5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
weblauncher.exe
Size 13.3MB
Sample260930-srpemsbd37
SHA256 5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181
MD5 7d99b702bcd90ba66a84ad53f636550c
SHA1 a61fbd6769615902b83ea2ecb94b0296de9681b4
SHA512 7cf5910ccdeeea03ddaec1e3916f5fd78436a84af18dc5f7244801c9047e61ac34fd291338594a654b9e67a2c8035435e43af606176390d51814c33d708c4253
SSDEEP 98304:UiqMy8ptSnCzJuT40LcMj4Kkz8qqoTqupR+Ui8t+PT+I5GYHasdKl6ED2+BaVjbC:UNMDJcLcMsX+tdKqefFRL
TLSH
T108E6F6217B5E99ACD19BC47483874A72497130CB0B35B9FF449496382FAABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5792	RobloxPlayerBeta.exe
3288	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
3288	RobloxPlayerBeta.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	weblauncher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5520	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3288	RobloxPlayerBeta.exe
3288	RobloxPlayerBeta.exe
3288	RobloxPlayerBeta.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1888618841\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2112386961\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2112386961\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1888618841\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2112386961\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1987038445\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	weblauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	weblauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\weblauncher.exe\" \"%1\""	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\URL Protocol	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open\command	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\URL Protocol	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell\open\command	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\shell	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\ = "URL:roblox"	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\weblauncher.exe\" \"%1\""	weblauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player	weblauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\roblox-player\ = "URL:roblox-player"	weblauncher.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3288	RobloxPlayerBeta.exe
2760	msedgewebview2.exe
2760	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4224	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5520	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5760	weblauncher.exe
5760	weblauncher.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5760	weblauncher.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 4224	5760	weblauncher.exe	90
PID 4224 wrote to memory of 4348	4224	msedgewebview2.exe	91
PID 4224 wrote to memory of 5364	4224	msedgewebview2.exe	92
PID 4224 wrote to memory of 5364	4224	msedgewebview2.exe	92
PID 4224 wrote to memory of 5364	4224	msedgewebview2.exe	92
PID 4224 wrote to memory of 5364	4224	msedgewebview2.exe	92
PID 4224 wrote to memory of 2384	4224	msedgewebview2.exe	93
PID 4224 wrote to memory of 1140	4224	msedgewebview2.exe	94
PID 4224 wrote to memory of 1140	4224	msedgewebview2.exe	94
PID 4224 wrote to memory of 1140	4224	msedgewebview2.exe	94
PID 4224 wrote to memory of 2024	4224	msedgewebview2.exe	95
PID 4224 wrote to memory of 2024	4224	msedgewebview2.exe	95
PID 4224 wrote to memory of 2024	4224	msedgewebview2.exe	95
PID 4224 wrote to memory of 2024	4224	msedgewebview2.exe	95
PID 4224 wrote to memory of 2024	4224	msedgewebview2.exe	95
PID 4224 wrote to memory of 3372	4224	msedgewebview2.exe	99
PID 4224 wrote to memory of 3372	4224	msedgewebview2.exe	99
PID 4224 wrote to memory of 3372	4224	msedgewebview2.exe	99
PID 4224 wrote to memory of 4260	4224	msedgewebview2.exe	100
PID 4224 wrote to memory of 4260	4224	msedgewebview2.exe	100
PID 4224 wrote to memory of 4260	4224	msedgewebview2.exe	100
PID 5760 wrote to memory of 5520	5760	weblauncher.exe	101
PID 5760 wrote to memory of 3288	5760	weblauncher.exe	105
PID 4224 wrote to memory of 2760	4224	msedgewebview2.exe	106
PID 4224 wrote to memory of 1148	4224	msedgewebview2.exe	110
PID 4224 wrote to memory of 1148	4224	msedgewebview2.exe	110
PID 4224 wrote to memory of 1148	4224	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\weblauncher.exe
"C:\Users\Admin\AppData\Local\Temp\weblauncher.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5760.5920.1124635991184124033 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView /prefetch:4 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x194,0x7ff84ac05fd8,0x7ff84ac05fe4,0x7ff84ac05ff0
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4488 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=816 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1780,i,1783700570101830377,10845172422354618054,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ec92e6eb015b98a19db4fb2eb6681b6bd0ba786
    3⤵
    PID:1148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Users\Admin\AppData\Roaming\weblauncher\core\roblox\version-2366ba214ec740ca\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Roaming\weblauncher\core\roblox\version-2366ba214ec740ca\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  PID:5792
- C:\Users\Admin\AppData\Roaming\weblauncher\core\roblox\version-2366ba214ec740ca\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Roaming\weblauncher\core\roblox\version-2366ba214ec740ca\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cf2b6c1ee9400ef80451f80be9623440994d8624c8d48bb1e036127ce60672eb
MD5 f1a85c9c6feb961561b12561c10c02cc
SHA1 a97361e950872d48b81ada96182cd9a6618e47b5
SHA512 f7b50b004cf5268ed9876a54a7ddbcffe1f8b74b76ff179e625d567c3b1706991e336b9c1a59e8531efb8494d9a055d50b8a1711ad70559acf95134032a03093
TLSH
T1D5D0126332028635C01024732192A1080404C20F40198242646D8A5D5B080500E4A851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3e1a33caf9b70a57439962d294770b2cd6ab7984d4c972bbb958862bf41e09a
MD5 2df101540f37f3c12866158d3df8c17c
SHA1 8a748846e4e6122ca4770093fe985e769fe5ce1d
SHA512 2bc56cbdb238dfe16eb4d3a3ad837741918065e2e9334abec562b223333888b33f9c8d42bbdd8122f35c4cd9de30497a6e1d50d95273943dfe2a24809c1b5322
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

