Analysis
- user interaction
yes - max time kernel
1799s - max time network
1801s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 22:10
General
- Target 616a236771b9f79448bcbca56cbf314813b311fa.png
- Size 405KB
- Sample260808-13mn7azsaz
- SHA256 a0dcec8b986fcd2c30723051c536a5cfde354969c7803622a248f97fb482537e
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 26 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 16 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 48 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 52 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\616a236771b9f79448bcbca56cbf314813b311fa.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7fffb580c728,0x7fffb580c734,0x7fffb580c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11471840737298006866,66188340850023750,262144 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,8963984143292459368,8986169179708879042,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,1205997737738992254,10541321855549218023,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3340,i,5142504535055970794,16407615644177049874,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,13487687460209843308,9411588371159343588,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,14408080098418042236,13878439471170164047,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,14108239081803192132,12593529194278255392,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,383627901321961882,11511918101977329529,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,3548633616224467454,14171645050937416044,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,10061879330295022064,11420994478241042161,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,18394073023189346286,7441469823829015646,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5816,i,12825897141975760081,6094139257356593318,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,3796587936783557671,6236180948262817200,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6224,i,5208861085388361936,10997848450625384340,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5408,i,15425585348377250835,8308965826005002326,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6228,i,14824643005918905474,15032133029128931669,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6072,i,13012816202360063947,1276182469850280719,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,15481207182329763759,9413635938877856728,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,2265672714876884398,6105312046235651909,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,13345086059078480986,7178661701538273710,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6040,i,7140754212257799912,887586112856976789,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=2692,i,845138427253509053,10598182889603653574,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,3094667699719316426,13943335489481674151,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,6726599019999433427,7717429546084489030,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,1416970449174939581,13376941075580732683,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3524,i,9041293066585796886,726014345487714322,262144 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,2752433031750298812,7232143365111119936,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3936,i,9655500123958904157,1738707946032401409,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4840,i,5609774936836215272,12701648863828366137,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6344,i,17712776070245541291,15450140809349199709,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,15983700659931395264,3518637303440707421,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 5436 --attachment=attachment_0.733.0.7330989_20260808T221556Z_Studio_D9258_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260808T221556Z_Studio_D9258_last.log --attachment=attachment_log_0.733.0.7330989_20260808T221556Z_Studio_D9258_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.733.0.7330989_20260808T221556Z_Studio_D9258_csg3.log --attachment=attachment_log_0.733.0.7330989_20260808T221556Z_Studio_D9258_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.733.0.7330989_20260808T221556Z_Studio_D9258_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.733.0.7330989 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=6468eec5ddfa1510f06a43d039a72a6d9307e028 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.733.0.7330989 --annotation=UniqueId=3431044787831704069 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.733.0.7330989 --annotation=host_arch=x86_64 --initial-client-data=0x47c,0x480,0x484,0x458,0x48c,0x7ff701d64ed8,0x7ff701d64ef0,0x7ff701d64f084⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5436.4352.8895856272236250101 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fffa7445fd8,0x7fffa7445fe4,0x7fffa7445ff05⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,15411699904077336359,14222916540213861152,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1736,i,15411699904077336359,14222916540213861152,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1736,i,15411699904077336359,14222916540213861152,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1736,i,15411699904077336359,14222916540213861152,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5436.4352.8660288826772910269 