dbdc81bacde0aabecc19512e2c91e5ebddc62d7665942ccd87256d6e41b0d6ed

Analysis

user interaction
yes
max time kernel
899s
max time network
449s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YUMI/YUMI.exe
Size 4.3MB
Sample260913-ldly2axvbx
SHA256 dbdc81bacde0aabecc19512e2c91e5ebddc62d7665942ccd87256d6e41b0d6ed
MD5 0c19387305678d903dcfc3499cae1cdc
SHA1 d9be36c0399d6f6b7c7e3e174dc9d205589c4739
SHA512 2a9661d40958e13bd8f0914d855816ca82e2697213bbe53d4d5c9daf62857ca78e89822e94cc78e314cd1da59c2667a2fb498f18d613a96c4464e33c362eec67
SSDEEP 98304:izl82NLwSMSVdsskgGSVwSBZQDA5S1u27Sl:iBZDjkMVwSBZQDA5SAl
TLSH
T17026D056F2FA40FDD276D03CC6A79217E6B17414173587DB23E08A22AFA3AD08E79711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
77	1008	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
1832	RobloxPlayerInstaller.exe
1328	RobloxPlayerBeta.exe
4952	RobloxPlayerBeta.exe
5456	RobloxPlayerBeta.exe
5028	RobloxPlayerBeta.exe
2200	RobloxPlayerBeta.exe
4380	RobloxPlayerBeta.exe

Loads dropped DLL 3 IoCs

pid	Process
4952	RobloxPlayerBeta.exe
5028	RobloxPlayerBeta.exe
4380	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
4316	YUMI.exe
4952	RobloxPlayerBeta.exe
4952	RobloxPlayerBeta.exe
4952	RobloxPlayerBeta.exe
5028	RobloxPlayerBeta.exe
5028	RobloxPlayerBeta.exe
5028	RobloxPlayerBeta.exe
4380	RobloxPlayerBeta.exe
4380	RobloxPlayerBeta.exe
4380	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\PathEditor\Control_Point.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\btn_greyTransp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Emotes\Large\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\LuaPackages\Packages\_Index\BuilderIcons\BuilderIcons\BuilderIcons.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\families\RobotoMono.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\waypoint.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\PlayStationController\ButtonCross.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\dialog_red.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\icon_friendrequestrecieved-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\PlayerList\FollowingIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Players\Unmute.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\Cursors\mouseIconCameraTrack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Menu\rectBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\ic-clear-gray.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VR\hamburger.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\ButtonLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\avatar\meshes\torso.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\AvatarEditorImages\Catalog.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\Cursors\Gamepad\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\LegacyRbxGui\CloseButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerDark\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Input\IntroMove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\InspectMenu\ico_favorite_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Scroll\scroll-middle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\indicator-background.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\account_under13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\SearchIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Menu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\TopBar\inventoryOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\places\AbuseReportingTest.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-10x10.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\DarkThemeLoadingCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Input\IntroCameraPinch.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1724	cmd.exe
