Roblox Malware Streams Victims’ Desktops and Captures Webcam Footage
.webp)
A malicious Roblox cheat campaign is turning a familiar gaming shortcut into a serious privacy threat. Players seeking an “undetected” Xeno script executor are being lured through gaming forums and Discord communities into downloading files that appear to offer game automation. Instead, the package starts a hidden, multi-stage infection that can give criminals control of \[…\] The post Roblox Malware Streams Victims’ Desktops and Captures Webcam Footage appeared first on Cyber Security News.
A malicious Roblox cheat campaign is turning a familiar gaming shortcut into a serious privacy threat.
Players seeking an “undetected” Xeno script executor are being lured through gaming forums and Discord communities into downloading files that appear to offer game automation.
Instead, the package starts a hidden, multi-stage infection that can give criminals control of the computer.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
The operation is especially concerning because Roblox cheats often attract younger users who may use shared family devices.
Once installed, the malware can target gaming accounts, browser data, payment information, private messages, and cryptocurrency wallets, creating risks that extend well beyond a lost game account.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
Bitdefender researchers identified the campaign while tracking fake Xeno packages promoted through gaming channels.
Bitdefender said in a report shared with Cyber Security News (CSN) that the researchers found activity affecting users since the beginning of the year, with infections rising sharply during the second half of March before settling into a steady rate.
The investigation links the operation to malware previously documented as Powercat, while newly observed infrastructure and expanded functions suggest that its operators are continuing to develop it.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
Roblox Malware
------------------
The fake cheat uses familiar-looking folders, copied game-related scripts, and Windows-style names to make the download appear legitimate.
It first checks whether the device is being analyzed in a virtual environment, helping attackers avoid security researchers and automated detection systems before delivering the final payload.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
The final malware can capture screenshots, log keyboard and mouse activity, access a webcam, and stream the victim’s desktop in near real time.
Its display-streaming feature captures images every 500 milliseconds and sends them to the attackers, effectively creating a live view of the infected screen.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
That level of access can expose private chats, documents, passwords entered into websites, and images visible on screen.
Similar threats have shown how gaming lures can combine account theft with remote monitoring, as seen in this report on malware targeting game cheats, where attackers used fake tools to reach gamers.[](https://cybersecuritynews.com/webrat-malware-via-github-repositories/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
The malware can also receive commands, transfer files, run PowerShell commands, and open an interactive remote shell.
This means a compromise may continue after initial data theft, allowing criminals to alter files, deploy more malware, or use the device in other criminal activity.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
From Cheat Download to Takeover
-----------------------------------
The infection begins when a victim downloads an archive or self-extracting package advertised as a cheat.
The staged process then retrieves additional components from attacker-controlled servers, disguising Java-based files as ordinary Windows programs and libraries to reduce suspicion.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
The malware searches for browser cookies and saved data from Discord, Roblox, Minecraft, and several browsers.
It also checks for cryptocurrency wallets, messaging applications, game launchers, VPN software, and development tools, enabling attackers to prioritize systems that may contain valuable accounts or financial information.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
Discord is a central part of the distribution lure, but it is also widely abused for malicious delivery and control.
Readers can see the broader pattern in CSN’s examination of modern malware abusing Discord, which explains how trusted community platforms can be misused to spread dangerous files.[](https://cybersecuritynews.com/how-modern-malware-exploits-discord-and-telegram/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
Users should avoid unofficial executors, cheats, and game modifications shared through forums, archives, untrusted websites, or unsolicited Discord messages.
Updated endpoint protection, application controls, multi-factor authentication, and reputation-based blocking can reduce exposure, while parents should discuss common gaming scams with younger players.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
Anyone who executed a suspicious game tool should change passwords from a clean device, revoke active sessions, and review financial accounts for unusual activity.
The combination of screen surveillance and account theft also mirrors risks described in a recent screen and webcam malware investigation, where attackers used remote access to collect sensitive data.