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1d4,0x7fffa7445fd8,0x7fffa7445fe4,0x7fffa7445ff05⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3952 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4848 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4856 --field-trial-handle=1772,i,7066644281289205965,15840935832248287873,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5436.4352.15830193270602849576 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1ac,0x7fffa7445fd8,0x7fffa7445fe4,0x7fffa7445ff05⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,12315530551241413137,8946617756739171506,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=1844,i,12315530551241413137,8946617756739171506,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2804 --field-trial-handle=1844,i,12315530551241413137,8946617756739171506,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1844,i,12315530551241413137,8946617756739171506,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:15⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6480,i,15485996005669900999,15287299128274655166,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3564,i,12845514840616906944,13006500476325383066,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6800,i,15504307099490162489,2838377364328431281,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,9829710266074461499,794951126738217034,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4872,i,8920206108525935181,5407441246479642071,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5712,i,11007016794872943189,17154352521262159429,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7096,i,4456538812264545450,8429772846454273342,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7100,i,1427642592196433072,2112632625667074052,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,7335830189672769745,13148955929324024714,524288 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6344,i,2487514275471286307,4759369662630183342,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7188,i,9369203015353382343,3741461286508027598,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7276,i,8824907849467120455,13558788889678125446,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7472,i,1669592475908420900,17504990239853751637,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7276,i,6249370376236671633,12449648235537980392,2097152 --field-trial-handle=1952,i,1390435635817821955,7783620925223340102,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004DC1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
AppSettings.xml
qgif.dll
qjpeg.dll
qwindows.dll
qwindowsvistastyle.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Widgets.dll
Qt5Xml.dll
QtitanBase.dll
QtitanDocking.dll
QtitanRibbon.dll
RobloxCrashHandler.exe
WebView2Loader.dll
dd-win-prof.dll
libfbxsdk.dll
msvcp140.dll
msvcp140_1.dll
vcruntime140.dll
vcruntime140_1.dll
BookmarkMergedSurfaceOrdering
f_000004
f_000006
f_000059
f_00005f
f_000068
f_000069
f_00006a
f_00006b
f_00006c
f_00006e
f_000071
f_00007e
f_000097
f_000098
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
000003.log
000017.ldb
000018.log
000020.ldb
LOG
LOG
MANIFEST-000001
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5f3e5a.TMP
the-real-index
the-real-index~RFe5f9c78.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5f337d.TMP
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt~RFe5efcec.TMP
67a473248953641b_0
67a473248953641b_1
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a1fdd.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
512.png
512.png
512.png
temp-index
index.txt
index.txt
index.txt
index.txt~RFe61fb18.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.json
settings.json
OTAData.json
OTADataCache.json
InstallerInfo.log
InstallerInfo.log
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
index
the-real-index
76356b52-ba35-4036-b418-1b976837469b.tmp
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5e8338.TMP
Preferences
Preferences
Preferences
Preferences
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5e1d1b.TMP
075274a7-2bc4-4792-8e58-56cbe7fe8a61.tmp
the-real-index
the-real-index~RFe5f2eba.TMP
cacert.pem
rbx-storage.id
8913724486d5e3c463c493b25346ca31
messages.json
Unconfirmed 30601.crdownload
desktop.ini
memory/840-1367-0x00007FFFD2270000-0x00007FFFD2271000-memory.dmp
memory/1320-2215-0x000001D2EBE30000-0x000001D2EBE5F000-memory.dmp
memory/1636-1764-0x0000026C49F90000-0x0000026C49F91000-memory.dmp
memory/1636-1763-0x0000026C49FC0000-0x0000026C49FC2000-memory.dmp
memory/1636-1765-0x0000026C49FD0000-0x0000026C49FD2000-memory.dmp
memory/1636-1767-0x0000026C49FE0000-0x0000026C49FE3000-memory.dmp
memory/1636-1795-0x0000026C43CE0000-0x0000026C43D0F000-memory.dmp
memory/1636-1778-0x0000026C4A110000-0x0000026C4A112000-memory.dmp
memory/1636-1780-0x0000026C4A160000-0x0000026C4A162000-memory.dmp
memory/1636-1768-0x0000026C49F90000-0x0000026C49F96000-memory.dmp
memory/1636-1783-0x0000026C4A100000-0x0000026C4A105000-memory.dmp
memory/1636-1782-0x0000026C4A730000-0x0000026C4A733000-memory.dmp
memory/1636-1762-0x0000026C49F90000-0x0000026C49F91000-memory.dmp
memory/4348-1366-0x00007FFFD2270000-0x00007FFFD2271000-memory.dmp
memory/4348-1529-0x00000124A3970000-0x00000124A399F000-memory.dmp
memory/5436-1260-0x0000015DEA670000-0x0000015DEAA70000-memory.dmp
memory/5436-1162-0x00007FF6F4FA0000-0x00007FF6F5FA0000-memory.dmp
memory/5436-1159-0x00007FFFAA480000-0x00007FFFAA9CC000-memory.dmp