2732	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1008	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337651640167564"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-93202a13414c4131"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
2264	chrome.exe
2264	chrome.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe
4316	YUMI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	YUMI.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1724	4316	YUMI.exe	88
PID 2264 wrote to memory of 4572	2264	chrome.exe	90
PID 2264 wrote to memory of 2872	2264	chrome.exe	91
PID 2264 wrote to memory of 2872	2264	chrome.exe	91
PID 2264 wrote to memory of 1008	2264	chrome.exe	92
PID 2264 wrote to memory of 5864	2264	chrome.exe	94
PID 2264 wrote to memory of 5864	2264	chrome.exe	94
PID 2264 wrote to memory of 5992	2264	chrome.exe	95
PID 2264 wrote to memory of 5992	2264	chrome.exe	95
PID 2264 wrote to memory of 120	2264	chrome.exe	96
PID 2264 wrote to memory of 120	2264	chrome.exe	96
PID 2264 wrote to memory of 4424	2264	chrome.exe	97
PID 2264 wrote to memory of 4424	2264	chrome.exe	97
PID 2264 wrote to memory of 700	2264	chrome.exe	98
PID 2264 wrote to memory of 700	2264	chrome.exe	98
PID 2264 wrote to memory of 3084	2264	chrome.exe	100
PID 2264 wrote to memory of 3612	2264	chrome.exe	101
PID 2264 wrote to memory of 3612	2264	chrome.exe	101
PID 2264 wrote to memory of 1364	2264	chrome.exe	102
PID 2264 wrote to memory of 1364	2264	chrome.exe	102
PID 2264 wrote to memory of 3316	2264	chrome.exe	115
PID 2264 wrote to memory of 3316	2264	chrome.exe	115
PID 2264 wrote to memory of 5604	2264	chrome.exe	109
PID 2264 wrote to memory of 5148	2264	chrome.exe	108
PID 2264 wrote to memory of 5604	2264	chrome.exe	109
PID 2264 wrote to memory of 3780	2264	chrome.exe	107
PID 2264 wrote to memory of 5148	2264	chrome.exe	108
PID 2264 wrote to memory of 3780	2264	chrome.exe	107
PID 2264 wrote to memory of 4436	2264	chrome.exe	110
PID 2264 wrote to memory of 4436	2264	chrome.exe	110
PID 2264 wrote to memory of 3768	2264	chrome.exe	111
PID 2264 wrote to memory of 3768	2264	chrome.exe	111
PID 2264 wrote to memory of 3552	2264	chrome.exe	112
PID 2264 wrote to memory of 3552	2264	chrome.exe	112
PID 2264 wrote to memory of 4956	2264	chrome.exe	114
PID 2264 wrote to memory of 3420	2264	chrome.exe	113
PID 2264 wrote to memory of 4956	2264	chrome.exe	114
PID 2264 wrote to memory of 3420	2264	chrome.exe	113
PID 2264 wrote to memory of 3316	2264	chrome.exe	115
PID 2264 wrote to memory of 3316	2264	chrome.exe	115
PID 2264 wrote to memory of 5552	2264	chrome.exe	116
PID 2264 wrote to memory of 5552	2264	chrome.exe	116
PID 2264 wrote to memory of 1200	2264	chrome.exe	117
PID 2264 wrote to memory of 1200	2264	chrome.exe	117
PID 2264 wrote to memory of 3768	2264	chrome.exe	118
PID 2264 wrote to memory of 1548	2264	chrome.exe	119
PID 2264 wrote to memory of 2124	2264	chrome.exe	120
PID 2264 wrote to memory of 5760	2264	chrome.exe	121
PID 2264 wrote to memory of 5760	2264	chrome.exe	121
PID 2264 wrote to memory of 4104	2264	chrome.exe	122
PID 2264 wrote to memory of 4104	2264	chrome.exe	122
PID 2264 wrote to memory of 4448	2264	chrome.exe	123
PID 2264 wrote to memory of 1832	2264	chrome.exe	124
PID 1832 wrote to memory of 4952	1832	RobloxPlayerInstaller.exe	128
