006E098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 fa6bb4d75b388a288f73597c4a9cff1e5d06871eb3835b0efa57d2265808dfee
MD5 5cdd99912ade44226cc2879742a85619
SHA1 7929be010b5b62b92de659b4e66f414fc60c2526
SHA512 ee8180c33e7a82b5a840460e204b86517d5ffe97e2f3ce6b60ebc066ada44fa1af54484381bd155cf6d229887e53c5d9ab5b05cfcd692fc79dd66db2bc5e92d0
TLSH
T170414EAEADA4633CCB7021B090E4796C76F61D800C7BDE6A9CD971782733BC3050D490
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 c77be981d7a46741576af50bfc7f2151d54aa7ce6446e0d8e7a3d05a555260ea
MD5 933e39081803caf858cbbc9e3c6c1f57
SHA1 5fd652930f8d618baa041e99fdb7524913748d36
SHA512 cb2bca59c3bbd55834cb9b89585f9bdaa06d57e76c3fc7e2355eef9a2b2437b6796ad6f28ca1eb497e4bcbd231b076cd519f73d92f3a400c92640275e095f535
SSDEEP 96:wDJH9DSiQga52PF7IW8KkHlooBxicknMcFHZ6Y:KHQiQ55yF781lIpZ6Y
TLSH
T1BAD12CADAD810BFBCB70F83090E5741CF6F50D40482B8E5B5BA6B9742B33BD3006A099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

3a169e9f-969e-4fa0-a310-58dc02b58853.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3a169e9f-969e-4fa0-a310-58dc02b58853.tmp
Size 3KB
SHA256 46facd946ef83e9be065ed36a2b3d043e2914287c50066189f5fe1c37ae74001
MD5 15e0493df5a2d2aba951a382efbc1bfa
SHA1 ef6aaa1af66c52214a2faf6362f59bd9ee5c3bc1
SHA512 b3c8c490ea5aa6f777981a2168351631d26497b09275c6c276491cc8b50ef75323a9018929d267e431815fc1f915edbfecc34aac383d9725b1a066b6e351abc1
TLSH
T1A081A9F793E8856D892252F49B156E1FCE6E0924031C3C66C9D4AE1B93F3872E20078F
MD5 SHA1 SHA512 TLSH

Submit Download

4152ca60-9277-43f3-ab3c-e563e715780b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4152ca60-9277-43f3-ab3c-e563e715780b.tmp
Size 3KB
SHA256 33c82f855080e0b4b92de69ff7a8238e1476b6ad16a30db1d68d4bd533cc1a9e
MD5 aa83170bd5d7c1c0174e1e9e3c316fe0
SHA1 bfad63e804a068b0a233321b8e13b6f8cf9656a7
SHA512 3f9d9ff2c69c5feb704ac1ccc413b7daa776fc7583b2e3a5169b0e7082d891e929b1a656c093cf67657553bd84e859d3b4676051edb883aa2c312ad0b268fc09
TLSH
T17B617DA7DA7EA46B706B8AFB1E04780A7CFAB837019174F4DA57826D70C59F31706063
MD5 SHA1 SHA512 TLSH

