Analysis
- user interaction
yes - max time kernel
899s - max time network
901s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 04:28
General
- Target https://www.mediafire.com/file/qzfmc6jlfghg6cb/Mighty-Omega.rbxl/file
- Sample261024-e3r31sw15r
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 19 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 50 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 52 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/qzfmc6jlfghg6cb/Mighty-Omega.rbxl/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff83016c188,0x7ff83016c194,0x7ff83016c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,2005328354681709621,797565854278506146,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8895318833081814957,14546507251658087285,262144 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,6719548399433359544,7858594242269397055,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,500918077353634877,2186446401450164029,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,13722751789543799391,3094192887218047235,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8090538303368144213,15743642666501722440,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,4390950470357809383,2730039275710420831,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5136,i,10324104182490762535,10072891796278408624,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5292,i,6721638070977345932,10056640407413559596,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6020,i,7798282320687131264,14191614079941811283,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,6954342385616735437,1506655546511122969,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,13588506972945731344,16412631979261724134,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10116557932238189398,7237676455394597416,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10116557932238189398,7237676455394597416,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5188,i,1758295636153054336,5412826324675967890,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5196,i,2643200012543370919,9027573846661896948,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7040,i,17625586807287444251,8284663922660773280,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7068,i,3711933863590862653,3265894244747556029,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5200,i,17624907446682629542,13712913948871740734,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7320,i,17490185335930962702,6832770480064159930,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7476,i,16134030259380854212,3115161701216228721,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,3653782699538895950,692331610035762593,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7808,i,3231616010534294905,7965996771592625627,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8340,i,13235566951138665433,4188879126524179940,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8520,i,7995339902126441437,10884519512888386996,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8532,i,7126388290503100284,18026409460745453407,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8398414222756638716,17917906176357760,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7328,i,4483640929795545673,14135123628822368903,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8804,i,17405959201112627603,4199224258973625721,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3708,i,15961087604521019533,3656747943764737907,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7424,i,18421666554217395843,11614050729010767075,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6952,i,170141004705520045,4171287716022257818,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3787691193003206590,18030004737145677444,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7849865736949153985,3508804264744949352,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,11597744091215870810,1702402636156099134,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7240,i,14023178013433214870,6591711541337476324,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,3761891486900861462,2736790202912711413,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8748,i,6730490577006095499,13598093994350059789,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,7863659678557940441,2741477111704563441,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 3684 --sentryUrl