PID 4316 wrote to memory of 2732	4316	YUMI.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\YUMI\YUMI.exe
"C:\Users\Admin\AppData\Local\Temp\YUMI\YUMI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd0c63c728,0x7ffd0c63c734,0x7ffd0c63c740
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,1436721342662501223,16901544190074900501,262144 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,16550321248258584300,12005612739529701747,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,8061810771957131279,12424796328057277011,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,8658051723671824458,7125243418427090664,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,3177727377143436215,10231924865616642404,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,6866180102061199844,10049919691920720256,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4900,i,11055321000072804532,10976816634657356561,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,2346455433710587283,18178742583223872656,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,6810408919537988656,14722499082107475597,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,4909996652361516342,13128311177928534485,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,7232724990625536570,11884078587947980659,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,1170667184454038124,7585144369428280673,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5580,i,10525974902970052401,11049176467544367514,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5560,i,8609775267168785351,15364192485998850915,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5604,i,14645549540806376715,2993131680764119568,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6164,i,5258915295902574380,2822646933152016807,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,7060201727004185257,13509704688475471870,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6128,i,9570967890197059831,17297402543932199024,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1515235950444688146,4530018220770476226,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5732,i,3229626477777917046,3350948619497525131,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:9
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5788,i,12507850703776359986,15170156260244384296,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5804,i,14101972568401198678,4982904533564061785,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,12720210932662724042,11714011578455808595,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,14827027724360557593,11194127467487183737,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,9501081812218062884,291155255558861381,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=900,i,1325875834662058633,5780231671575789293,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6360,i,3472059023366299674,17422673185059779760,2097152 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6676,i,9797647323782533355,15933235165352295101,524288 --field-trial-handle=1884,i,17235892698864905121,1797227538392847731,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:4448
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1832
    3⤵
    - Executes dropped EXE
    PID:1328
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1832
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3480

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5456

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5028

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2200

