98b6c6c47069106623a5ba02744b1809405bbc0b2419d40e06d0ee9d15c86c93

Analysis

user interaction
yes
max time kernel
890s
max time network
893s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YUMI.rar
Size 2.0MB
Sample260913-ldly2axvbx
SHA256 98b6c6c47069106623a5ba02744b1809405bbc0b2419d40e06d0ee9d15c86c93
MD5 4ce86e1fd943b9cdbfc1d4e1942faf8b
SHA1 cc3d62439994774d2b4bcd48c4f7199f29afe71b
SHA512 2292101126fe3850445d42da5c465330810e76cae66e9f12d5bf2d7454accbab17e96bb95aa2c284ebedc275e321f11ed729506fb99507ff6b8798cbe42fb5a1
SSDEEP 49152:18qGRw1dDkrGJ5HxDT5efE3XcSBr7QFRKd5LtYMgvIt6:18B1iefEncSB7QFRKTLtYM8W6
TLSH
T16595330A881E9B7DF0515EF57B1FC5FAECA5818E8636E3001499A53B4BF4B40F723926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
114	2744	chrome.exe
55	892	chrome.exe

Executes dropped EXE 23 IoCs

pid	Process
796	RobloxPlayerInstaller.exe
3608	RobloxPlayerBeta.exe
5616	RobloxPlayerBeta.exe
3364	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
3096	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
4616	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
472	YUMI.exe
1404	YUMI.exe
1888	RobloxPlayerBeta.exe
3168	RobloxPlayerBeta.exe
4884	RobloxPlayerBeta.exe
1272	RobloxPlayerBeta.exe
2936	RobloxPlayerBeta.exe
4412	RobloxPlayerBeta.exe
2688	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
1148	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe

Loads dropped DLL 10 IoCs

pid	Process
5616	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
3168	RobloxPlayerBeta.exe
1272	RobloxPlayerBeta.exe
4412	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
118	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3780	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