Submit Download

9d369296-19fb-4684-982b-6164649549af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9d369296-19fb-4684-982b-6164649549af.tmp
Size 5KB
SHA256 839cea7f5c50d6cf1b814f8850ec1c903581994c318efa4331a6d870fceac5ff
MD5 5d8ce5675bcfa3e2f06aa1c80393e1e6
SHA1 0e1fc78aad237180719db273cea113f288b8b84d
SHA512 dfb5e0e492cfad06231c7343a3b9d754c71f4597d9005f90eeb2afa4edd1a6293de1cbb7ddd2f1272ded2f763d3707c520e6e73436fd4070a4fe0085b871026f
SSDEEP 96:D0uV+EUyL1+8aa8zEd7MM0hHHsjhnbH3vcflRRx3Vb+yPKK:D0uV+EUyL1+8aa8zEd7MlhHHsjhnbH3Q
TLSH
T11AC1DCF793B4867DC91152F09B15AE1FCE690A25036C38A689D0BE1793F3472E28079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8b064b8-3c54-42e9-96e8-5bb1b65ad8a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a8b064b8-3c54-42e9-96e8-5bb1b65ad8a1.tmp
Size 3KB
SHA256 a2cabef4de827506d1e91e5e9102767171dd25b6fe963efff2955ecc85a21884
MD5 fc01b516af892e4f98907b465a01dac1
SHA1 8f9052f61347ad1a5bc5c26bf1d7926c0addba5f
SHA512 7c01a98ab130e7f199ada83d26c1b486adcea6bde2aab397cf68f96d3938504c925a11063c745ea3e26b410b1682282b26fd2bee2f7ecbff7b212d2ba2a522d8
TLSH
T1F47198F793E8856D892196F49A116E1FCE6A0A24031C7C66C9D4AE1B53F3972E20079F
MD5 SHA1 SHA512 TLSH