416495a1-bec8-428f-ba25-0097254f24e5.tmp

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\416495a1-bec8-428f-ba25-0097254f24e5.tmp
Size 6KB
SHA256 3ec219234e00eb3689dc7291a96e822b14d24661a25c3f2e9c6ba45523cc7fd1
MD5 5fb4df5553618f664fbbe053c21ab1c0
SHA1 da74196fb32dd4f030ac5a73bdb9fe855cb63db0
SHA512 8830a5b9e4aaef863be51f279b06aef7b603ca99dce813806aea8cb0ae1e7e5f3f9c2cdafe7442c4609b14b14167a7847bb7b9efb39a6be817061c2bc20e3215
SSDEEP 96:stX/dGIanLKAb94k+o5h16Z03s7/x+6MhmuecJjo1ejeCK+gx28XM1C7K:stv6LQhon3sV+FdjoQjiPG6K
TLSH
T181D196016E68B9BF8CC6E109FA35BA16E2F9607261D11D58EBFC852C08D66CD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5a815421d17e1bb8f1cdb9a76385a7979e3c6f4e9f68467b34d2f6d2e3ad3584
MD5 5d3b8fd63cb355bbb8d3c0830fa43538
SHA1 2ae4ea3636993cb5f29a82cfa13ea71394e89957
SHA512 2d398e0121cf107cf1f11047bdbd2587a29a8da71037b476de39736ea6e6c894d9a962ef6a7dcd5401f7d5aafd68004d28ee6452caabf600aff5d8cb182a6fe5
TLSH
T187A0022DA5815507C1510BB057C101663735682122530706A2D6446FAC757D25505151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 eb28eb8c149db255346a7e2e121f8b50820d300e43c5327f4cf5c6b0a9743192
MD5 cdd1bc782cf5a491f3b4d15fbb1e191f
SHA1 674ebed1086832ea531d52776da3b16895ce475e
SHA512 49cec3b2d333d168b9b44b90da8ef28adc083e8b2acdb6a0abbe71baa45dc8082d2cf42732b8eef0b4feed391097b3b069d3936a4a707f3271c2a2568ad3ac82
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8389.TMP

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Network\Network Persistent State~RFe5a8389.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Preferences
Size 6KB
SHA256 bee7943534a6844b3a630cfba47a48f90e4962fa55c34fcecfb9ae2fbcf6068e
MD5 5bb0ca82a9c55237e4e6928a4d69e3cc
SHA1 82c32e8354b4f06858d93b218988283cbdb36b19
SHA512 8ca7a9e022e6872e54602604df8e3bb0039f5e305fea0c3872ac59937d041eb2aaaca353a658c2f54c2aca631620afae42af0753df73e1acc6e336d95852b0af
SSDEEP 96:stX/dGIanLRGAb94k+o5h16Z03s7/x+6MhmuecJVzMFNjeCK+go28XM1C7K:stv6L2hon3sV+FdVz2ji+G6K
TLSH
T177D195016E68B9BF8CC6E119FA25BA17E2F5607261D11D58E7F8892C04DA6CD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 15KB
SHA256 6475c2b200b6feab6b70e97bf4a913b572540c03ec64fca7e576d83ff65057e3
MD5 f2f24881ad0befe5d5fc8ffba2cc1caf
SHA1 95327eedd400de8077ef4a43332a5161ebc61ce2
SHA512 6cd67afc79838315ef0727436fc9e1b15ef03873084065e21f17a95b8732e3abc4b92eb4aa268a4cb4e5d7f7b692d6ce1a4d6e688a883d376059477bc1446b9e
SSDEEP 384:a+aQikB+z/xvxjg/qhEB2NBSYvH6viGxAB03g9zq:l/UxvxjgC+svavisABPFq
TLSH
T189729E3765796E3799F7A6047959078BCAF894B391C27EB84ABD5F0D06C32880342C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 2KB
SHA256 114e747786b32e5e9133fa168e67900814fd50ce6a4be8c1aeb0ec43c897bce7
MD5 d33843c3af10b92012eb6f0a583bc69f
SHA1 6daf24420623a7174884ef0c74ad8e85f4a7c58b
SHA512 0acd73fb454d6714461374d12169bced8da1084c8d1cbaa866d74c1bf213997fa26015479cf47a0969778f2f83bb7be8c25254fdd31eeef1be4b2fa10da9119f
TLSH
T1E65195337968EA77C9E34708B9463B23CEB99166EA622F54E6EC4B0C00C615C1306CB7
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 3KB
SHA256 78b4dfb2b2b02d3544caa49bb1dcc230c4d631e618d7bedf9c007af467b78d0a
MD5 1f709431d2c671701d9dca258f8f4e64
SHA1 1df3f972c3e166b1d6eec6fd5ec2b59dd677588d
SHA512 b6e90a4252bed68a5cd4f980d1d9646afd2ab59ebd29cf77206a47abe113c652209ec3e267e6ef57256e8b48e692347c6282fc31d333c1f503590b051e20588d
TLSH
T15A6173337974E93B8EE38B04B9863B16ABA59127E5913F98D6EC0F0C01D728C1352C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595c9d.TMP

