Analysis
- user interaction
yes - max time kernel
900s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 10:20
General
- Target Madium-Installer.exe
- Size 843KB
- Sample260623-mc71jscs3s
- SHA256 5d48d810f20c0de47ccfc2e4abd74777f7540620b9b5e5c3057b45ab238ed23f
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 28 IoCs
- Loads dropped DLL 11 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 17 IoCs
- Modifies Internet Explorer settings 1 TTPs 18 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2560.6120.5944253592098041029 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView /prefetch:4 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c04 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdd03a5fd8,0x7ffdd03a5fe4,0x7ffdd03a5ff04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c04 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4612 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4316 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4852 --field-trial-handle=1680,i,1868579002345032526,6509752956556409504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c044⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffde545c728,0x7ffde545c734,0x7ffde545c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,9687969476369807072,2378507497069863716,262144 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,2033066937194537683,8292434996995373769,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,13128639209971857342,3079617629542453664,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,17853534546520379507,9368749891824370188,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,12874064161663895264,6279392076640591531,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,18349903417112424936,10411207474811389130,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,9519594168171328830,4775390264036707276,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,3350380672749933678,15190515032117316049,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,17828950297804975444,4402636136933365767,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,7453599275336589507,10837940278103203464,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5420,i,2187719724126230516,3641947539846037938,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5460,i,12336560042063426421,10140857236740334587,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,17966757400823895241,13340789354641109860,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,11235517503351187461,16104839888563821619,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5964,i,9417038892581784657,17156653766414499303,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6220,i,9436940444534820418,15124342992631785647,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5464,i,11682391053920931438,5851733712745633488,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5668,i,5092903685526529880,16095350853453430760,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5984,i,13674000792176033289,16999051860326733017,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,15244984544031988183,1071778473766666524,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5716,i,2756645993308072705,968239445711198067,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,340681924675003331,17999155014494956460,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6332,i,16168974222290970196,13383855461103511126,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4820,i,8338932858415629693,8932767163113887053,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,11683092088740435849,6328481222160970613,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6404,i,18264741460736367243,1996803082962051265,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6476,i,8312099350513142016,2371585545757586861,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6716,i,17751551874411950295,3171270819925692375,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,10428050055610289162,13590790275986419541,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 7723⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 7723⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,9865713446533109143,355900518915828006,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,10258890774646266019,348795215132210407,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,7501159266893633086,5090060403820934797,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 22763⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 22763⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5564,i,422134224417716961,7629818300957479831,262144 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,7713324429998719630,3221345448037571330,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3632,i,3044421058925988829,98738324333731524,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6100,i,9761105902499062626,1839404544446581976,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7096,i,1945192256354509999,13731028548524571618,524288 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4784,i,998062645462345342,9324894787398761808,2097152 --field-trial-handle=1948,i,5925406181041897216,10020843865919326466,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:CZuWxfNm11xl_rcytaLFu3RZFVOgzXG6R_T21G1h41H3BOiXIwNRcIQLLeNwFazi-d4NPta4-MgjfajaqNfbMHvdFarG6mVtd--uhtNU2mCOe-MGD8Y0SawGjO_pXA7K-RS-Uml2HBdiqbg5vj8llzp5atzupew_IXlN_qW3tx7b6qDBbj0p6CG69szwiQQFwRngX-MNRkHgImU-FY2Teq0WqT2mCjEwH9_eke7lEDwB_dkW6K7Pb1Zwv9lxuPvllOumLWVgZfo2WHNvnIX8QXheYvfEfKyGudRnWs2hr_jTrSdINvgEKDPAcRwcGkLL20ULuf0lIVt9EtTD1NFUzAa4GcFptifI1RV2u1xuP9UL56O99waNWNe-YTKT9Lt9EEbRH3xzpScvJoUiynBqzEL8TZlid6JCx2iNhJp695HoB0VoTLQBCpJfcFcR5vo4-sdbZtiwk1zJBrcYS8qPG8_g0InFNYk7Otn5-AUR13Sxu-im4DOn1NuqhRS0IdM3_srsx4IaKLsZjRVNDoZmtdkKn9DarVTq3b4BSJHSniI+launchtime:1782210653792+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1782210310534002%26placeId%3D5972698540%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3De6f83576-48e1-49a8-9104-5225b8771e40%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1782210310534002+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