Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://archive.robl...

windows10-2004-x64

8

Resubmissions

28/08/2026, 12:26

260828-pl8dsaxves8

28/08/2026, 12:24

260828-plfc1axvax3

Analysis

  • user interaction
    yes
  • max time kernel
    370s
  • max time network
    371s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://archive.roblonium.com/Client/Windows/RobloxStudio/main%20%28roblox.com%29/2017/11.2017/November%208%20%280.315.1.163458%29/
  • Sample260828-pl8dsaxves
Score
8/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Network Service Discovery 1 TTPs 3 IoCs

    Attempt to gather information on host's network.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.roblonium.com/Client/Windows/RobloxStudio/main%20%28roblox.com%29/2017/11.2017/November%208%20%280.315.1.163458%29/
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff967a8c728,0x7ff967a8c734,0x7ff967a8c740
      2⤵
        PID:4632
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,18389422749503447064,17221445541861669919,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
        2⤵
        • System Time Discovery
        PID:3132
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13568251278856237613,3191083718940198393,262144 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
        2⤵
          PID:5000
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11112192279582170204,14701164188976478192,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:8
          2⤵
            PID:1916
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,16292987962546525918,10604905026592205297,2097152 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
            2⤵
              PID:4444
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,17373633107894662086,2547147391447132641,2097152 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:2676
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,15493921726614248019,14163787402496592121,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
                2⤵
                  PID:3020
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,17618342194101106904,932135088999357015,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:8
                  2⤵
                    PID:3344
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,4729996589914123181,6065598729700968470,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:8
                    2⤵
                      PID:1204
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,12262122299524446760,17132855611050991875,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:8
                      2⤵
                        PID:3612
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,11348736177098274588,16522003109546764033,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
                        2⤵
                          PID:2036
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,5495822229355667019,11037808986254456960,524288 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
                          2⤵
                            PID:3376
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,17423754245495517061,8701826730736855348,262144 --field-trial-handle=2064,i,8815504937354297882,14362597155515968068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2912
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:1020
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:2848
                            • C:\Windows\system32\OpenWith.exe
                              C:\Windows\system32\OpenWith.exe -Embedding
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              PID:2728
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:4116
                              • C:\Windows\system32\OpenWith.exe
                                C:\Windows\system32\OpenWith.exe -Embedding
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2880
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\version-a184d7ab177f46d9"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:568
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4976
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=939494B7A994ADDD1761397E9EDD278A --mojo-platform-channel-handle=1772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4332
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1D5F51C431DE4D01C0196E45069F2076 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1D5F51C431DE4D01C0196E45069F2076 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2728
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C5E64C9FDD30988872477518C36D5605 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2664
                              • C:\Program Files\7-Zip\7zG.exe
                                "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\" -ad -an -ai#7zMap2214:116:7zEvent6700
                                1⤵
                                  PID:4624
                                • C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe
                                  "C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies system certificate store
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:6056
                                  • C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe
                                    "C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe" -d
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4624
                                • C:\Windows\System32\GameBarPresenceWriter.exe
                                  "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                  1⤵
                                  • Network Service Discovery
                                  PID:5404
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5364
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x2c0 0x2b4
                                  1⤵
                                    PID:5520
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5912
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Drops desktop.ini file(s)
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    PID:5992
                                  • C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioLauncherBeta.exe
                                    "C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioLauncherBeta.exe"
                                    1⤵
                                    • Downloads MZ/PE file
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2156
                                    • C:\Users\Admin\AppData\Local\Temp\RBX-ECB0FF93.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\RBX-ECB0FF93.tmp"
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • System Location Discovery: System Language Discovery
                                      • Modifies Internet Explorer settings
                                      • Suspicious use of WriteProcessMemory
                                      PID:1212
                                      • C:\Users\Admin\AppData\Local\Temp\RBX-ECB0FF93.tmp
                                        C:\Users\Admin\AppData\Local\Temp\RBX-ECB0FF93.tmp --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=3539e67194ee6ba0c99d6e96abe3b09d611a4794 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7b4,0x7b8,0x7bc,0x720,0x7c4,0x10d2ad8,0x10d2ae8,0x10d2af8
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3332
                                  • C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe
                                    "C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4656
                                    • C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe
                                      "C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe" -d
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: AddClipboardFormatListener
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5716
                                  • C:\Windows\System32\GameBarPresenceWriter.exe
                                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                    1⤵
                                    • Network Service Discovery
                                    PID:116
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4780
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    PID:4652
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5516
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    PID:5948
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                    1⤵
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of WriteProcessMemory
                                    PID:1428
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff967a8c728,0x7ff967a8c734,0x7ff967a8c740
                                      2⤵
                                        PID:1976
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,3746979947087683323,16619976772792349484,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
                                        2⤵
                                        • System Time Discovery
                                        PID:5196
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,11604360124563834073,12392141478129442150,262144 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
                                        2⤵
                                          PID:5204
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,547969686134418943,5343965036801293636,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
                                          2⤵
                                            PID:4156
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5130360324447764927,4462897674173895714,2097152 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
                                            2⤵
                                              PID:2728
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,4101738322532204580,4494142513749379834,2097152 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
                                              2⤵
                                                PID:5336
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,3124442903532349411,17766963886901480541,2097152 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
                                                2⤵
                                                  PID:2192
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,17150661348804121973,1964487869364121447,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5008 /prefetch:8
                                                  2⤵
                                                    PID:5980
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,13179446873475936741,16974040002038724850,2097152 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:1
                                                    2⤵
                                                      PID:3536
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,16801260113708721540,16941295822811701852,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
                                                      2⤵
                                                        PID:4228
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,90304157808827481,71137846746273584,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:8
                                                        2⤵
                                                          PID:3484
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,9385003461214851398,3602530792739951209,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
                                                          2⤵
                                                            PID:4516
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,12509611690419482453,12205647962077588371,524288 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1532 /prefetch:8
                                                            2⤵
                                                              PID:4552
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5608,i,14105199311612822016,11858804398818674794,262144 --field-trial-handle=2076,i,7350268976695741436,17315353769674514079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
                                                              2⤵
                                                                PID:5700
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:5168
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                1⤵
                                                                  PID:3688
                                                                • C:\Program Files\7-Zip\7zG.exe
                                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\" -ad -an -ai#7zMap4205:142:7zEvent23157
                                                                  1⤵
                                                                    PID:1380
                                                                  • C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\RobloxStudioBeta.exe
                                                                    "C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\RobloxStudioBeta.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Checks processor information in registry
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4932
                                                                    • C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\RobloxStudioBeta.exe
                                                                      "C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\RobloxStudioBeta.exe" -d
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Checks processor information in registry
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3124
                                                                  • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                    1⤵
                                                                    • Network Service Discovery
                                                                    PID:2848
                                                                  • C:\Windows\system32\OpenWith.exe
                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                    1⤵
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5996
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                    1⤵
                                                                    • Checks processor information in registry
                                                                    • Modifies registry class
                                                                    PID:3320
                                                                  • C:\Windows\system32\OpenWith.exe
                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                    1⤵
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5780