pid	Process
5616	RobloxPlayerBeta.exe
5616	RobloxPlayerBeta.exe
5616	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
1404	YUMI.exe
3168	RobloxPlayerBeta.exe
3168	RobloxPlayerBeta.exe
3168	RobloxPlayerBeta.exe
1272	RobloxPlayerBeta.exe
1272	RobloxPlayerBeta.exe
1272	RobloxPlayerBeta.exe
4412	RobloxPlayerBeta.exe
4412	RobloxPlayerBeta.exe
4412	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe
696	RobloxPlayerBeta.exe
696	RobloxPlayerBeta.exe
696	RobloxPlayerBeta.exe
3444	RobloxPlayerBeta.exe
3444	RobloxPlayerBeta.exe
3444	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Input\JumpButtonPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Players\Blocked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\AvatarContextMenu_Arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\laugh-joy-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\skull-medium.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\families\TitilliumWeb.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\families\Zekton.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Menu\rectBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\heart-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\PlatformContent\pc\textures\water\normal_16.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\Blank.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Slider-Fill-Left-Cap.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\LegacyRbxGui\PlasticBlueTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\PlatformContent\pc\textures\ui\Shell\Icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\avatar\compositing\CompositTShirt.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\MenuBar\icon_minimize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Input\CrouchButtonPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Radial\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\graphic\Auth\builderman.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Slider-BKG-Center.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\backspace.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\PlayStationController\DPadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\DeviceEmulator\sim_orientation.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\XboxController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\RobotoCondensed-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\families\HighwayGothic.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\New\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\category\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\shaders\shaders_d3d11.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ClassImages.PNG	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\gr-mask-game-icon-48x48.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Backpack\ScrollDownArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\BuilderExtended-Bold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\Cursors\DragDetector\ActivatedCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\StudioSharedUI\RoundedLeftBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\LegacyRbxGui\scroll.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Help\RotateCameraGesture.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\Gamepad\VRController.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1824	cmd.exe
1260	cmd.exe
4840	cmd.exe
1552	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	chrome.exe
2744	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337654798776519"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-93202a13414c4131"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell	weblauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\ = "URL:roblox"	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open\command	weblauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\ = "URL:roblox-player"	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open\command	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open	weblauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\URL Protocol	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\\weblauncher.exe\" \"%1\""	weblauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\URL Protocol	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\\weblauncher.exe\" \"%1\""	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4152	chrome.exe
4152	chrome.exe
796	RobloxPlayerInstaller.exe
796	RobloxPlayerInstaller.exe
796	RobloxPlayerInstaller.exe
796	RobloxPlayerInstaller.exe
5616	RobloxPlayerBeta.exe
4732	RobloxPlayerBeta.exe
2124	RobloxPlayerBeta.exe
5564	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
3168	RobloxPlayerBeta.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1272	RobloxPlayerBeta.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
1404	YUMI.exe
4412	RobloxPlayerBeta.exe
2384	RobloxPlayerBeta.exe
980	RobloxPlayerBeta.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
5864	chrome.exe
5864	chrome.exe
696	RobloxPlayerBeta.exe
3444	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5972	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
2892	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5972	7zFM.exe
Token: 35	5972	7zFM.exe
Token: SeSecurityPrivilege	5972	7zFM.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeDebugPrivilege	1404	YUMI.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5972	7zFM.exe
5972	7zFM.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
2364	weblauncher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	YUMI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 120	4152	chrome.exe	99
PID 4152 wrote to memory of 2428	4152	chrome.exe	100
PID 4152 wrote to memory of 2428	4152	chrome.exe	100
PID 4152 wrote to memory of 892	4152	chrome.exe	101
PID 4152 wrote to memory of 3908	4152	chrome.exe	103
PID 4152 wrote to memory of 3908	4152	chrome.exe	103
PID 4152 wrote to memory of 3024	4152	chrome.exe	104
PID 4152 wrote to memory of 5960	4152	chrome.exe	105
PID 4152 wrote to memory of 3024	4152	chrome.exe	104
PID 4152 wrote to memory of 5960	4152	chrome.exe	105
PID 4152 wrote to memory of 1080	4152	chrome.exe	106
PID 4152 wrote to memory of 1080	4152	chrome.exe	106
PID 4152 wrote to memory of 5512	4152	chrome.exe	107
PID 4152 wrote to memory of 5512	4152	chrome.exe	107
PID 4152 wrote to memory of 2864	4152	chrome.exe	108
PID 4152 wrote to memory of 2544	4152	chrome.exe	109
PID 4152 wrote to memory of 2004	4152	chrome.exe	110
PID 4152 wrote to memory of 2544	4152	chrome.exe	109
PID 4152 wrote to memory of 2004	4152	chrome.exe	110
PID 4152 wrote to memory of 4688	4152	chrome.exe	114
PID 4152 wrote to memory of 2376	4152	chrome.exe	115
PID 4152 wrote to memory of 4688	4152	chrome.exe	114
PID 4152 wrote to memory of 2376	4152	chrome.exe	115
PID 4152 wrote to memory of 1964	4152	chrome.exe	116
PID 4152 wrote to memory of 1964	4152	chrome.exe	116
PID 4152 wrote to memory of 1676	4152	chrome.exe	118
PID 4152 wrote to memory of 5092	4152	chrome.exe	117
PID 4152 wrote to memory of 1676	4152	chrome.exe	118
PID 4152 wrote to memory of 5092	4152	chrome.exe	117
PID 4152 wrote to memory of 2424	4152	chrome.exe	119
PID 4152 wrote to memory of 2424	4152	chrome.exe	119
PID 4152 wrote to memory of 4204	4152	chrome.exe	121
PID 4152 wrote to memory of 4204	4152	chrome.exe	121
PID 4152 wrote to memory of 4252	4152	chrome.exe	120
PID 4152 wrote to memory of 4252	4152	chrome.exe	120
PID 4152 wrote to memory of 5032	4152	chrome.exe	122
PID 4152 wrote to memory of 4248	4152	chrome.exe	123
PID 4152 wrote to memory of 5032	4152	chrome.exe	122
PID 4152 wrote to memory of 4248	4152	chrome.exe	123
PID 4152 wrote to memory of 928	4152	chrome.exe	124
PID 4152 wrote to memory of 928	4152	chrome.exe	124
PID 4152 wrote to memory of 4048	4152	chrome.exe	125
PID 4152 wrote to memory of 4048	4152	chrome.exe	125
PID 4152 wrote to memory of 5944	4152	chrome.exe	126
PID 4152 wrote to memory of 796	4152	chrome.exe	127
PID 796 wrote to memory of 5616	796	RobloxPlayerInstaller.exe	131
PID 472 wrote to memory of 1824	472	YUMI.exe	158
PID 1404 wrote to memory of 1260	1404	YUMI.exe	163
PID 1404 wrote to memory of 4840	1404	YUMI.exe	164
PID 1404 wrote to memory of 1552	1404	YUMI.exe	180
PID 3840 wrote to memory of 3360	3840	chrome.exe	189
PID 3840 wrote to memory of 5004	3840	chrome.exe	190
PID 3840 wrote to memory of 5004	3840	chrome.exe	190
PID 3840 wrote to memory of 2744	3840	chrome.exe	191
PID 3840 wrote to memory of 4368	3840	chrome.exe	193
PID 3840 wrote to memory of 4368	3840	chrome.exe	193
PID 3840 wrote to memory of 5256	3840	chrome.exe	194
PID 3840 wrote to memory of 5256	3840	chrome.exe	194
PID 3840 wrote to memory of 1392	3840	chrome.exe	195
PID 3840 wrote to memory of 1392	3840	chrome.exe	195
PID 3840 wrote to memory of 5712	3840	chrome.exe	196
PID 3840 wrote to memory of 5712	3840	chrome.exe	196
PID 3840 wrote to memory of 2916	3840	chrome.exe	197
PID 3840 wrote to memory of 2728	3840	chrome.exe	199

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\YUMI.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ff84e72c728,0x7ff84e72c734,0x7ff84e72c740
  2⤵
  PID:120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,5070811860195172308,13871544196382727445,262144 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,7804659711213417883,11888244311426842251,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,470360835231621753,17765936336832392168,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,10267043542864312267,6045039931043693421,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3336,i,1544602953422370100,9825208238788360751,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,7230115862813058216,5263773631604662547,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,560688523960122981,10391666241941017825,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,4951134124431794354,887739842323095719,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,18168951434123195894,991120105402782731,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,1669720934813794279,10712340767023089937,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,13556730001527879710,13947629756396523643,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,16011413717098796174,16027996457402642756,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6020,i,7437151622571266382,1789310758421040340,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5512,i,12785646461536072778,13343425896294452,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,4345313577461539819,4628128422689397857,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5528,i,10354777299360171903,7643428072003070253,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,10800799002115139582,16867665772854655085,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5588,i,13682496982723654411,16914135404275454023,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5656,i,9972818903910425613,1800291057904069810,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4740,i,6972106583524502166,3841920516671902010,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:9
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5688,i,5404030452965625435,10754725855715221959,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4880,i,13516361400002900850,16136087872305736583,2097152 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,2483409198663794814,11615813895673096282,524288 --field-trial-handle=1852,i,11655158611536731406,6044649083999725473,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:5944
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 796
    3⤵
    - Executes dropped EXE
    PID:3608
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 796
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6064