:CZuWxfNm11xl_rcytaLFu3RZFVOgzXG6R_T21G1h41H3BOiXIwNRcIQLLeNwFazi-d4NPta4-MgjfajaqNfbMHvdFarG6mVtd--uhtNU2mCOe-MGD8Y0SawGjO_pXA7K-RS-Uml2HBdiqbg5vj8llzp5atzupew_IXlN_qW3tx7b6qDBbj0p6CG69szwiQQFwRngX-MNRkHgImU-FY2Teq0WqT2mCjEwH9_eke7lEDwB_dkW6K7Pb1Zwv9lxuPvllOumLWVgZfo2WHNvnIX8QXheYvfEfKyGudRnWs2hr_jTrSdINvgEKDPAcRwcGkLL20ULuf0lIVt9EtTD1NFUzAa4GcFptifI1RV2u1xuP9UL56O99waNWNe-YTKT9Lt9EEbRH3xzpScvJoUiynBqzEL8TZlid6JCx2iNhJp695HoB0VoTLQBCpJfcFcR5vo4-sdbZtiwk1zJBrcYS8qPG8_g0InFNYk7Otn5-AUR13Sxu-im4DOn1NuqhRS0IdM3_srsx4IaKLsZjRVNDoZmtdkKn9DarVTq3b4BSJHSniI+launchtime:1782210653792+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1782210310534002%26placeId%3D5972698540%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3De6f83576-48e1-49a8-9104-5225b8771e40%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1782210310534002+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=468.2120.16424841331396945879 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c042⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView /prefetch:4 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c04 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffdd03a5fd8,0x7ffdd03a5fe4,0x7ffdd03a5ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3632 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c04 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3860 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4656 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4732 --field-trial-handle=1792,i,6262192127832209953,14411304846395550651,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f8bc9330819d2ef6b395d44327ed237f3af8c043⤵
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerInstaller.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxPlayerInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxPlayerInstaller.exe -relaunch2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 50883⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 50883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8884371d30284041\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
RobloxPlayerBeta.dll
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
8b57dad2-dec7-4d11-9db8-6a4301d6d4db.tmp
BookmarkMergedSurfaceOrdering
f_000009
f_00002f
f_000036
f_000053
f_000054
f_000055
f_000056
f_000057
f_000058
f_000059
f_00006c
f_00008c
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
000003.log
LOG
LOG.old
MANIFEST-000001
69b18ac5-9398-4852-9c2e-ad34fc795471.tmp
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5c7007.TMP
index
f8b3ddae-0592-4776-b5f1-52e31779e780.tmp
Local State
Local State
Local State
Local State
Local State
iconcache_idx.db
iconcache_idx.db
1d0390337d1a4a58e5514be1a9481ad6
7071af81f7fad1d26ec29b7699f2d96f
82749026fce27062a4c968059ffce7f7
aaa5092ef5ba9e846ab7764cd269ecf0
b28a43281e4b17e26084470fb18e587f
e2f08295f4cf8a1c13df5bee365c90c6
cacert.pem
8913724486d5e3c463c493b25346ca31
messages.json
settings.dat
settings.dat
settings.dat
settings.dat
throttle_store.dat
0a9147f6-2be0-40ad-a08f-60d70ae09af6.tmp
temp-index
the-real-index
the-real-index
the-real-index~RFe58a8dd.TMP
81ba964d-2df5-4c56-b0b7-07b2ee4ff639.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe597f0a.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity~RFe597e9c.TMP
Preferences
Preferences
Preferences
MANIFEST-000001
CURRENT
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5857ef.TMP
Madium.exe
RobloxPlayerInstaller.exe
Staging
hyph-bn.hyb
hyph-mr.hyb
hyph-nn.hyb
memory/464-3393-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3385-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3389-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3383-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3390-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3391-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/464-3392-0x0000020D2ACC0000-0x0000020D2ACC1000-memory.dmp
memory/1132-57-0x00007FFDF7420000-0x00007FFDF7421000-memory.dmp
memory/2712-525-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-528-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-521-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-519-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-530-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-529-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-526-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/2712-527-0x00000292A9780000-0x00000292A9781000-memory.dmp
memory/4236-321-0x00007FFDF7420000-0x00007FFDF7421000-memory.dmp
memory/4236-322-0x00007FFDF6B30000-0x00007FFDF6B31000-memory.dmp
memory/4768-3-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-11-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-14-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-16-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-12-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-4-0x000000001E900000-0x000000001EAC2000-memory.dmp
memory/4768-5-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-6-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-7-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-191-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-8-0x0000000020A70000-0x0000000020F98000-memory.dmp
memory/4768-9-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-10-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-13-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-1-0x0000000000EA0000-0x0000000000F78000-memory.dmp
memory/4768-0-0x00007FFDD5AEF000-0x00007FFDD5AF0000-memory.dmp
memory/4768-192-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/4768-2-0x00007FFDD5960000-0x00007FFDD6304000-memory.dmp
memory/5304-145-0x00007FFDF7420000-0x00007FFDF7421000-memory.dmp
memory/5672-3753-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3755-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3758-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3761-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3760-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3759-0x00000241A0F00000-0x00000241A0F01000-memory.dmp
memory/5672-3757-0x00000241A0F00000-0x00000241A0F01000-memory.dmp