Submit Download

abd70226-8515-4de9-8817-916b49a58231.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\abd70226-8515-4de9-8817-916b49a58231.tmp
Size 5KB
SHA256 b5962d9aa1ebe5a1804d685cf6a2ba3d222a02f51a9ce52003f29bb9b3178bb5
MD5 36098a6aa307963d2619f8fd6468694f
SHA1 754a172189f035121fbd2a51d5a1f251c10c8334
SHA512 41149c6a0c435c5c655821a254ae2894b3e81786778c7942767579f1ee8dc4148a7ac6310870f08ddec5ea013281fd983f11626a5736babecdb21fc4a6a510ed
SSDEEP 96:D0uV+wEUyL1Waa8zEd7MM0hHHsjhnbH3vcfl15Rx3Vb+yPV:D0uV+wEUyL1Waa8zEd7MlhHHsjhnbH3i
TLSH
T16BC1BCF793B4867DC91152F09B15AE1FCE690A25036C38A689D0BE1793F3572E28079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c031c472-5cad-4f52-84ad-ea68c8ef47e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c031c472-5cad-4f52-84ad-ea68c8ef47e4.tmp
Size 6KB
SHA256 17f68d2924e0231cc7fe8c7ea211533013421349d244b95b98986292f77af7a7
MD5 40636dbda3bec1dab2dc3d65eef07581
SHA1 75b507cd97191fae77101fc7b0ab8fda8f8c39a6
SHA512 f40b31eb1e827f04c08a16783db3d660893d18a041d9927f4b59e65ea134364bae587824c6f1e4e792999b48d9c54235d727fd938b225ce5afde40626d5c5a91
SSDEEP 192:D0uV+wb/Eaa8zEd7MlhHHx8jhvbPSQcROrvcfqvfK:D0uQwb/Eaa8zEd7MlhHR8pbPSQcwrvcv
TLSH
T175C1ADF7D3E4867DC91152F09B156E1FCE690A25032C3CA685D4BE1B93F2972E28079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e641ffd2-91e8-4af6-9a0f-80b1651a7ae6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e641ffd2-91e8-4af6-9a0f-80b1651a7ae6.tmp
Size 6KB
SHA256 7345bef286c7c00029b93d31bdf9e96cb4e662ad50cebbe91f003dffedbeda5b
MD5 0bd33f6479fb6c09e6161758a66a5620
SHA1 1447b459941789b3dfe4ca25867bc1e8f6253a4f
SHA512 794c5e3504e9273cd6941ade55326382aab15f024f7af043149fb570b7e63131fa56e6349385f8d89f274ec2aebf49c9104f58fc31d48fc668ca34826f5e75aa
SSDEEP 192:DU/U+Ib/Eaa8zGQ7MlhBHx8jhvbPSQcROrvcfrcvM:DU/dIb/Eaa8zGQ7MlhBR8pbPSQcwrvcn
TLSH
T1DFD1CFF7C3E8866DC91152F09B156E1FCE6A0A25032C3DA685D4BE0B93F2871E28065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9113544-6f79-4076-adf6-71e7cf2e487e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b9113544-6f79-4076-adf6-71e7cf2e487e.tmp
Size 14KB
SHA256 57d5b014850d8e0653632e4dd12836c78919da391ce18efe6a4c9e8a6456eb2f
MD5 bc0247adc0f1c2871aaeb317990652f9
SHA1 15e150011bc0a13047e7b4afbf2eb67f1afd162b
SHA512 ae70eb2605b347f21f084079f5365261b6f91d0d1081d2223878e272641ea2e681a6c73c3d236903815337b9e90db911d4ecd60be09b3ca5b247a8245530e4dc
SSDEEP 192:5RiYqwnv75pBPRpdLzlR9j93Hsb+WNm6lD3Qn/h7R2ORNl2ouaVEVyIsnAUgraxL:5RiYDvFLXTxwf8X2GNl29aG6L
TLSH
T1C752C62ABD10793BACDBC65AF912B757E2F4202164D42E84E6FCCD2C15E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1b06093-2397-4920-8267-2bbf6acc36d1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e1b06093-2397-4920-8267-2bbf6acc36d1.tmp
Size 12KB
SHA256 c106efa72c3bfa07ac20ee26c36df93d3e8ad48c2fee080df4272259af523846
MD5 7abc57506be6395a640b5b1762614495
SHA1 f345cdafd60884ac73a1a19ca1ac93c513962806
SHA512 26d8b57cb8365425e95a8ca6ad4dbbf987f3df6ee7a67f6b586af277c741afa1523c3054f729628a922437b198b9b81d7ddb617d0025214905ff7e213a045ac3
SSDEEP 192:5RiN7plv74pAPRp2k693Hsb+WNnlDt7R2RRNl2ouaVCVyIsnAUgtaJ:5RiNFVUUXixwVD2TNl29aE8
TLSH
T1FF42B62EBE10B53BADDBC26AF962B757D6F5102120942E84E6FCCC2C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 270KB
SHA256 dc5921c72bd75235a80c5521fed8d5d1044cf852534f57733589044c8cbf2dce
MD5 a6d82307e3708c00e0461cc197f058c1
SHA1 03eda49012ca611813098f472828d6dfd707f76c
SHA512 e6d98fb7bd3ba4202f91df043778b5c6bd3bc018c724c848896f07c2586e9ca36e7b05b6f449c9af6aa43fc782141020ea62a70aa0d249b57608355e59a5d479
SSDEEP 6144:aM3fYHZV9EONkgDLrKQ6087qtBzpiBkzAMQjmvaFezXEmLOMzexYj:aQwHr9EONBPDxztBzp8Gn2FezpOxx6
TLSH
T1D7442334A57F9CBEE368551AE09DAB0A3A9159F348EE4B9C6003B7CF9142BF40787D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fde86630-5fd1-4606-a8f4-5760b242bffb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fde86630-5fd1-4606-a8f4-5760b242bffb.tmp
Size 270KB
SHA256 94bcc54d5e46951af743104dde0b2fd3f040476b8fcc605d56cafae9e7d12614
MD5 2b59d6201a6caaa90cdcfae5baac7cf3
SHA1 b693751fed792d79da1d4c5595c3d241ba87237e
SHA512 6fedbbe3a1774ce984eb356467d51af9b991b44544d5926130f0cceedd0894fe95f36de472bec3d615b9868e5d959eb523effa2c03f26a991e10755b7e83994e
SSDEEP 6144:LM3fYHZV9EONkgDLrKQ6087qtBzpiBkzAMQjmvaFezXEmLOMzexYj:LQwHr9EONBPDxztBzp8Gn2FezpOxx6
TLSH
T18D442334A57F9CBEE368551AE09DAB0A3A9059F348EE4B9C2003B7CF9142BF40787D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RBX0DFDA3A5943D40E89178CE36A2B1837E

