Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://www.roblox.c...

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://www.roblox.com/home
  • Sample260703-xprjfaex7x
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.roblox.com/home
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe603cc188,0x7ffe603cc194,0x7ffe603cc1a0
      2⤵
        PID:784
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,13205514919337351620,9569377719941041042,262144 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:2816
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,3493600019782138988,6446996337812630537,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:712
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,15278868810523101568,14639713808430904925,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
          2⤵
            PID:1244
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,10807305402716659037,15495257248245680942,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
            2⤵
              PID:4556
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,14242421300055688948,17627308221931936771,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
              2⤵
                PID:4388
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,15725821851108286663,4940397706427513038,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
                2⤵
                  PID:5216
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,4855023451475415267,2101248700157674718,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:9
                  2⤵
                    PID:2660
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5360,i,12684615204123102521,116447627007494005,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
                    2⤵
                      PID:2028
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2940601167592279916,1182359132507844499,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
                      2⤵
                        PID:4296
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,3355298713761261398,8380964262560090112,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
                        2⤵
                          PID:4812
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15162985780883277761,1503658956811999094,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                          2⤵
                            PID:1844
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15162985780883277761,1503658956811999094,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                            2⤵
                              PID:1324
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12637774433098011442,12615811791705923319,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
                              2⤵
                                PID:5164
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1043736662299932368,16595810535743262655,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
                                2⤵
                                  PID:1364
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7587363611643862314,1185212010553040918,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
                                  2⤵
                                    PID:3432
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,658192978081156649,11247205352103689004,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
                                    2⤵
                                      PID:3608
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5176,i,17660188489064376639,14923719722463435637,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
                                      2⤵
                                        PID:1132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5576,i,8869294200434746037,13187730973442199995,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
                                        2⤵
                                          PID:2208
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5288,i,10858102252361229220,520017148124479169,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
                                          2⤵
                                            PID:4160
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7044,i,2710923038871875257,10960430439912252407,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
                                            2⤵
                                              PID:2544
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7056,i,1017033116960764568,15942130772429563138,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                              2⤵
                                                PID:5776
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7296,i,5678599663346167563,3911049205349537489,2097152 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
                                                2⤵
                                                  PID:5220
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,3056679516389116044,4914008635027028756,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
                                                  2⤵
                                                    PID:1536
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,9878522563547873679,11977819945890501249,524288 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
                                                    2⤵
                                                      PID:2872
                                                    • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                      "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Enumerates system info in registry
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1776
                                                      • C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
                                                        "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1776
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:852
                                                      • C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
                                                        "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1776
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4912
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6896,i,15354341298449827493,7033790647507886992,262144 --field-trial-handle=2232,i,11749829608514486017,12987150323685257615,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:10
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:252
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:5284
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:1316
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                        1⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:1528
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                        1⤵
                                                          PID:3296
                                                        • C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
                                                          "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:924
                                                        • C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
                                                          "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2212

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              RobloxStudioInstaller.exe
                                                              • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                              • Size 9.6MB
                                                              • SHA256 4fb6633176abb8d1be846cc49d65bf4a4a358af81b750bd2bca87604fdc98dd7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              RobloxPlayerBeta.dll
                                                              • Path C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.dll
                                                              • Size 21.1MB
                                                              • SHA256 735aa9c8dde82f0d8aefd1aced464df2e0ca44b9b3bd23b15737f670d53bbbb7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 9KB
                                                              • SHA256 abad0fe015afa977ce88b660b584fc425d7e6f64bbb0c04939b148742abf32f2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index~RFe5a470d.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a470d.TMP
                                                              • Size 3KB