Indicators of Compromise (IoCs):-[](https://cybersecuritynews.com/new-npm-supply-chain-attack-uses-undicy-http/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756)
| Type | Indicator | Description |
| --- | --- | --- |
| MD5 | 4bdaf7792e908f163ebef137854c571d | Archive containing fake Xeno installation [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 9930036e8f787674db39094e21413e77 | Archive containing fake Xeno installation [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 9699bd6a448d0662a1e9e353223263b6 | Archive containing fake Xeno installation [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 1a462c76efc4e73725b9e95c4a00fddb | Archive containing fake Xeno installation [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 7b96170259a376ea79411c5713beb396 | Archive containing fake Xeno installation [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 2ead73ed62f1c2beb9043ce92e774e0b | Malicious loader [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 0aadd62b535e683a5a2fe31fde546d07 | Malicious loader [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 26a94168fa25af0bcb46a18ede50af86 | Malicious loader [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 0d03faf1764297c908158da77c8ffcae | Malicious loader [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | d123dbb5c5980bfeb22586197d2cc403 | Java archive payload [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| MD5 | 163c8d117ef5a4e4e9c3e92a726af0eb | Third-stage Java archive from GameDVR directory [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| URL | hxxps://solthere[.]net/justacoolkat10 | Victim registration endpoint [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| URL | hxxps://solthere[.]net/api/v1/redeem | Additional payload retrieval endpoint [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| Domain | ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz | Dynamically generated command-and-control address [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | RbxAnalytics.png | Junk-data file used to support the fake Xeno installation appearance [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | xeno.exe | Malicious first-stage loader masquerading as the Xeno executable [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | instance.exe | Archive used to extract the Java Runtime Environment [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | XenoIcon.jpg | File containing keys used to validate execution with the command-and-control server [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | decompiler.exe | Java archive disguised as a Windows executable [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | -ntcache | Local execution-progress log file [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| File name | SquirrelInteractive.bin | File used to store logged Exodus wallet-related buffers [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
| Registry value | DisplayCalibration | Run-key persistence entry used to launch the Java archive [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/59070b64-b133-412f-9a89-2155f62d71b0/Roblox-Malware-Streams-Victims-Desktops-and-Captures-Webcam-Footage.pdf?AWSAccessKeyId=ASIA2F3EMEYE2QRVK5ME&Signature=wsdnLlwMefIKOlwaaLHZFZjhy40%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEEQaCXVzLWVhc3QtMSJHMEUCIQC3alryTKroil4VfVpf7844fyo0d3jwEKRadbgz3JQ8rQIgIzqlmIF95QdSB6C8HavwZmZ%2FHpe3zUjSR%2BT5ckFSCCUq8wQIDBABGgw2OTk3NTMzMDk3MDUiDBmRo852aOLIqiBL2yrQBLK%2FJrmNBMNeRQkLYNYc5vPZUwy8Q178E477GyYuvpgHGZK5JF%2Fcgh2R3wgcqkxdC5tMn%2BbLxfAEeous7eIL%2FO2ctX93oLtpr3wuAu2CCbDXAormnn%2BN4ZXiJW%2FRfz5gqIZDWTJ5aMTi7bAWKwRE3zieH5v9u9%2FnhWlwNjvHbe6FuzkxpIqpHamfa584uEASFGvZjJ384VMKohjKN5%2BIr27MJWm4B2feUMq4GQ%2FEDGvS1lCTuFlvzoT%2Fv95K%2BEbzPZ%2BnXTZolfZdZHcqLS5PiQTB70xKpZRde1zNM5tt4Nq8Q8aOPH7xoM1%2BXraKf2%2BvMo31F%2BFg%2BmVUBeW78161JV244lB7nSMQ9HezGRuXWPtZx0I%2F%2BXREJpQUjVf2VhARd4w2PRAFnN2Lkoef9mb5N4Pn982naXmRW%2FfBckWmMYu2aCDbBplnSD4Bsa69qXYIzuciPbSMlLcvxFZKlQlDMD13Ej32GitI3lVTJ69Fk2o0AVWLkbOTixsbrhbJfQwXVF7KROc3xlh8bcQmWtAC204OHGH%2ByiD5%2BRKQv%2FdEtqPGnt4M6hAOdbbVCM0NjmPP5iatV7gzD5iarZDjGgmh4Qf7JeZw9dXtt%2FE29D6EMEvJ%2BItftOcKNeiMnbtPR8eRbXFqEpVJb0KG6%2F%2FSk%2F7qg%2FD1IXeWG%2BROJeMUmoM2xh6ney06Wu%2FOp%2BQmEDJwWpsfe2TtoXfSenTPqDJoe0kb1iP%2FuADa3QaCrLsr87McEcIDsTaTRBXjp1CgCQfVJrTwxiY4gUWO8lm4k3l5xfL8PtswqZTH0wY6mAGGUAoJL6NH4XGrb9fyvI1NXdJaox3Umd9WFEGO4JS5awOvuLS0Bec5SfxY%2FeOzA1J9%2FvSCk6O1ik9E27Fn9BYrHpeYe0KE6KZnS0PIrSDPIb4pIaZWHUfS7XM%2BYSjoRUB0si2ra2aQJ8bMwnQQXzyVi%2FfzD%2BRUl0tz%2BhhX6jXHrJy5tWYO83W3oZhi0x0iKAyiNJmQFPb4oA%3D%3D&Expires=1785845756) |
Note: _IP addresses and domains are intentionally defanged (e.g.,_ _[.]__) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM_.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
The post Roblox Malware Streams Victims’ Desktops and Captures Webcam Footage appeared first on Cyber Security News.