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX0DFDA3A5943D40E89178CE36A2B1837E
Size 64B
SHA256 4ecfec821f83ad5b28aacb143cd4044df54d1b785a7078e3e9965771e88e2776
MD5 e307ca69d42b07cd2b5d63ed7a77b5c3
SHA1 2175005a7189699b534fdce5e9718adf5feb2c49
SHA512 97315642241c2eafc6e1aba281bf39f525775d58aa68f4806ebbf71a86c871520f37ec63d6bd48383526162bbe8cc768fa688bb6f6bac9e94e49875790b33a4d
TLSH
T103A0028A92964813D08928B6E1867B207EF89620D659745589AADAA2C400468C53D943
MD5 SHA1 SHA512 TLSH

Submit Download

0dc4884d-3ff6-42b1-8ab8-e6cde0e73d94.tmp

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\0dc4884d-3ff6-42b1-8ab8-e6cde0e73d94.tmp
Size 3KB
SHA256 3a8881ea818545dd752f5e7da1a8f42f93be724f0af88c14c3d9adf03212e03f
MD5 8d23b115b2629d6d43dd05ffbf00ed75
SHA1 4898afa7fe0ee4bfaf44b49fd1e2ac7a58454582
SHA512 99124d5ae6039b499f8a465aca21fbda930c510fb361d875e1331e7155532c93f049d7f2b95ed9b360495af6ec5f46bb216a150c49e26dc67f84cf4a933498ae
TLSH
T1FD71523668A4A93B4EE2DA44F8872F07F7659127D6952F98D9ED1F0C01DB3D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

144d8f9a-34de-4912-b7f8-a7416f7bd1d8.tmp

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\144d8f9a-34de-4912-b7f8-a7416f7bd1d8.tmp
Size 1KB
SHA256 9c9a24cd22f03c684429e0bd8bb3cac5db4ff0247476353257286946ce415280
MD5 efcd0062acd49a50fefa78a8b1b47b9a
SHA1 74db32acfb86e78f004c3557fa47e28b59a0c4f2
SHA512 e45b7f8ad841b0c4e25c62899505904e72672b4c6bd24139ba00c1a3eaa94242c05a9ba627b0df3a81d4114a89a5f94d6acdc273eaeec653e9cc814dbdc080e5
TLSH
T12331657294D43B776D929585F1477E83AF20A06B82144F8495ED1B1C01EB2CDE26BC37
MD5 SHA1 SHA512 TLSH

Submit Download

50ce1897-53a1-4929-90a1-a74147eec064.tmp

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\50ce1897-53a1-4929-90a1-a74147eec064.tmp
Size 2KB
SHA256 650bd465401152e1aee92729e9d04bcc9b34ae9a3861c3ba0f7d1c5a025e85b2
MD5 747b6ceefa48810fe6d8b4ebc7c7f2a3
SHA1 98e88433ad7b924dccec25d3fc3c83fb51efb63c
SHA512 5ac374459f29dd91e141a541a3f19f2cc1427d71aa30af18761786e6ff8372201b720679e8ec9ca537608ee1e7aee5f3c571c41176ee9c388fa8cd5e14a44efe
TLSH
T1A051A53368447A778AE3CA84F84B3F13DA35A16A96511F9099ED1F0C00EB29D7342C27
MD5 SHA1 SHA512 TLSH