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3364

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4368

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2124

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3096

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5564

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4616

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5872

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6092

C:\Users\Admin\Desktop\YUMI.exe
"C:\Users\Admin\Desktop\YUMI.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1824

C:\Users\Admin\Desktop\YUMI.exe
"C:\Users\Admin\Desktop\YUMI.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1552

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1888

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3168

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4884

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1272

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2936

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4412

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2688

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1148

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff84e72c728,0x7ff84e72c734,0x7ff84e72c740
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,14501504288439394341,10186074342481220461,262144 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,13472145850324179121,18429224340364875320,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,11654187229799510400,17913843867498947869,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,16450514908070478813,18163530182197177667,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,13798928820638750677,9138833240302573313,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,17476696247508964443,17074788216261546217,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,2330661051160902648,579387194780288078,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5768,i,11622486585380919900,2376264712919182662,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5680,i,10293242927468388686,5073308681766373914,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3512,i,16546949771602376612,4507881474399062876,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,4899805165330592280,714119443907867835,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3604,i,6850806443013755471,14470131121663287679,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3708,i,5081277667325511130,4480488665531674912,2097152 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,5884121841761310693,11656490229356768384,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,10739969570291200667,16648286381895225807,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,11161205950953155277,8695630369035523607,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,894343087973767778,15536416436133024113,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5716,i,2550212452384364708,4402292838864475550,262144 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=6104 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,13921682692947727665,7848883174797000913,524288 --field-trial-handle=1872,i,1042700630107347263,18212569026648538997,262144 --variations-seed-version=20260912-030030.322000-production --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4088