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State~RFe595c9d.TMP
Size 1KB
SHA256 b540f9daade6e8a7e848930a0c9c8cd89c5f850fb5676a675a327b2b6fdb8198
MD5 18083c29a134e6390db77da505fb2494
SHA1 01899710756e68190183818eb4757daf84a2a5cb
SHA512 1577490d12219adba276f19b4d74656d2f7a2d9ea699e2521db1afe373e81ae5a865fddb991afdfe45726e81400e1aef8aaa7d2cf7ed89778e2f49b665708df5
TLSH
T1DF2195B3F5A99F73DD92535A71027B138E30623BC3514E44F1DD8B1C05D604D962ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\configuration.json
Size 1KB
SHA256 d9e00fd5bb4e82438dd99bba80b1ccb73d8a93110f60df73e706f0101a390499
MD5 7ef831e4d0c9491ebf57b8fd76b07c73
SHA1 89af2cee0b3217ef6939386572dce04e10ee8481
SHA512 0b030ac1830557f14d49957697bed72cf5bdb3c97edf1c821f4a651b9a874b0ab4f6b11cfc93c64d30caa7a12e103a5e0b48e9863a0ae2873fdb56dc0d720fc8
TLSH
T1EC31F525CE256CF74094A03DED6E9153A75445530E4E3C18F389A59C2F0E63F61FAAC8
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\configuration.json
Size 1KB
SHA256 664f25561aeec51c65219fc8d2f096b8567b027aed4dc463270e215dcdcfea67
MD5 9b34a2216443ce2d198ff72c3c7b217d
SHA1 ae2587a10f71432edcc93da07a0f5e3f36480d11
SHA512 baaa3c737782ced5627367261da930dfec33155649cee7fbd038079d874bf92fc82158ea228c148e8834bf95500f449f104b7b650b155bbd5a2ccb4b2a100181
TLSH
T16031F525CE256CF74094A03DAD6E9153A76445530E4E3C18F389A59C2F0E63F61FBAC8
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\configuration.json
Size 1KB
SHA256 5f042926ae86c6c562019a2be22f1308f515a494987652185ec01788aa27665a
MD5 2d1e501de62ea935b3a34d481aea3382
SHA1 e4a5a6886716a3815acc1747f3bb24fe71ee6f9c
SHA512 7fef5093e3ab1e892122bce6f079521147ace3c07dfd1951e0d9551965db1e80e4d4e1acfa8ba930c63487a845a3d32a7fefa7891e380a9ab00a42d5b300e9e7
TLSH
T1B8310525DE256CF74094A03DAD6E9153A76445530E4E3C18F399658C2F0E63F61FAAC8
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\roblox\version-2366ba214ec740ca\RobloxPlayerBeta.dll
Size 21.5MB
SHA256 ce0db8e154bda29f9c84b1ed5fd94cbe143db61b2651fe436a179de28edccdb0
MD5 fcf8180bd84e419d98fba405e195e74f
SHA1 c2e9e655abc71e651caaecdf1f71b16d6dfa8b96
SHA512 b1f1b9cd06695445bae5fd1c2beef39e316b0e81868fd8effc5663aea8a8d213d10bfed25fa2627118eb7bee2ec08f1ff7a5cf01f95a705b779124a588dcd9eb
SSDEEP 196608:xHHPfTBFjwgQCvVVvD5A28emAcKabd/FYbApyN:xPf/aredG0vN
TLSH
T15B37CF4EF8D60AE4D17250B1E55F56D3EA66304C4A6C2EB783D90320367369EB248F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2024-77-0x00007FF86CFD0000-0x00007FF86CFD1000-memory.dmp

Download

memory/2760-3202-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3193-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3195-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3200-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3204-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3203-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3201-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/2760-3199-0x00000265E83A0000-0x00000265E83A1000-memory.dmp

Download

memory/3372-243-0x00007FF86CE70000-0x00007FF86CE71000-memory.dmp

Download

memory/3372-244-0x00007FF86C7F0000-0x00007FF86C7F1000-memory.dmp

Download

memory/5364-26-0x00007FF86CFD0000-0x00007FF86CFD1000-memory.dmp

Download