https://sentry.prod.rbx.com/api/15/minidump/?sentry_key=c17c3208072138b08e2d48575a4b31a7 --sentryDbPath C:\Users\Admin\AppData\Local\Roblox\logs\crashes --sentryLogPath C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T043032Z_Studio_A9A97_last.log --attachment=attachment_0.744.0.7441077_20261024T043032Z_Studio_A9A97_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T043032Z_Studio_A9A97_last.log --attachment=attachment_log_0.744.0.7441077_20261024T043032Z_Studio_A9A97_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T043032Z_Studio_A9A97_csg3.log --attachment=attachment_log_0.744.0.7441077_20261024T043032Z_Studio_A9A97_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T043032Z_Studio_A9A97_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.744.0.7441077 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19041" --annotation=RobloxChannel=production --annotation=RobloxGitHash=b06ed5a2056729e5e96702c5885f912373dc2307 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.744.0.7441077 --annotation=UniqueId=8187901253375651049 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.744.0.7441077 --annotation=host_arch=x86_64 --initial-client-data=0x44c,0x450,0x454,0x428,0x4b4,0x7ff642616b08,0x7ff642616b20,0x7ff642616b384⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apis.roblox.com/oauth/v1/authorize?response_type=code&code_challenge=D_6o-taE4vR5zBrkKA1iU3l7rg8saW6Y_nntoi5WiZ4&code_challenge_method=S256&client_id=7968549422692352298&redirect_uri=roblox-studio-auth%3A%2F&scope=openid+credentials+profile+age+roles+premium+verification&nonce=id-roblox&state=eyJwaWQiOiIzNjg0IiwiZXZlbnRfaGFuZGxlcl9uYW1lIjoiRXh0ZXJuYWxMb2dpbkZsb3ciLCJkYXRhIjoiZmZqQWhfd1F2dVBMS1hjb0VYY1M1aXhLT1I1dWZObmJRUEhFTkhQYnhNbyJ9&studio_trace_id=fd048a9b29b36dfd4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://apis.roblox.com/oauth/v1/authorize?response_type=code&code_challenge=D_6o-taE4vR5zBrkKA1iU3l7rg8saW6Y_nntoi5WiZ4&code_challenge_method=S256&client_id=7968549422692352298&redirect_uri=roblox-studio-auth%3A%2F&scope=openid+credentials+profile+age+roles+premium+verification&nonce=id-roblox&state=eyJwaWQiOiIzNjg0IiwiZXZlbnRfaGFuZGxlcl9uYW1lIjoiRXh0ZXJuYWxMb2dpbkZsb3ciLCJkYXRhIjoiZmZqQWhfd1F2dVBMS1hjb0VYY1M1aXhLT1I1dWZObmJRUEhFTkhQYnhNbyJ9&studio_trace_id=fd048a9b29b36dfd5⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3684.6048.90004712419248544664⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x40,0x7ff81cc2b078,0x7ff81cc2b084,0x7ff81cc2b0905⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,16720653246776733733,17818107262110702113,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1352,i,16720653246776733733,17818107262110702113,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2336,i,16720653246776733733,17818107262110702113,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3752,i,16720653246776733733,17818107262110702113,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:15⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,4433204346727928839,2977016395208650084,262144 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5768,i,13492894145451319511,12864310651989571931,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6952,i,489519283782434345,13603983150024066594,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5348,i,13702422712608105408,13857486594380820210,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe" roblox-studio-auth:/?code=3uP-91Z0S3-dj9vED_-3rsm9OjwvPdpfRbRvCU0BMfY3ozFtzCyHflJwpMN-_NsF6pqR0MdazlXr9JQAOV-1LI0soMPBwC-NbZnfeuMBEQ0a10jYJnVqVO1PFUJEUgz_jWEJWuvACldb8upyjzaqbzJ8EGcRNysd1QQg5F9yyW_A50ZJf3_MqdYRlpinRvRydWwd3WKJ_-_bvz9prEBInluIbOFsCWPg0oEkKv4XaKA-ia-9Cy_S0M6jJii4Z_J6uV-X64e3xWd7kRHzBKzUOtFYwVhfbldXQRXUBGbPsMuU9LBu2WT_glyYVcrEUlcsp9WtnzofxXsap8PUVe7D7JYtpEel9WD_ZgVrLWb82pE&state=eyJwaWQiOiIzNjg0IiwiZXZlbnRfaGFuZGxlcl9uYW1lIjoiRXh0ZXJuYWxMb2dpbkZsb3ciLCJkYXRhIjoiZmZqQWhfd1F2dVBMS1hjb0VYY1M1aXhLT1I1dWZObmJRUEhFTkhQYnhNbyJ92⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 3532 --sentryUrl https://sentry.prod.rbx.com/api/15/minidump/?sentry_key=c17c3208072138b08e2d48575a4b31a7 --sentryDbPath C:\Users\Admin\AppData\Local\Roblox\logs\crashes --sentryLogPath C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T043121Z_Studio_FA8DF_last.log --attachment=attachment_0.744.0.7441077_20261024T043121Z_Studio_FA8DF_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T043121Z_Studio_FA8DF_last.log --attachment=attachment_log_0.744.0.7441077_20261024T043121Z_Studio_FA8DF_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T043121Z_Studio_FA8DF_csg3.log --attachment=attachment_log_0.744.0.7441077_20261024T043121Z_Studio_FA8DF_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T043121Z_Studio_FA8DF_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.744.0.7441077 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19041" --annotation=RobloxChannel=production --annotation=RobloxGitHash=b06ed5a2056729e5e96702c5885f912373dc2307 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.744.0.7441077 --annotation=UniqueId=1520955475879038084 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.744.0.7441077 --annotation=host_arch=x86_64 --initial-client-data=0x43c,0x440,0x444,0x418,0x458,0x7ff642616b08,0x7ff642616b20,0x7ff642616b383⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,14962277388437460924,17691497451108996234,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8596,i,7958954847197151569,11666637544063669361,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8488,i,11257975474349884197,13900331433850499698,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14799309719865561747,7222189639241262690,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8116,i,7652322274117223158,17635807852325108652,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7152,i,1493994203780166894,7158108507595309991,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,16325380515347382303,3409036100356376687,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7232,i,4207615528256311411,5093805820653867529,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6752,i,1107060846774084012,5445435692937191954,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8908,i,10143381179450742520,6142352593547893739,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7356,i,2335817192075140740,9687745173010981488,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8296,i,13447372975265272476,13390056705937108178,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6080,i,5078358640451334995,5385376226435294091,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7220,i,5147779091546913835,16990829899909535065,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8616,i,6356044142592257188,10719292674453382880,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8288,i,3084091499133693690,9811350015744601376,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7132,i,10012074122126852635,13288700681253487603,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8332,i,12176531010767763163,13220865405792019790,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7000,i,7774911433182833360,13153838983628818294,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7128,i,16939343909243440947,13165998129243144572,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8716,i,7987953578573685440,6626710084411770044,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8644,i,13296495834973237272,1999656616009607480,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=7108,i,9996270642081808342,14884138816849792336,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8972,i,2996781912537965526,7798940198754288274,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9020,i,14796717688198065058,17126619291485594676,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=6012,i,11913005537885455815,2066951114779889150,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6752,i,14292082772954966970,4890874022639538720,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8364,i,13360989651197161505,15299982829138171718,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9116,i,9002498513695695534,8525528826597387718,524288 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=7688,i,11256019006243751720,10948382644506039528,2097152 --field-trial-handle=2768,i,15011981808753928126,10027446658895233495,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxStudioBeta.exe" roblox-studio:1+launchtime:1792816969915+avatar+browsertrackerid:1792816170250001+robloxLocale:en-US+gameLocale:en-US+channel:+browser:edge+userId:11868893640+distributorType:Global+launchmode:edit+task:Default2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe"C:\Program Files\Roblox\Versions\version-7aaa6838d36c4448\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 6428 --sentryUrl https://sentry.prod.rbx.com/api/15/minidump/?sentry_key=c17c3208072138b08e2d48575a4b31a7 --sentryDbPath C:\Users\Admin\AppData\Local\Roblox\logs\crashes --sentryLogPath