Submit Download

562812b1-48a7-4b2a-a156-877c924e06d3.tmp

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\562812b1-48a7-4b2a-a156-877c924e06d3.tmp
Size 4KB
SHA256 fc0865273ac508b3fdeb35e568e0a72091695ae0df68c4d958a2719e9bce91f5
MD5 e3a4eedbf469bf264254b9cdd73992bd
SHA1 70925b9dcd5f23b0603e20f02eeb122d4a6a6816
SHA512 359791ef06488f9707df6ec31eb05403067a0ed6e8ee83080db032ff77b836b4e4dd81d846048f55101fdf6a0f029d327ad09d8300c800ca5271cd2b9494433a
SSDEEP 96:zuPek3NkCESfWkT8i5K8Frh/cInURoDotoN5uuKDzRBKZcc6jgZNuTOl8Da:zWek3NbqkT8IRooDUavsDKZJmK
TLSH
T1AD91722268A4A9374DF2DA85F9873F03E6A5A06795946F98D9EC0F0D01DB2D92342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3a5ee5e0b16607d0d40fb669bd80f06f6080aa722824164bb3d33f01d4db56b
MD5 5dca3c1c99bf96df49797100fd2d19c1
SHA1 86cb45c43e978c150131f28361fb1a83e1af67fe
SHA512 fc80d0591e1a3d43a2be9230671c0f9a5c7ea46f7c4febbd77ff4f07f2145ddf9e75699d67fb69f5b984cde4c5d6f0daedeacdaf59b299730eb06e733476f4c9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b3f46b30bd871da3c7f05aa5d1425ee2e3e27a56c7fc841b33f8e7ce6c566954
MD5 3a91d15784607992ff21778559bf7256
SHA1 4abe98c7dfe6278af4e944cb1531d79abc761b82
SHA512 d82c9ca93e9ad67f6067eab24c9417f3cea6c21e6cb2d2ed17bb1afdb4d624002f9f4aae00fda42342472db658f603b7d87998c65753a8d02d535c1a940cb724
TLSH
T119D0121276011938C82030331012F5490409D10F804540049828C59D5B240640D03882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 240B
SHA256 439567c7ce7d70d39318b47fb9850234e4f4e5af61a3d09a2663c28b0d8bd684
MD5 d52d0147a930ae8e5048ba3ba0bfeca7
SHA1 34a59d0ec3d27a5cdb39ac2b08d104fea70d0aa7
SHA512 4f43c64b357fa49af8c551a36972a1fc794ba30b850d9bf5a253f8f2ac6aa7612622498e0d5c276e5d1702ba95df32abadda7a91c7a0253350f8f50b82d37303
TLSH
T1FCD08CEDC0050740C33A827A22E0416CF33C0D8C764BAC38C65100B898AC360310B25D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2d5018078996bb32278348a366069380ed9cfd7a100d3a12efcb1b5df928716b
MD5 0eace956ba3752322d4602c18c6cead7
SHA1 bbab5caa211226d7d946a6d16e47803bca4cbd95
SHA512 e0f23d9b314fed03dfc1ade5286bb3d072fdf957a78761be7109d1b758deef991a6d6653514d25b2f38fd8b5358e1a07a28c1bd296450e4cb2db4876dc69df34
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 c98eb9117748693a8dced300b449d97ff7b6ce7a1efc900ab1ed957c24bc3514
MD5 57fe6d30af3388471a33ea8976950412
SHA1 070299259627fa8616ce75331ab8c706865f2fa6
SHA512 d013a22ed785d75234292a8f19c607fd843a66edaede3381e3e2f3d6d4d2f1a016058e67e58d4533fcf06dbf8ae5c06c4b47c7c10719d29a37cb0b072a29a7e6
SSDEEP 3:LstlNllkll/lE5:LsX3lEtE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.opium.autumn\EBWebView\Local State
Size 1KB
SHA256 d296b1d87a50b61a1d15cc5e056585b81ea2451750ae92d5a99c082bdc86cacf
MD5 3bb7cbf1050e7cd6aa0b9652319f0151
SHA1 91032da69bb68a879b7ad58d996d0902f52d469d
SHA512 87f54834d413c4e160917970b7cf2df9489c5f7e5a5e591d3356f89f7e95af77d6ccd0c1bbeadec6504a076157ff2ba2d92fed0f44b9a213e8b7f70651a20f0c
TLSH
T17421407290D43A7769929984F143AE87AF20A06B82144F48D5DE170800EB2CD93A7C33
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerBeta.dll:Zone.Identifier
Size 58B
SHA256 fe25e31061b432c3a3fdd8f797c6dadad253e83dfb305ee997a7302cd70b618d
MD5 f328e184c322cba91dc3c014fe2ef3e9
SHA1 2aab1f0a70009051dcc87350e0f3b079da02fbb2
SHA512 e59501b550ea64155d134ae832812004ec298a44519eb03183542599174b7691be3225f6fa5064d45ed7ec81f0a93721eb8f401d7e2a49c4b91a70ded006c97e
TLSH
T18DA00297484485550114369415BD95ACB04F65548DB90A48E84040DBA88587889E5966
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerBeta.dll:Zone.Identifier
Size 164B
SHA256 7779c1be633ea6bd2b7d704571b69e3b52c8ac4a06e6fe61eb934a1f3b2377d0
MD5 6db29a897bc5be3c8681a52795eb8133
SHA1 a482f66bd85c5e5a715792a38be0f4649704ca63
SHA512 7775fb02a31b7d0fe58654100d5314c91b9bed31ed881f65dba42ebb7d18b0b61f97cf5768c51426d5307f294d5533669128ebc4a87e431b57a54a230d79c6d8
TLSH
T179C080F79D44447516D432C011544CFC754F56804DDEC584E910644F640DC3847FC476
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller-XY8P7H6M4Q.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-XY8P7H6M4Q.exe:Zone.Identifier
Size 168B
SHA256 00bee33968db13ea40262e002a3d2f87e55b4c5ebcd3d0604fe065ababcacfac
MD5 b8fc597b97986d5d8edb66f3c55ebe28
SHA1 c21a7f0934e5379356e0b5f8d8265d07fe85adc6
SHA512 764b84d2ae5676d500a13ac5c68a6150434e75c20eebd0074eb1a3441b06335f17af92eb520b9a1fa263a1adcf2d4ed3b9d75187cfc0c49b0a631c257227b537
TLSH
T1BFC08CE74700C5203D2956D0A3ECD59CF0CB2A1548AACAC8DA2064AFE9A007287A92B7
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 230819.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 230819.crdownload
Size 13.2MB
SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
MD5 b2d39424d98b15791a22ae607d85dd3f
SHA1 5ff42a9afac12adbb60346c7f1bb923015683c48
SHA512 7155696c4e4fae5a77ddfc55a50867625c4c94672a3825b4437bf7537cdecc9eff25cd106fe712da4c170f9eae7776cb3f87582ed1d548481d4944727a02f013
SSDEEP 196608:oGNlRA0k5a4nF9Ljyl6OqZr5LT8EI3i5pAPtGEgT:oY8tFol6O+r5LT8EfYngT
TLSH
T118D69D6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6bc0c49-ea1c-45f9-b145-268cad47a48e.tmp