C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3052

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 14e3e506d5cccc03eeb3ae006f2d55611fb0af64ac8d176dd23d8a3966099b74
MD5 955fc4e7e130c59a820d08497c2140e3
SHA1 cdb7dec908c21bb2f36868df8f2e6b90b1902e6d
SHA512 1c0cde12f81564f720ba563be3f6ecb320da4bf4e36b67afe9e20512e0cdc8af5e23a8154a3c3616ea193cc78467d04d9fab35f068b49c745f66fb73f9f23dfd
SSDEEP 196608:WEItDe7ZgAgDLs5gk173msx1rO4jBI0pGU8xZ0P04KR:WiqAZ3msxhO2BIYGFg84M
TLSH
T1F7A6BE22BE00C032E8D200F2A6BD9FBA993C59341B7954D3A7D45DB95A305D33B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 6417d71533072b12043a9a0ae4084fc7f04754ea34914003aeb8ba4cfebba0ed
MD5 aa4d548826d9aa8ec371c0a3abb689b9
SHA1 a447ca0417be6cb27115eacc82881389f6e21137
SHA512 4d849b6e4d7974119b4572ae3e94c3ce1a499f4dd4d94598c02ca1a4b4018aa5b713f217cff72f7620e73a57ff96fb2cae67b5fff1ba180f0e8566c504bbc376
SSDEEP 196608:ZX1oy0IyVwmwHV7GRt94O1QojO2LIkyGKgz5Rs:FFVmSV7G6O1y2blz5Rs
TLSH
T1F027BF0EB4D206E8C5B15070E15F63D3E672308C0BA96EF746D902213A73B9DA659F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 1429e4417b667f437dce4c54c873adacaac70cedbd5003481bf55595eaf590e5
MD5 aa6e479309ad952c1ddf27b44192c992
SHA1 648ce8931cf318f18299258b5b269645c8584eaf
SHA512 020d7624d2e99147feb47c5895ff894b752a32965e2979badf61bbb73e78a2bbc9bebe04052647f59701f0bf62015f94be5ba6af832eaefb58c4f61133a33d71
TLSH
T1991142832AF2F033FF471E3371D44B38245C9AE740565A9BFD80C55865173A6E05C408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c6b0e52d8a440a083ee2bee127d54c1ba24ad13ac67861b0aa39322b796d9d53
MD5 b04ce29f61e7b5626ad28ef042fc74fb
SHA1 fd7f73aac38e769c84654fe59b7699af13347bab
SHA512 f22c4715f227bf7ec3c8c3e1a414f4d8909e4cc6492e6750f212cc25a415bc9ce5f5691b72bc6582bd2268830a9899dbe654b15a8c6c660274713f4cb657fcb9
TLSH
T18BC0122C90B09843DF2D0778215948FC73DC1F1801A331B96CF2D16CACEB391E0B2586
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 75b5814dea407f325fa081c28b115c544df5a1ac2c738a4e39eb31a6627a8088
MD5 544a4b9c441963e4a85efe151616beed
SHA1 97311a79285b64ef3df73e2503ea7f39fda2b4f3
SHA512 83ca589cf8be51ec18e627ef8c308359e497981a7678af32524a007ccf3ef6ee889cb4c04299423112ffe819d3bd40024a516a74a67b87a2fc97dab3d09493ab
SSDEEP 192:D4C5Jf3BxKJf4x7kJRRIfNkkfNIpNPQaPivCfPLybblh+HxK:D4C5Jf3BxKJAx7kJRRUNkkfNIpN4a6K6
TLSH
T170F18FF7C3D8C62D891156F49B15AF1FCE291A24432C3C26C9E4BE5B93E2871E21164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 316f3906d5433e8a6cf719045bc4c9c97af539a62bae982749b2c63a37fdf6b8
MD5 4c4d47d755cba67587ece1f73309d6bc
SHA1 ed391832838f6a7fc368740e9157f56aebeaa420
SHA512 e09945ac47b94c4f9a1bd6a563f974ab04c499d1c87e6adb3fb366c66a8a84ef71410a3950ea96eda450985421355ee36a1a7e6c82aa668fff39282421c70fd3
TLSH
T16A8181F7C3D4C62D881156F497256F2FCE291A24522D3C66C8D4AF5F63E2472D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b00b39b2b1ce29078680be39cb2de61e0e2344aecc0d656b00a7209a5edbbe42
MD5 9b0262503b8b97b03f72ba7b195a2a64
SHA1 036a4da1dce426015ab13a00f2235e3d6ce3ebd2
SHA512 87170e83812745886e72e033406e938df31dd0f7f65a5cde311823002327a4d140e0c0fb66a7806871cccd19b5ba7079f138fe22bed25ea5f643be9fd8cd6354
TLSH
T15331B05BF5FFF42F1079D5671D00F80659BAA83201906DF0DF97816DB48A6F70716016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bae387aac447c59dd11524791ee9fd249fabc8968ebb96e9bf3a79d7c434b7b2
MD5 c427cb045f244c882de4f5803f8190fa
SHA1 ff384ab95fad5bf130ee2f60effd4909bc7d8876
SHA512 eaa6723a59ba2460d3a72f1a37a34706de1915c6baa445cfe3dad53840eb2eda823137a2eb3efc1665c38c9f68c6356e8703406b8fb452e8f834e74e52619d93