C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
PID:5044

C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:696

C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\weblauncher.exe
"C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\weblauncher.exe"
1⤵
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2364
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2364.264.938615852586212687 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView /prefetch:4 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8401f5fd8,0x7ff8401f5fe4,0x7ff8401f5ff0
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,8122539003062838909,14469662068998283977,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1768,i,8122539003062838909,14469662068998283977,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1768,i,8122539003062838909,14469662068998283977,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1768,i,8122539003062838909,14469662068998283977,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786 /prefetch:1
    3⤵
    PID:1136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3780
- C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe
  "C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
  2⤵
  PID:4340
- C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe
  "C:\Users\Admin\Downloads\WEAO-LIVE-WindowsPlayer-version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 14e3e506d5cccc03eeb3ae006f2d55611fb0af64ac8d176dd23d8a3966099b74
MD5 955fc4e7e130c59a820d08497c2140e3
SHA1 cdb7dec908c21bb2f36868df8f2e6b90b1902e6d
SHA512 1c0cde12f81564f720ba563be3f6ecb320da4bf4e36b67afe9e20512e0cdc8af5e23a8154a3c3616ea193cc78467d04d9fab35f068b49c745f66fb73f9f23dfd
SSDEEP 196608:WEItDe7ZgAgDLs5gk173msx1rO4jBI0pGU8xZ0P04KR:WiqAZ3msxhO2BIYGFg84M
TLSH
T1F7A6BE22BE00C032E8D200F2A6BD9FBA993C59341B7954D3A7D45DB95A305D33B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 6417d71533072b12043a9a0ae4084fc7f04754ea34914003aeb8ba4cfebba0ed
MD5 aa4d548826d9aa8ec371c0a3abb689b9
SHA1 a447ca0417be6cb27115eacc82881389f6e21137
SHA512 4d849b6e4d7974119b4572ae3e94c3ce1a499f4dd4d94598c02ca1a4b4018aa5b713f217cff72f7620e73a57ff96fb2cae67b5fff1ba180f0e8566c504bbc376
SSDEEP 196608:ZX1oy0IyVwmwHV7GRt94O1QojO2LIkyGKgz5Rs:FFVmSV7G6O1y2blz5Rs
TLSH
T1F027BF0EB4D206E8C5B15070E15F63D3E672308C0BA96EF746D902213A73B9DA659F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84ae77e4d131e93379683481e2602a0250f7ccaba40692ed2949a816431c9da9
MD5 ebcc9a297e5c474090962ed19a5e48a9
SHA1 2e86ffcad4ddd1266a3658610fed4361bfa6153f
SHA512 1346cabd9fe762b02f75bbf7904d7abe5469c2a7cef859aa89ea76204ae27b1759fd0a4435de57059ad8d709fdc549c5703fbcd74fded771fbb19adb99bde62a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c87a0a0ae11a76ef7e0fe317935bdde281ce6af1f5f0771f4ebb5eaa60b741b
MD5 d2fd1f4a111100698fab4bf7891f40f2
SHA1 b6acf1d81834d339f35f7752e8c14f0edab4df18
SHA512 730b8a87bd43b74b0488078eb401c2bcf6e7a984d313a1e1e6389760cddc795a67ec28e2c5d113fb33c2e9ade3818b085cd1ff8f2d64376be2a61928579198b6
TLSH
T179E022AAC934ED2B19FC1B1861245746FA1517272B905B0F363DC20C8FF563B419782C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 6e434f2ab927be71e16ac60353a1849b33cd8cc7acca65f6bcf28d919cbac429
MD5 5ef2b35aa284b60a3c240ad42b16480e
SHA1 34c95202eae5efb6f0eb32a0b096d5df7b806d5a
SHA512 1627222411c0c4f45ec026a1fa32148e8df4cc7f1f8a2cc7b8ebd5dcaf6e9caa5f2768a85ad55e5fa5a9e0e98ecc9edbc6bad170e977e248c7c653516c0fc360
TLSH
T1CDF0E299D1A35117EB3063B3A0E24B7235340B40D9D62B4F7156C4FA55223F6EE85D28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 dc28f470983995e20242ee023b342ff81bb987f719eb19bcfaee4abae21f9611
MD5 58500a35b0233f35106a6d3644062839
SHA1 87d2dea9bc64ba135b74360ed6cefe69f8ebe075
SHA512 c5267989ccb41d7e0f42857f9e2c3c394845aa658a30bfb28124f31da530453f49c5a6894f1afee741748166f1b1d6c22072ed4ed9919c75c67b0d90d4067b71
TLSH
T12EE02BEA21C30013FF706372B4D20F3434241704C4D05797B1A4D45345233E1EC9AC38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 d862fe46a0407b778f612d8416f893f9e438af7485df30dde520bfdecd3c98bc
MD5 110eb4b7a597215053602144e3d08fe4
SHA1 401635cb865b029f46e47674d531b90e06c0ab12
SHA512 a7b0807a249977200140d7986031084956dd2d06def8e40930834c98f0df3970a0fe7c2c28d79610251c1db10ccb1f24eb1344d49be5e1e7ff92d8659ee6f0ec
TLSH
T1BEF0EDD8D2D3100BEB3423B3B4E20F3230240705E8D2674B7166C0AB10233D1DDC5C28
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5f55efa73cfe109e657ffd39c722e21bd703e113e85b48e2beab04876366f28
MD5 bffde85412fd0ea059c8000695ca1ce7
SHA1 d488950878339297430fa020defbd6bb31814c6f
SHA512 91761f5473772510b3ff69e975c4b79db0416f70482e102c341f695932f11da4b6c7aeb66a41a76150407526e682c79fc37347198ec0a937983f9b3b9560b472
TLSH
T1B4819BF3C3E4DA2D891156F49B15AE1BCE2D0A24531C3C66C8E4BE5B53E24B2E21179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 38965c9200c5748dd4bfff6b40236c3e9f35f95730caa5d746d953999acbcdce
MD5 5426c1ee65587899b31af22a9c04cbbf
SHA1 52a7ce8c38743523c02eb3d46514a8378bc6f84d
SHA512 b148ec4df58656b98cbcd0360631dc8e8dbafb1b22490a3b0979aae4384795a62260d640bac2070bef2a56ad9b4bfb54e5bc03e4d188f9ffb779e9cd2de5474a
SSDEEP 192:DTV+WoMFcZuaMlhnHHrOMg7dfd/16HIWJKdLYmPdE:DTQWoMFcZuaMlhnHLOMg7dfdN6HIWJKe
TLSH
T124D1AFF383E4866DC91152F49B156E1BCF690915632C3C66C9E4BE1B53F28B2E250B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b747a8c6f2b3c00fcfd45e25f2bfe995348c0fd42ba2c303dc7c86584d23e3d5
MD5 4f6f32b83b0c7ac0db124436ad1ecc20
SHA1 c8523dd084ea4e8609955f6a67b7ff7564c90942
SHA512 7ee7a1fae53744085c6984b49bf3438256c1b2d5456046976950889558df973886975568767b691a578e2d4a3fbf66616c4f59345937eac01ff7ccfbed13e6c4
SSDEEP 96:DTV+WoMFcZuaMM0hnHHrOMgBHdAKGd/16HIWJKdLYF:DTV+WoMFcZuaMlhnHHrOMgBHdAKGd/14
TLSH