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                        • Size 40B
                                                                        • SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        BookmarkMergedSurfaceOrdering
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                        • Size 6B
                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        BrowsingTopicsState
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                        • Size 414B
                                                                        • SHA256 0119200144db7661663442997bfe179b970e2730d7779223efc18488e1abab0d
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        temp-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                        • Size 168B
                                                                        • SHA256 6a3bb1d1d8bd24193b7722ec10c16094fabfd52347355f729778d1b216a8ee8d
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        the-real-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 120B
                                                                        • SHA256 52f5b7ce8b95fcf8b4cbf0e2395e00081562b8f01abc9ff8931c212be12998d9
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        data_1
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                        • Size 264KB
                                                                        • SHA256 aef79b33f724e0109065e573d9ad92c0b8fbc3927c8b54e22e2625267b7e903e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Network Persistent State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                        • Size 3KB
                                                                        • SHA256 db88d20052a3f13498484a3ec6216fb2ebab0956792f4a7b9356c37bec7a39a7
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Network Persistent State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                        • Size 4KB
                                                                        • SHA256 604c42b175fe15c3c87a6aeb7c5bfcd0c74fbcde0b346d1ce762db75a2d83f32
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Network Persistent State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                        • Size 3KB
                                                                        • SHA256 9177218e3e4d22801c5ced08f4f181c7251a0ae2207c0dafa4747238c19e3e61
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        TransportSecurity
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                        • Size 858B
                                                                        • SHA256 baf37ccc0703ed71add02925e7a09a5229ad8ff3f326eb7c5aeaef90cc798040
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 13KB
                                                                        • SHA256 36723c1c8e265482e67cc69dcb6814c1d3651fa5fb0445ed1328ed785c73aa6f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 11KB
                                                                        • SHA256 f125832e11d65998bde69b28182de1c0fe17131567541c79e958d90f748d3697
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 13KB
                                                                        • SHA256 59b54507005352db9d3918e5cc7dda2f48700cf3630ddb92ebe07954562a7d77
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 6f76bd800fe7d7b35c892305daef62ee574981654e16fa094dad54f57e7b9fdd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 13KB
                                                                        • SHA256 5978a9135cea59e6ba8a0dca80242cea187ee6bc1f8378fe4498a5a07a55ee17
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 1f857c3dce425c105dac7b7bf10076654da927788175a84953ff7f41db2a1a64
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 13KB
                                                                        • SHA256 a1733997ae4794aea50d6d6617863979b0a9293bb5ae29ae7546ea4fb62f29d3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 13KB
                                                                        • SHA256 c8d5541f79838b9d986780fe0528b48a97c34e907ee8898eccf82ce15385e88a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Secure Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                        • Size 13KB
                                                                        • SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 115KB
                                                                        • SHA256 d12340ad89afb2e655a5e329f2a6c408c8b2a58b68e93a9ec1d581cda565b500
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 116KB
                                                                        • SHA256 6d9cc52b6633e52865138c809d1822b43d6fad557d2d24df80b7a9962bbc566a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 117KB
                                                                        • SHA256 77f47d7325b904c9c74d7bf108c75f6a0156966b0e529e84c77427114cb5dccd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 252KB
                                                                        • SHA256 7dd38f7da1cca1f997220b29f43e6a647f478d3c539798351105c40d4baf3418
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 253KB
                                                                        • SHA256 d1843e22a7ec6de0f5dad5ab997c5ac2d9f451e5f0540691fc23bbe50b767911
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 116KB
                                                                        • SHA256 226f8deb0b2e9f4cfcf951f9c36575449032ffff9228b8ce9a1954e87a88830d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 116KB
                                                                        • SHA256 1776f4b1ec5d36d62bc1d4921c511a78eb25b8eaa2b414e8c01bf2615b14c55f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 242KB
                                                                        • SHA256 868c9d61748ab5c6db0ec883658d38828db018e708730dfe8c48e4aa9eec9632
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        8bc9cea2925563d0b4ed35fc50d54731
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8bc9cea2925563d0b4ed35fc50d54731
                                                                        • Size 1KB
                                                                        • SHA256 116abfa7b67b69a9e824ee443bae9f4ed46c2d942f1080d98678d1a17bc80c87
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        cc75e92aecfca20f15f36fba1899d11a
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\cc75e92aecfca20f15f36fba1899d11a
                                                                        • Size 1KB
                                                                        • SHA256 50fb16c8b6ffda9f00b0ceb0ace53e3b2913b4c4497737d773982133cb4f90d6
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        diffuse.dds
                                                                        • Path C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\PlatformContent\pc\textures\aluminum\diffuse.dds
                                                                        • Size 152B
                                                                        • SHA256 8552dc6e0cb6d92005d531258fdb0648f943c720eafff55b51659ec80b7c3e3c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        specular.dds
                                                                        • Path C:\Users\Admin\Downloads\0.182.0.59097 (version-12d40fa2399e46ca)\0.182.0.59097 (version-12d40fa2399e46ca)\PlatformContent\pc\textures\concrete\specular.dds
                                                                        • Size 170KB
                                                                        • SHA256 454ee746e774d4a1611cadb2552eacc28167ff3f3306018198a8e203274ccb47
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        normaldetail.dds
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\PlatformContent\pc\textures\cobblestone\normaldetail.dds
                                                                        • Size 176B
                                                                        • SHA256 2a51ad9239a2102af2c08ee23e18407c3500770a931332a722c643ffca90a60e
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Qt5Core.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Core.dll
                                                                        • Size 4.0MB
                                                                        • SHA256 89c24de8294e624fd3185db7746e1f1d45513a7c0a564d0adc1bd64ac314cbf5
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Gui.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Gui.dll
                                                                        • Size 3.5MB
                                                                        • SHA256 246e1e1101b140a8a0eb970b3076c6c3d12c26cbb90730c7588f1021e24b7499
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Multimedia.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Multimedia.dll
                                                                        • Size 569KB
                                                                        • SHA256 98a9878b8dabe5a93106908576d0ce5ee10fc1c09fb7369d5e2721ea4e19a48d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5MultimediaWidgets.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5MultimediaWidgets.dll
                                                                        • Size 82KB
                                                                        • SHA256 e26129152806ee27f76e6fa17c725da9fea6ecadb78c775eb9eb4e31e7002c92
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Network.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Network.dll
                                                                        • Size 831KB