SSDEEP 192:wRVXWXYnv72APRp2Hj9zHsb+WNnZG0TyeA+VyIsnAUge:wRVmovTXglwM0k2e
TLSH
T19432826DEE14757B5CCBD22AF9217B53E6F5102271D12E84EAF8892C11EB6CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9534c23897a6880f1e05bf669ac3fa8e99d9c0a2c38fdaedf6024beb61624430
MD5 d2d361a1ddea0b6331a95964cff20694
SHA1 f842b923a73611976f3255023e201d53580fa103
SHA512 d999301ba204cd631cb9bd3726dee9d8b0c6a2e3ff32422441871a9ed5144af19616addb7f42ff73657da2f2663b2a178d0bb2a31ef455353139ebf3fd014d82
SSDEEP 192:wRJcBzXWXY4v72SPRpXHADw9zHsb+WNnZG4KmC1gp2ye8+VyIsnAUgE:wRJmzmokdXPlwMJrgpF2E
TLSH
T14642B46EEA14357B6CDBE21DF921BB63E2F1102261D12E84E6FC893D11E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9c173e1ea93c5d757264f4121f66670acb85708309d2db7b511a9e573020be17
MD5 efc0ad8f6130f3a6b36a7ddda86ad0dc
SHA1 793c72f741f1e7bba2e43513d6e1f40d37482e6f
SHA512 6d7525d47eaf3da55a0ca7886c3cda8143776a3f676922eb170946e2d0829bea78dcb2f9b08094978daec11633d7a5c3e3637ea338828131feba04d40bdcc0aa
SSDEEP 192:wRJcBzXyXY4v72SPRpXHADn79zHsb+WN2jZG4KmC1gp2ye8+VyIsnAUgE:wRJmziokdXwlwpJrgpF2E
TLSH
T19D42B56EEA10357B6CDBD21DF921BB67E2F1202261D12E84E6FC893D11E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cb14144ef2f559bdb57f080d2cf8f6fd15e45628f9ae01cbc388bf00103ac9e1
MD5 da76035511753f9abb775b8f8ad8ab93
SHA1 8e71a9cca82a2807653cee0dba4ef0a6d95a784b
SHA512 4182cb2622ca9e464512ee72b57a258fc80ca054d5a9d4a2a040a4974a28983e3e458b32984caf1a73bc38b9721c4ece9ce5bfe12bddbfbe4e4542fe98144758
SSDEEP 192:wRVXWXY6v72APRp2HA3/9zHsb+WNnZG4ej2tyeG+VyIsnAUgE:wRVmoWTXxlwMh202E
TLSH
T1AA32A36AEA14757B6CDBE219F921BB53E2F5102271D12E84E6FC892C11E76CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b3132f7488b3e6c568a7b40c2f478c934a1e39990dbf87bc0ef7f26c3e45222
MD5 bec169c3452ba3897f4863fe72f31e3d
SHA1 295002e4fa58130a8e465a7db9360253a2bf1514
SHA512 46f1d6b2ebd219cb3fa00d0760e166cd4502aa3be709767bfeb668f002cb02d2c3c75fb0066503ae51c31a7ad41cc4a0a9bc01d7d26d42fed29f8cb05872e12f
SSDEEP 192:wRVXWXY4v72SPRpXHA3/9zHsb+WNnZG4pmEiye8+VyIsnAUgE:wRVmokdXYlwMhEJ2E
TLSH
T13042B46EEA14357B6CDBE219F921BB67E2F1102271D12E84E6FC893C11E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 6d0897c3b294694bb1bfcf09ed5b6a37d3f5a5de6b71208b0dec1e127179982c
MD5 a53f819afe8ad6dd0a53def96645b4d1
SHA1 1ef02585b9d83b05931eff5bd044ba7fba8b04fd
SHA512 448acc4d4e97acefc2986d00a92da80027e5dc3bfdc8a9c690597c28f4d8a905145030b17478399c8d96bc68434c67dff8be3a6270b8c91cb16e0eeed796d909
SSDEEP 384:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNXODKF+ErU3hcHG5oI67:GoKF7KxkXqKf/pUZNCgVLH2HfgsbpO+f
TLSH
T1E752F727A84C9A7F4FD8D688DC166F4FADB502466268492897FB9C0803957CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 889209227f1c7438ab7a1d1f477026673a218bb7645a7406561f26149dd53728
MD5 4de6af492699e0a3ce70cfaae8e83080
SHA1 5c0b0edcfd7dd0393a2d86091f6c2765d76ec555
SHA512 c0fab83ad132ce25c8bd2f5c4426b1f86894bf9a1fa2f52d3e86b06014484834dde63100678e9052531b28d47e0d9d1e086d909a0b90dc9791b57c7a356e3d92
TLSH
T173B0110A00C00A83E8008E3A82C888F033280C20C323080200A0A0A8803228ACB8BA02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7bccbb47101ba203a9f9f3dcab94ebb1592e88f8a278598ebef5945b5bdfb681
MD5 240893b7531dfa4516b39704d8e70326
SHA1 83442e2a11649011f7f23b507e35d9f91557ce74
SHA512 9ffc15471784a7530dcb753199e43e41cf70af658a1056be4e4f5e8f9785fe69bd4d489ee7add408f897f96cf345b8667efecdf8d32b437db149a17f983ceba7
TLSH
T1F0A0025061D00852ED04827470F585622F61896969A2A75374D1F688889BEC1C205180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a17b0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a17b0.TMP
Size 48B