T181C1A0F383E4866DC91152F49B156E1BCF690915632C3C66C9E4BE1B53F28B2E250B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 27cabbdd1aba6254f9b1857287e1882214ffdcba3d0fad083d34806aaa8d03c3
MD5 ea129cab4065bdc68ca9d178d026034c
SHA1 275d97b3d76d712360fa290ac85c7ad2d603a84d
SHA512 bb4f1ffc9a7aeda93443fe6544ebeac2f7d3becafc2d3b40e2ab2e677af98fb6c719ad5235b4cae0264df9234d3cd29ddb3dbb5a75b5a1bbb1f5ea3239f1a7ef
TLSH
T12C31A2ABB6BEB41F6068997B1D04FC0969BAB835924128F4DAD3816DF0C79F30703467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f3b29047869da73d37f783d53da3b782e6a2cf467937d843c37073f6ea880e33
MD5 47344f8c37b52d87619a0b4f306de85c
SHA1 d95ad6a403d871f2d10a01610aba9c60ff8b01db
SHA512 378793fa8d523a38f0aa0e2d914147894d3b4001022a9faa2d36d31748fdaa2a8fa3e33f33ebd2ce0cb9d1e8125ca5604bb94c9d8a6c341a91ee879c9ceaeb0a
SSDEEP 192:kRS/nABv7B3r1XPRpO2Q+f9THY27b+WNkA+WEVBj9xAMU92poeexVyIsnAUgraJ:kRS/ARRlXV9Nd0vAt2we
TLSH
T15152942AAD207A7F6CD7D219F9257B67E2F62031A4C12F84EAFC892C11D75CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6f67a0f35a70e5ff5c941b568938f371c587285894f44d2d82c7e66480e17d85
MD5 09ff031e2a45d61623058696497b29dd
SHA1 4af69a60e6bace77e48e5ff2256077c6819fb4ff
SHA512 e63403f57caf9d01a9aaf4077a36b62f47a826d6bf1f30420ddce212f4557149d1fc93459ede4c638f25068fb237bca42f6e00980a2302d24a11dc258d29dc4e
SSDEEP 192:jRSPnCzv71APRp2N9THsb+WNnOD0qoeevVyIsnAUge:jRSPCL8XO9ww0ve
TLSH
T12832832DAE20753F9CDBD21AF9217A53E2F6203165D52F84EAFC896C11E75CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9c0dae3dff28eda8f90d275a2348c098d333967ec2f65dc1b42d272e37324512
MD5 3b0ca8df76350c63347702d662e7ce2f
SHA1 e336cf19b43cbee7ab161ff3138e1463e8524761
SHA512 9d62b9e4db4497438c184b454a74a16d30cb252e18e6d0733db311fe33dab8f714a170d51dcd193601ff04e1c1aaf81478882eb4d2706e8ab7a47848a46d19a2
SSDEEP 192:kRS6nAqv7B3r1XPRpO2Q+f9THY27b+WNkA+WEVBjMsBU92woeexVyIsnAUgraJ:kRS6AmRlXV9Nd0PK27e
TLSH
T1AE52942AAD207A7F6CD7D219F9217B67E2F62031A5812F84EAFC893D11D75CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 76040f68a91c96240dbe5bdb87bfb0f9a67f0f78676e3faf2ff9ee79ffd061eb
MD5 74391b9ee96538e6603986ce846731b6
SHA1 bd0250dac3b90d648253525fd32ff6bb68986481
SHA512 a765efc72f5b9ad16869251f5dcd40262a65ab6225f892f7b00a74da9d4f3090ca8758b53e2695677ac9cb274af32c24b998787d7ebcc21ab2e09f172ea62cd0
SSDEEP 192:kRS/nArv7BAPRp22Q+f9THY27b+WNkA+WEVBjIkDU92enoee9VyIsnAUgtaJ:kRS/ATIXV9Nd0ro2eY8
TLSH
T1ED42842AAD207A7F6CD7D22AF9617657E2F6203165C12F84EAFC896C11D75CC3217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 63aad0d87740b43f45abfe8a5f52a5f56931327fc5f0305875c0cb655aee25ae
MD5 62b8c612d1c44d5d06218abcc90408e9
SHA1 a829f7d4e3b685f1e7294b4e3dd8924b332591bd
SHA512 b3f3042e3ef7d4dfe80866b37a8f1794f29518ba651f7a00c252dc96c2a7c5918a94da9c6a677b8ced588e51293307e924d3205f406e6f4330b03296078cedea
SSDEEP 192:jRS/nC3v71APRp2a+9THsb+WNnODtU92EoeevVyIsnAUge:jRS/Cf8Xo9ww225e
TLSH
T1B532852DAE20753F6CDBD21AF9617A53E2F5103164D12F84EAFC896C11D75CC222B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f224bb048a3dbf0b3bcac2ebd257454591dc2db90756860d9ab98a22987bfc91
MD5 f12bcae04447e8114ca2fecc5b339ef2
SHA1 b5e2f9e0442947d489ae8b498e1d6e744cda4846
SHA512 0ad3ab7e4e8daebc97a2000de661afb74258f3aeee62f3bb59b5b866faa4489243d3dece7fc77a9efcb3c7c8e88778f87944a9c1395f3494e2ef092c411ecbee
SSDEEP 192:kRS/nArv7B3r1LPRp22Q+f9THY27b+WNkA+WEVBjIkDU92SoeenVyIsnAUgraJ:kRS/ATR5XV9Nd0ro2be
TLSH
T1E852842AAD207A7F6CD7D11AF9257B57E2F62031A5C12F44EAFC896C11E75CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 01c645c2e52d6a4857eec1e11a7bdf4aaccef0d32209b81ed0f86bc914cfb295
MD5 a9860e70637608d32167b1366ea78711
SHA1 32ea8349d4e3ca101866f836c6f4e15fdcb48963
SHA512 3bff7a7ebcd2c01f0398e1c04f47527e28d3c157f6be0eb85630354c3ce2b7deda99a4f5b833e1e7a5d89fa1c3e2c45d4a3c2cbb2b77ac831af31c8802fb1e68
SSDEEP 192:kRS/nvrv7BAPRp2a+9THsb+WNkA+WAU92cnoee9VyIsnAUgtaJ:kRS/vTIXo9wdR2cY8
TLSH
T14342822AAD20753F6CDBD21AF9617A53E2F6203165D52F84EAFC896C11E75CC221B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 5e9ea4528c498691c26290125aa941f3d2b4836adc4dccf8a58d4fbbf1b4c16c
MD5 7631edb29bc64aed76646b83a2c59072
SHA1 68673cf035223aa0013865a39787439ad12f10ff
SHA512 b472cb9b255f9c2920ad0ac13ffce38b58bba5d552e7cc6472701bba060f064ddc93ebb1590fce6f4d29e8b402650fec2f00311d7bf22cb4b97f210c50af55d5
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3alHG47vdYs:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7y
TLSH
T108520927688C9A3F0FD8DA4CCC127F8FACB501666678496492FB5C1903E97DB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 86ee0c643acd7b9bd2875916a434025d8624d3f5a80d977b6b5d372e23caa95c
MD5 a337488e6a59a1af55d85616c052e2c6
SHA1 2d28d3eb97c32e2110f637c105689624d867387c
SHA512 f4563fb8492a2f065c2022564b93180df02b8e84883fa6b3de3f79e52dd24f4a01941fe0df2fc0bdc2ab20ed1568d1a0a6e32c648b866150e26b666441500b03
TLSH
T183A00251C9E20421DD14A6F1606D15716251481854E4434348D78485A96F0C2D212D95
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eefad.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5eefad.TMP
Size 48B
SHA256 fed94dbc75a254562b3ce88839973a8c12003648511ed0467eb3bb8076d55b52
MD5 8c0012238ad2f7450ea65a75be1d151a
SHA1 67e137c76e5557c4757cb5956d74425ce4651c31
SHA512 07c69866aafd1caf43f0997c2c6f8efbcc221efeebc7cae19e08bc49bdf7280b82d2d3f4dd96ae5ff238dc819dcac815638fde70bb70e31003f4ffc2e0f9eba9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ef069.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5ef069.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 135KB
SHA256 a822b4e6ff87ce4eb9c6d4422edb8746a7f02b718764adec91edbecd80641103
MD5 67859e2fabbc857db57b70f3d0e81f54
SHA1 9090c9f75d7556a753ceb260eff0726b76fb21c8