Path C:\Users\Admin\Downloads\e6bc0c49-ea1c-45f9-b145-268cad47a48e.tmp
Size 4KB
SHA256 bae3b2628be209f44a8424bc05da75c1538c158454991291d35aeb980e2b58b2
MD5 afb39f66bbb55c453bfedc0eec1a4ba4
SHA1 7b9ddc256cda8902c1254be63258059e20fa325d
SHA512 44c5509c11cef6b7cd54a69630b5cffb12a95c7591246b4e1da3a5db28ff07777c1c6624d9b1dbc3b521d60a471ee68857e3f822d37ee60243577933334a179a
SSDEEP 48:jOXGv9Not/FsNQyqeDQrKzL/mp7bZF1/BwkccFUVN0q31Q2Wc8ZFN2aVUX6g/I7F:uyc8jwIYJF1ZXGVyqFQSf6KL/I15zp
TLSH
T1A491C74CDBF464EAC97190BDC4528F05B431B03127A253CF07F14E292667FDAA67E681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-312-0x000001DE75A10000-0x000001DE75ABE000-memory.dmp

Download

memory/1636-26-0x00007FFF63100000-0x00007FFF63101000-memory.dmp

Download

memory/2160-274-0x00000222BB640000-0x00000222BB6EE000-memory.dmp

Download

memory/2160-156-0x00007FFF63100000-0x00007FFF63101000-memory.dmp

Download