                                                              • SHA256 1f425d15711ae3949b66fea7976a67b92da89fd726d318a0ce8ccf400ae53c47
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HubApps
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                              • Size 106KB
                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MANIFEST-000001
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                              • Size 23B
                                                              • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 8KB
                                                              • SHA256 80cf93ff7ff7a2c3d1ffbf290056351960a605c6053d5752aea0b26f9fc58378
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 9KB
                                                              • SHA256 5daf85e5aa429b4e80e081e45429c02236404d45e37fd9d096fdbb0cb28ff78f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 1KB
                                                              • SHA256 5cc0e829132360846873b9cb0e10b25aa7448a53c37a81ca5c1e45abc5f34bdb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 211B
                                                              • SHA256 ea0bfe624c6c2542353a9909a5bbf2ce54a5e03cf74b7f46ef3f5e36352210dc
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 90e8436192fea31a978024af1bbfad95c85e59a501caed51668a6728ba898637
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 16KB
                                                              • SHA256 262a74f9be62ac7147bcf6e0d4156ae6fc88f9f26f8b0df10750ebdecbf49588
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 19KB
                                                              • SHA256 fcf61d14e4631db967ff52743e880b6969a77f4f0197c05df49a03a88553aa77
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 854dd7c1494ad68d5ed1788e1b3daf4b222c09c70a003a222fab959742d83db1
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 91e5d0cef2480ef0af07921a3afab593ffdfc0e6a0fb06ef347c36f787a32465
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 19KB
                                                              • SHA256 7ee32b2c439ad127bbc29a5fa6f4105cef5867e56bd060d6da8ee64bde7f5da8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 27KB
                                                              • SHA256 4aeec333b12420b01a8ece7207f2d7bdbfc0e23ea2fb2b10aae5214b16773330
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 c5dc05c6ddad34c3c0f04891914f8979e15986a474bd8fbdcaa48a20485fe324
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 c279ab63c2f091d45d403417ee60d872adbdd58658ea1f2caaca66e7d14ddd38
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 6ce532b6a1fcd037312bd515f4d2f7807c2e46593c71cf423bb11f2e8b4787a5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index
                                                              • Size 792B
                                                              • SHA256 23dd06b949e9b37b24d7363572bf5ab1495a10aaacc3b1ce36f3d293cb316fb5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe59888f.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index~RFe59888f.TMP
                                                              • Size 792B
                                                              • SHA256 ed572d077c4d2069c869081ac4c5ff9d748ee5bafefb3cae9a87ce598e06416f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce8f32e1-1438-430a-98d9-b9f0431b0a78\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 9a7dcc280a7618ef0be2f715ac5d4a35bc78e633ed8aaaf0bcfcbd112b98105d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f7b1a8c5-3dd8-4b9e-85a7-72c8a520509f\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 5bb8141694aade1c567f70402d1fa7acc89e343935d74314fcb855648dcd607f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5a2b18.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f7b1a8c5-3dd8-4b9e-85a7-72c8a520509f\index-dir\the-real-index~RFe5a2b18.TMP
                                                              • Size 48B
                                                              • SHA256 6f388dbd7b889cf0276e9f10898d0021edcd319ed6a2385644c4d96bc1e2bf7b
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              index.txt
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                              • Size 481B
                                                              • SHA256 07ef2d8cb7ce0cd81bb28aadad1a537bad1413ccc81580a329a006bce830780a
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              index.txt
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                              • Size 476B
                                                              • SHA256 1cc47896b03a74bbcc69f3de2605877ac42ec9844b1c58f947fcb326f96deddb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 ff6e1d1a8ea1c3f19c35644c3339087b0bdfe448a21ad556c02341476b78a188
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe59dd37.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dd37.TMP
                                                              • Size 48B
                                                              • SHA256 504d4e2a8de5865b04ca17de65e24c97ead32584fa22cb4ef5f4b6adacf7d88f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 4KB
                                                              • SHA256 e091fd0997652659c7c5a4f8db734d8df878e90633802592275224ebeccf4efb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              CURRENT
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                              • Size 16B
                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              MANIFEST-000001
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                              • Size 41B
                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              6748709a-eabf-44ca-9a84-fcbf24a29bda.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6748709a-eabf-44ca-9a84-fcbf24a29bda.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 35KB
                                                              • SHA256 7163b4c17a46491161c0a169ff25f54f43291452edc78680cae109077d9d8d90
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 43KB
                                                              • SHA256 c160a759c7da62e6b10091296e552702994790d14f8f28b3133c39f35fa81ad5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 169a89b26c0a63c9fbc84dd27eef8248fe17bc222bb0cb4fa26745b52350b934
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 35KB
                                                              • SHA256 990ce0b35cb88ffba4611aadc40f32abcd41643ad45ab72d5a54bce3e8cb902a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 545b8a9f9574af4e344389a3aea253fbf09d5de05f742be315ae834c8ccd37ac
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              RevisitationBloomfilter
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                              • Size 392B
                                                              • SHA256 8f67d3078c29ce6f4580af95b0eceb769425580f40a90690e38d8ca7f9578347
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              RevisitationBloomfilter
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                              • Size 392B
                                                              • SHA256 1a19c3bdd6c12384e03a7fa5f61de3d6886c613b1d548b8c2f34fbb3f38fbde4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              RevisitationBloomfilter
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                              • Size 392B
                                                              • SHA256 f421ff1b9cd69e5bf8f345e3ded380e27dc8e198a748779ac302f8bef8310614
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              RevisitationBloomfilter~RFe599774.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe599774.TMP
                                                              • Size 392B
                                                              • SHA256 938e454e4e641390f12d8e829e06f0944c42151c4d42316fd7499c2007c59065
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              4cdd8bce-d059-4bc6-803f-92ff042e6986.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4cdd8bce-d059-4bc6-803f-92ff042e6986.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              RobloxPlayerInstaller.exe
                                                              • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                              • Size 9.6MB
                                                              • SHA256 c377f327acf6f974085678aeb267ef49caf229abcc290fcbcaa88d3c5b28d571
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download