SHA512 a37f2ddd84f0af3bb64faccde59895b3fdb1b4ecc41bf501778e4b8008219c537983c95f34a314a82f349acf6a4ae2f50c4c39fb0f33ab1647499ed4f7bf73dc
SSDEEP 3072:geMgh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI1:geMgaG4pEejPhAIuNWmTETII1
TLSH
T1BFD312351E2D5639CF9ED13D9257252A1C644ABBC48A4AC869CC2ECF90DF5881E3BF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 98b588558363cb08174ac6580bcaebd107f568ba7dc0de8b1c7cd14f7dd6acc2
MD5 0b2b687f2b18dea956735b1d143f09bd
SHA1 a9210e7011de71f8c918dc30a2f7addae858a6d4
SHA512 e08408ee1bef6fa3fd7f0567f0a463527ea84ac9350cf1863c7857e68a12a78c46efd351621dda33eb7d1f141a1978c1add2e0011465977c831ca4c920c89c31
SSDEEP 3072:Yehfh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI1:YehfaG4pEejPhAIuNWmTETII1
TLSH
T11DD312351E2D9639CE9ED13D9257252A1C644EBAC48A0EC869CC2ECF50DF5884E2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 1a23ff34462193dc479b729bc30defc28c127f6452fda61098668afcf312998d
MD5 0d31c956a6edb303c8c4ea8f90b82348
SHA1 f669fea684fc41bef739078dd999a100a2c93f8e
SHA512 96b993b3674d1757c2fa0a5385dd7e8da19186916ca4e71318d417dd1626bd339b0b5fadca423c23350bd5680eac088a2c074a62f6c5255d62ff88ecf2566ef4
SSDEEP 3072:SeZh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIi:SeZaG4pEejPhAIuNWmTETIIi
TLSH
T140D312251E7D9239CF9ED23DE257152A28144CB6C48A0BC819CD1E9F54DB5881B3FF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 50b0e1bb7d18be1c250767f666291dd8fa3a51793bf74b634f453b57f5f800f0
MD5 90ca19bfa82a401d82ac1000c5858580
SHA1 9d19af599c67fa62df4550400f24351216cefa6c
SHA512 7db4b8ae544e824d07ba986a9bcf5247663fd34c30d05fdcc674ef79c90c30bf62fb72ad6b09960a76b48c4fb8050d3ce3779c2a64b7727e84e40a0e116110ed
SSDEEP 3072:Se3h4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIi:Se3aG4pEejPhAIuNWmTETIIi
TLSH
T1D9D312251F7D9239CF9EE23DE2A7152A28144CB6C48A0BC819CD1E9F54DB5881B3BF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 e0aca74abbc32247d6845b337e9c7f1b85429b0d642a5fcdaa902b072f866ea8
MD5 0ad4afb76db5bef3841e3ef0707bd313
SHA1 3be588787f5cdb2de03d6698574a57e73907b45d
SHA512 c585ff83fef769aa921f6c2b76ec85ac0bec6e950dadf1bbf3a66c051911cc8048d8688230f7f731c96f2a49237fd2b8e7c1e0fe5d6fdb802fa3460d14ee1c93
SSDEEP 3072:geph4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI1:gepaG4pEejPhAIuNWmTETII1
TLSH
T198D312251E3D9239CF9EE23DE267152A28244CBAD48A0BD419CD1F9F54DB5881B3BF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 103d89e4a998a725a1ff4db8393ce0e919c801fa99f2bab8a69aadd473306d3d
MD5 bde38318fe407aa2e4922a84cf58d612
SHA1 e7d482fd70174cb4f7f28816cc0796461351a1f7
SHA512 0e6b93429fc88d71346be83f35ed9d543d94d1a9ddc18728864d1f5c84b4e2461ba903fd93c773a6e140314e6c7037c731fde6c8b8e00fb75866c8dd2b089b30
SSDEEP 96:pC6Nd+U7D/u1i5WFtfvuvTj7sCRDotok5VHD/B6jGyvutFDLnmbYLsv4a:pCGz7q134vtDUD9Jf7FDLnmbY6
TLSH
T1CBA12B71E8BD99778576C085B5422A43CFB022BFA901AF84DCDD1B1C11EB6EC1316A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 d785fe36afc8312ded95bc3a89379b27c0ec61583f86a253602e94dc7ab028db
MD5 9ef00de314d97862cd0a83841e1f80c9
SHA1 5bfa331c2a9b2faf570050c551873b679323dc62
SHA512 b4e475420b10f5453a7b64694b7a2a24e35951450d38dc571defbd5863f3cd7ac65f772916c5b7b92760b217f4805a69162d0c550d76f2d98d7a31ca75591192
SSDEEP 3072:Zeph4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI1:ZepaG4pEejPhAIuNWmTETII1
TLSH
T1E7D312251E3D9239CF9EE23DE2A7152A18244CBAD48A0BD419CD1F9F54DB5881B3BF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 191KB
SHA256 000c5e473f076f2564bb3a839328bc1b55571d231b8f61208d197c53c8dcdc72
MD5 481b5049edc7f208cc446d37dc954ab6
SHA1 90e04958671193eff7fed8ab010ca24b80e58e60
SHA512 5a93b808a10ed546ab4b2ed3cc54969d67c883c815450ac40ebdfe3db6436b7ca41d044840886320a4d11323c94343545f75a76ba99037d7cb41bfdef34a83ad
SSDEEP 3072:geGpkd84Oe3w2D0e4qdr1WAJUh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qW:geGpp4tw2ANqNUaG4pEejPhAIuNWmTEF
TLSH
T16D1412261E3E5C69DEAA823D925734221CD85FF9909A0D9869CD1DCF40DB95D0E3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 9488dee4b84566a00dde480eaa264fe86dda12b2aa173d4a68720c7224c29ac5
MD5 87e139d02a9746277b6974efd5355552
SHA1 b1c7d4a3bae8ff63979ab4195fcb9a384181e938
SHA512 b097b58b6a1327ded9182d895cbd6bfde570934a48fc7b37ca5fb09c07a2c136e11e500c171ed9be495e67caaec23d282487a26cb6eb1934df9165f875fb3a09
SSDEEP 3072:gehfh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI1:gehfaG4pEejPhAIuNWmTETII1
TLSH
T122D312351E2D9639CE9ED13D9257252A1C644EBAC48A0EC869CC2ECF50DF5884E2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4152_1587933417\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 253a4fbd38077d45d6e23061cafa984d5441398ae72b711f889e556c908f06d2
MD5 21ba67d02f48d4dff6ae2b22ea574eb9
SHA1 d7bf2488a0e61f8834c4ffd16e2cb76951041b40
SHA512 6e5e3408b6a90d4dc8d05386d80be297ae8a3ab6856cd9e4ab326c9b60a749047c632fc04d104139abd1babf8d2cdc8528c0d653dd7cf5fdff5801ca2f5acffb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 82696df5b5f7fc130b3fcdb332a872268f4f3d82e40b65caf0c39b91edd7f1c1
MD5 d7d134bacb718b02ca9d005d4678b1ad
SHA1 7e55a32b04afe75db299ca12d4df8fa7aea35b5a
SHA512 b54f0da95005f3e42180ef7444fa8cdd579a31f5edcf0de9ad41edca3711a91c9c88b61eb27229803b850bb17d6410085e0e1c43fd55eb38bf1baa9180b15719
TLSH
T14FD01222724201B4C01024730402A1081A80F60B810644046829CD5F1F040602902951
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7b77bfddcc0b9742f2975f3c22217a6e6138bbca1a1aef0609b413ec6107d55a
MD5 2c2e5cda267576cb6b91c6cb93c8834a
SHA1 647c216e77ed8aa5b850e57b4b490272eb7d3683
SHA512 cd97018ecff38d128dbbe89119f9d433d4058bbdbf85e181b89d675522a4e30bc71957140e9021b26ca10ac2fcdc85e259d53f42ce61736d0caa25f71ac75d65
TLSH
T11EA0025511892263D3015771B5C9437237345CA216E3071264A1C8F98898B90E5451C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe666c5d.TMP