                                                                        • SHA256 40ceddf00e444e346027ac935d874223c04f2d7a1adeba3225f8e74e09d177b1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5OpenGL.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5OpenGL.dll
                                                                        • Size 257KB
                                                                        • SHA256 17dce638d96d1a3996c443bf0ff2bd658d4055ce787d81cdfece8711ea02ce1e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Positioning.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Positioning.dll
                                                                        • Size 171KB
                                                                        • SHA256 66e4243257f5ce5396d03c20519a5a1edb8a0644e98598579f7bc9a6430799bd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5PrintSupport.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5PrintSupport.dll
                                                                        • Size 261KB
                                                                        • SHA256 9befd7c539274fd3764f22a7a6435275b8342edf6c1f0eba4000a8678e699c84
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Qml.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Qml.dll
                                                                        • Size 2.4MB
                                                                        • SHA256 2b85d2018a462ee61baff0b80febca97d5a24f8ecc7ca38e1b9704a516860d13
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Quick.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Quick.dll
                                                                        • Size 2.4MB
                                                                        • SHA256 b69e23bff70ac0d123c650b652de3ad084626a4c8103f57cc8db1be604964e99
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Sensors.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Sensors.dll
                                                                        • Size 150KB
                                                                        • SHA256 1faf7a350bf1fe215c8d27a6daaa16118c773ba972330ac99d5cfe8b62f84158
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5WebChannel.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5WebChannel.dll
                                                                        • Size 81KB
                                                                        • SHA256 96983f71900ca5b119dc569d9721322cfceeb9b281ee045dd00a665873aec943
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5WebKit.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5WebKit.dll
                                                                        • Size 16.5MB
                                                                        • SHA256 480079aac0ff54fef0d79dca45e7da8a9a071293d5a42c9d68406522dc0c2d23
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5WebKitWidgets.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5WebKitWidgets.dll
                                                                        • Size 191KB
                                                                        • SHA256 1e2d28196fb2b53913e48e1c000c7aadf47a3e7e81954de06f84afa02611a81b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Widgets.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Widgets.dll
                                                                        • Size 4.2MB
                                                                        • SHA256 db27d7be6fed7b352a502b3507fb1bda274c71b7d803944835b1ff2b0dc0f66c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Qt5Xml.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\Qt5Xml.dll
                                                                        • Size 149KB
                                                                        • SHA256 6c83a45e2953139172c99ba14648fff14355fe70ba44dbc52e0d9675f8bdd97c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        RobloxStudioBeta.exe
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\RobloxStudioBeta.exe
                                                                        • Size 24.1MB
                                                                        • SHA256 571bbbf8522586ff5a4484e574f42c0c88b45c551b9677c49c05d158a9c2f5c6
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        fmod.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\fmod.dll
                                                                        • Size 1.4MB
                                                                        • SHA256 f766df180452c176d650bd0f539e7a09dcbdb324c44a587861f5f05f106c184a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        icuin56.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\icuin56.dll
                                                                        • Size 2.1MB
                                                                        • SHA256 b4417f59ea0a67ddaeccf858f96a01cd89a1db0413b672779bf275eb3d2182be
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        icuuc56.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\icuuc56.dll
                                                                        • Size 1.4MB
                                                                        • SHA256 6ddf9381ab8f304dbd1047612e256dcad3aadf87cc5805646016cf658e40998a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        libGLESv2.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\libGLESv2.dll
                                                                        • Size 1.2MB
                                                                        • SHA256 853d1e26bae182272c6c63dbcd2c802146a4439d0bf65d80f558a32851a9fa95
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        libfbxsdk.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\libfbxsdk.dll
                                                                        • Size 6.4MB
                                                                        • SHA256 9d73634c8d86415af721ef0917a67bea922d9dbad1d30ccb9f81d299795a0a2d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        msvcp140.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\msvcp140.dll
                                                                        • Size 429KB
                                                                        • SHA256 9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        qtnribbon4.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\qtnribbon4.dll
                                                                        • Size 3.4MB
                                                                        • SHA256 40e0d227537218e257083257185304897dd5280072797d3461d197fd6b637ea1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        sgCore.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\sgCore.dll
                                                                        • Size 869KB
                                                                        • SHA256 c8561cc80f5911e1494f444c547a315875819d5077ceeb7c3ae1096b02e14811
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        vcruntime140.dll
                                                                        • Path C:\Users\Admin\Downloads\November 8 (0.315.1.163458)\November 8 (0.315.1.163458)\version-a184d7ab177f46d9\vcruntime140.dll
                                                                        • Size 81KB
                                                                        • SHA256 6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        desktop.ini
                                                                        • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                                        • Size 190B
                                                                        • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        memory/3124-4106-0x0000000001F30000-0x0000000002060000-memory.dmp
                                                                        Download

                                                                        memory/3124-4110-0x000000006C740000-0x000000006C83F000-memory.dmp
                                                                        Download

                                                                        memory/4624-2384-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download

                                                                        memory/4624-2385-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download

                                                                        memory/4656-2423-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download

                                                                        memory/4932-4097-0x0000000001DD0000-0x0000000001F00000-memory.dmp
                                                                        Download

                                                                        memory/4932-4108-0x000000006C740000-0x000000006C83F000-memory.dmp
                                                                        Download

                                                                        memory/5716-2463-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download

                                                                        memory/6056-2235-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download

                                                                        memory/6056-2232-0x0000000000E10000-0x0000000002845000-memory.dmp
                                                                        Download