SHA256 377a4a1c9a6e80c2e6cd2d098cef646c48021d9b236ccb5a65b0a78bdb92a2eb
MD5 f97a54992405bb7802b1a47ce221bf68
SHA1 19dec3a8e6456cdaac74b2e5750ee605b222072d
SHA512 26d062f23a69b9fb8389f6a4ea746e4c2380c48136022bccc11886e809f94d15a335cf8aba97bd1ec2b9c75a29cab53dfd8ef5b4214c8ee28522b53e1cda3a75
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b63b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b63b8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 f44efedaea741eca2c9fdd8f0def4d8661ce7751093a3640c364abe4154bdb8c
MD5 648602c80d2afdb2cdfac657ef7eefd7
SHA1 f8fc5e41d357ab9fa9a9268be1bc36a985f585cf
SHA512 84a8bc29a6269da021ec856dcb84b3ffc244c5ce6f7a393bad927492aa7986852514a1014045b5092929a1179086d14849c231bda0063e216ca3bfdc99375015
SSDEEP 3072:TCh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIb:TCaG4pEejPhAIuNWmTETIIb
TLSH
T1FDD312362E6D9279CF9E9239A25725262C484CBBC8491BCC19CC1ECF549B5885E3FF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 345501ea6a6d736538b69d29f44d406d5eb4fa7a14857041d8ef0dbc8379ebda
MD5 809e8530ab7262d9cb1735e7c710b700
SHA1 e2634a395cc0b9d11d79bada4bc5c04a3c93b33e
SHA512 fa1441d9765f1c9dc38c6b830bacd89a99cdc0435eb7bb9b436fde5187df18e2451a1e68b4c6754a1d5dff9576b0e87e79236f920f84effee4f27bb535846e8e
SSDEEP 3072:O6h4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIb:O6aG4pEejPhAIuNWmTETIIb
TLSH
T17CD312252F7D9239CE8ED23DA267152A28184CB5C49A0BC419CD1EDF54DB5845B3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 7dce5fe83465c235b7497309ed8629cbb45e59b35684636bcea8698119d311cd
MD5 0f2f4f8e9451f3d1cacf4c97b63ed9bd
SHA1 0a7dfa797356f377ea65cea4aa1f236d374adf8f
SHA512 fd4ed53c35551a0671a89e859bc530bd20e56d704de4490b18f561100455412fdd76ef4739e1bb83e441c08478989b50f7ad38129db4dad841fd92159299582d
SSDEEP 3072:T6h4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIb:T6aG4pEejPhAIuNWmTETIIb
TLSH
T15CD312252F7D9239CE8ED23DA267153A28184CB5C49A0BC41ACD1EDF54EB5885B3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3a4b8ae8f7fcae4189a18890893ee0f4113651fa6765b993612e05183a7664c1
MD5 e4563e86d8278c9b9611dd0722e1c89f
SHA1 0b683d5781dd1641ded761f3997efd31b471a86c
SHA512 e7d2522958714a7b311e6f9fe0e9b412a759905f94da5633f5c0498c2c7c49cf147a380b0ec8620da42e8803658da872ea824c5ca0cfb9b442c4263abe626b3d
SSDEEP 96:8C6xd+2+07WJ3aJPWyqgfdfrgnRDotok564DNB6FJGyvQCl47Y/ZPE4/Rv4a:8CUd57WJ3aJ+yhYDUDBTS0rY/ZsM
TLSH
T179A107B0B4795D3794FAD986B9027E03DEE8A15BA560AF94D8D90E0A20E70EC0357523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 5cda9dda293310224c444ff8fc0e1d6d7c3e494cf556f263d09f496e8bb474b6
MD5 1339dabb5621f92b2046cecef781f58c
SHA1 4b1f56b1b9f0d71306d911c6e1b526790fb9b478
SHA512 6c0cd9f4a0f908f5745bad1b8fc94a7fc6be5229ec12f564725c87de2a2a3782081d4d5abb273b388f43fd6e12c2abf89af3aaf79a001723c2832ebf2bb3d14a
SSDEEP 3072:Tkh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIb:TkaG4pEejPhAIuNWmTETIIb
TLSH
T133D312362E6D9279CF9E9239A25725262C484CBBC8491BCC19CC1ECF549B5885E3FF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2264_673645059\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 12.9MB
SHA256 0c46c7041e530a39483f7b2c956811aad71e2c9c3f2c76d1a826867e2e50946b
MD5 8b59097de0f1a00833610261abc9d25c
SHA1 f695b490b69f7feb6cf752be2a5384315646584f
SHA512 0be5618cc568d9808defc3b732222f509f5f6a09ea9b5f0d353946281fe1a1c6a7c829f480425c61f649279a8a67ab62669e873a4fce613bd0b4424c91ea9e03
SSDEEP 196608:9saZFAPLVTWdfAKCF797jAA1Wlm645lEqfR2dE:2IuVTvKCFBjAoWlmE5E
TLSH
T130D69D6AB2B800E8D4BBD178C6565617EBB1741603709BDF1AA086F61F63BE01F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download