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe666c5d.TMP
Size 48B
SHA256 46068cbbdbc00b8c2ef16088ca1f303ca478efae2ce2ddd4216dbe7ca2fa1f8b
MD5 a962bbd037eeab6642d21820a79d8775
SHA1 29cac23c89cabc390194de74d7b4b99204e72824
SHA512 81db6e2d17a1a46d7d1693addb0e83f501de92981f4989a6ea8219d0c7594acea8fba5b5d5162889ef475842e41ad717e1ca1df83d5edd5101d3886b429fd15a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ccb8edf8-1e68-4086-bd7a-b43034c9924a.tmp

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\ccb8edf8-1e68-4086-bd7a-b43034c9924a.tmp
Size 6KB
SHA256 32ffd4ce4e77c6f0c040171f95a555713ad3da99d241e755a471f44e7ecabaf8
MD5 10c3ce8262cc0e7d1bfb7a2626f52901
SHA1 ec94746d27b945db458f882f42b171273a017f75
SHA512 b24d7332b62f6829eac103b0311ca84802c3893c5486d342134f5de1e612fe3402f36cce010d8213be7941e8a2c1b3e3f9f3d96b601b51c98cc1f4ce1f0e863a
SSDEEP 96:stb/dGIaQZPb9ykWo5h16Z0Ns7/x+6MhmuecJ381ejeIK+gHu3u28XM1C7K:stj6DRonNsV+Fd38Qj8XG6K
TLSH
T182D17302AE24697B4CC6F119BA35BA17E2F9607274D51E58EBF94A2C04DB6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 2KB
SHA256 aaf7845d3cc173d8461ff68ab945d3f5a333eb35b1e59ed46c5d14390cd0f375
MD5 b866c7cd1e55f88b0f30cf90176b575e
SHA1 55a92496d8fe7bfcaffcdd6e646cd348d213e49b
SHA512 27263dfe92ba853bed7a0a25668d374adedbfa5cf095fa3693fe544919d675fa553fd80a7dfbfb2204d0c6f67a755b08a32b8feb2b6133452a42b22e89d36b06
TLSH
T14051B6326960AA37DAA366043A667F639B746175BA821F60B9CC0B0C00DBA1D1303C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 3KB
SHA256 f189a93b99d705474543a38e21338d4e539bd2ef5aa78c97b52cf0d566e0ff98
MD5 f9156d2656e08bd252f2cbe138dfa615
SHA1 f9c77086313ed946f01f858b9edb2d00df6e441e
SHA512 6379a9531e82eb5503c915539f17bf76f995a5415e59293c0f18fc82e5eb084298e2744a84b6bcd36f4238050739b9fe34b077007e490a21152a20cef189833c
TLSH
T16B71853669B0A9378EA2960579963F17B7A45137F9816FA4E9EC0F0C01D77981303C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 16KB
SHA256 3633ef6c3d72b4dff33c8f48f77e9bff103f2965fe3b99a7000b05bf99f9fa2b
MD5 8d5819b2636432a1760fb178ca702dca
SHA1 dd9d322d7c790f262059415b5d664d12edb1c0c3
SHA512 193945a494be21e2bad4c1a7c7d80b6e5fb2c56dd55c5265568d4632c487fffb308543f6efb80151eaa854cb4344fbd4b5a2b7385966b8722d83ffc91212d984
SSDEEP 384:f+aQikB+z/xvxjg/qhEKNBSHmlHYEUh8p7Z9zt:u/UxvxjgC+2Hf77ZFt
TLSH
T1AF729E2A55657E37A5F7F5043A6D0B9BDBF8987360C26EB859ED4F0906C73981303C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe661bad.TMP

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State~RFe661bad.TMP
Size 1KB
SHA256 a28f5b9d18853cee667bfe7efb5dc7ae1125f6528a9333653d2061d0bca58ff1
MD5 b3dc7cef443d19fbdf3fc14cbe39ac4e
SHA1 559437c07a9a745cae4430368ac44ac0c78c5da8
SHA512 8397ba655238adb9a2b7db4a94b47df210943e312b6ba33cff3b42e57eb3f21fff4edc772631727459c4cdec01a4fd5350794dec6c0408cf1513cad7f95b504a
TLSH
T1433174B195B06B33ED56624A2226BFD76F60157AA5414F48B5CC4A0D01EB55D823BC32
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\configuration.json
Size 1KB
SHA256 31a1cc392c6553360252ad61bb7fa8401ae43619a755fae3fac7b0a635c12ec2
MD5 a701f82fc5e140c8b42123a867d80ffb
SHA1 c9f4275b499d1f06768aa2c6151cff31cd011534
SHA512 e2bd995f209acdfc4aed8508d28c72806e9aa95607c1b63c77624c5b1beeb7768f274e0f6e237def7136ffa7660960658db53755811ecf252c64129b61c4eb6f
TLSH
T1ED31F525CE256CF74094A03DED6E9153A75445530E4E3C18F389A59C2F0E63F61FAAC8
MD5 SHA1 SHA512 TLSH

Submit Download

YUMI.exe

Path C:\Users\Admin\Desktop\YUMI.exe
Size 4.3MB
SHA256 dbdc81bacde0aabecc19512e2c91e5ebddc62d7665942ccd87256d6e41b0d6ed
MD5 0c19387305678d903dcfc3499cae1cdc
SHA1 d9be36c0399d6f6b7c7e3e174dc9d205589c4739
SHA512 2a9661d40958e13bd8f0914d855816ca82e2697213bbe53d4d5c9daf62857ca78e89822e94cc78e314cd1da59c2667a2fb498f18d613a96c4464e33c362eec67
SSDEEP 98304:izl82NLwSMSVdsskgGSVwSBZQDA5S1u27Sl:iBZDjkMVwSBZQDA5SAl
TLSH
T17026D056F2FA40FDD276D03CC6A79217E6B17414173587DB23E08A22AFA3AD08E79711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash.log

Path C:\Users\Admin\Desktop\crash.log
Size 165B
SHA256 05a549a4af783015381aecb3ce51985e7ab0b96cfad67a978e5635cef44e9f9a
MD5 e58ee406fc565b846212180e86079568
SHA1 12001762c5a3b7c6bd630b2d7789f3c109bf4e76
SHA512 7e890bbacee148d4ab8d402a8a27c85769337696033583b84a8162bbb2244bfd0727b1b196c10b6949852531316147b802e1f4a061689bf40e6c638806f40da2
TLSH
T173C08011153E1979C224477099517A4C5DFA375514D13170F44582E5991D15559EC110
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 12.9MB
SHA256 0c46c7041e530a39483f7b2c956811aad71e2c9c3f2c76d1a826867e2e50946b
MD5 8b59097de0f1a00833610261abc9d25c
SHA1 f695b490b69f7feb6cf752be2a5384315646584f
SHA512 0be5618cc568d9808defc3b732222f509f5f6a09ea9b5f0d353946281fe1a1c6a7c829f480425c61f649279a8a67ab62669e873a4fce613bd0b4424c91ea9e03
SSDEEP 196608:9saZFAPLVTWdfAKCF797jAA1Wlm645lEqfR2dE:2IuVTvKCFBjAoWlmE5E
TLSH
T130D69D6AB2B800E8D4BBD178C6565617EBB1741603709BDF1AA086F61F63BE01F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-1154-0x00007FF86CFD0000-0x00007FF86CFD1000-memory.dmp

Download

memory/4924-1079-0x00007FF86CFD0000-0x00007FF86CFD1000-memory.dmp

Download