C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T044252Z_Studio_6371F_last.log --attachment=attachment_0.744.0.7441077_20261024T044252Z_Studio_6371F_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.744.0.7441077_20261024T044252Z_Studio_6371F_last.log --attachment=attachment_log_0.744.0.7441077_20261024T044252Z_Studio_6371F_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T044252Z_Studio_6371F_csg3.log --attachment=attachment_log_0.744.0.7441077_20261024T044252Z_Studio_6371F_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.744.0.7441077_20261024T044252Z_Studio_6371F_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.744.0.7441077 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19041" --annotation=RobloxChannel=production --annotation=RobloxGitHash=b06ed5a2056729e5e96702c5885f912373dc2307 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.744.0.7441077 --annotation=UniqueId=837897097236097129 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.744.0.7441077 --annotation=host_arch=x86_64 --initial-client-data=0x43c,0x440,0x444,0x418,0x454,0x7ff642616b08,0x7ff642616b20,0x7ff642616b383⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6428.7132.32432289818435796313⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff81cc2b078,0x7ff81cc2b084,0x7ff81cc2b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,11477518881016818749,12815848957706497053,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1864,i,11477518881016818749,12815848957706497053,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2308,i,11477518881016818749,12815848957706497053,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 744, 0, 7441077" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,11477518881016818749,12815848957706497053,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x4f01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://%22c/Users/Admin/AppData/Local/Roblox/Versions/RobloxStudioLauncherBeta.exe%22-g3mode%20NoGraphics1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://%22c/Users/Admin/AppData/Local/Roblox/Versions/RobloxStudioLauncherBeta.exe%22-g3mode%20NoGraphics2⤵
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x4f01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AppSettings.xml
qgif.dll
qjpeg.dll
qwindows.dll
qwindowsvistastyle.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Widgets.dll
Qt5Xml.dll
QtitanBase.dll
QtitanDocking.dll
QtitanOffice2016Style.dll
WebView2Loader.dll
dd-win-prof.dll
libfbxsdk.dll
mimalloc-redirect.dll
mimalloc.dll
msvcp140.dll
msvcp140_1.dll
vcruntime140.dll
vcruntime140_1.dll
0847fcc5-63af-41fa-b2ca-b450ae7f4475.tmp
0fdff36e-789d-4d99-b708-dd06b2ba647b.tmp
13fd4f93-354a-4f76-9a96-47f86ea339df.tmp
25bad0be-4b49-4279-9d59-cdf41c7c7363.tmp
277f7668-1f17-4ffb-817c-c4f709a8ffa8.tmp
42c9f418-f8df-4634-954a-36a5b716a5a8.tmp
4afe7c2b-6774-48ac-8322-090504f2a9c9.tmp
5073e609-f5af-44e7-b85a-d705154d2f84.tmp
54b499e4-3e7a-4474-bccf-945306b596c4.tmp
62002d51-4196-48f8-8228-9dce07a80400.tmp
69b9c475-94fa-497b-a149-b7ddb5accd39.tmp
84edd180-242e-4a5e-b8de-0f8fb1e9405e.tmp
862ad145-ae17-459d-af88-28c55ed5a8be.tmp
87e9b39d-695e-4200-b24f-5de75c590ec3.tmp
8da48e4b-0ab2-4b44-8389-527e237bd667.tmp
settings.dat
settings.dat
settings.dat
19c0316d-dc28-42d0-96e1-cabd7edc07ca.tmp
26b3570c-512d-4a9f-b93a-145f6f629fcc.tmp
53f1751b-9c82-4eab-9c76-2af647e9cf3b.tmp
74fbf375-b5fd-4220-bbc7-4278a8dd4d7a.tmp
7a79d7a4-b188-44e1-9849-50058642660a.tmp
7b6ed612-43f4-4e75-8b00-52f929a575b6.tmp
927750fc-4329-4a21-8b2d-c6dd7f3c70f2.tmp
9807ed15-4e82-4381-8924-bab259c2f384.tmp
LOG.old
LOG.old
LOG.old
f_00007d
f_000080
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a8
f_0000ad
f_0000ae
f_0000af
f_0000b1
f_0000b2
f_0000b4
f_0000b6
f_0000b8
f_0000b9
f_0000bd
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000ca
f_0000cb
f_0000cd
f_0000cf
f_0000d2
f_0000d3
f_0000d4
f_0000d5
f_0000d6
f_0000d7
f_0000d8
f_0000d9
f_0000da
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000df
f_0000e0
f_0000e1
f_0000e2
f_0000e3
f_0000e8
f_0000e9
f_0000ea
f_0000eb
f_0000ec
f_0000f7
f_0000f8
f_0000fa
f_000100
f_000108
f_000139
f_00013a
f_00013b
f_00013c
f_00013d
f_00013e
f_00013f
f_000140
f_000141
f_000143
f_000144
f_000145
f_00014d
f_00014e
f_00014f
f_000150
f_000152
f_00015a
f_00015e
f_00015f
f_000162
f_000167
f_000170
f_00018a
f_00018b
f_00018c
f_00018e
f_00018f
f_000190
01cf6d4aa834d027_0
02e41caad904e7fc_0
0f54957f594985c3_0
11104fe27cea1141_0
11cbc6d59d75a3bd_0
1781f4c6780c06a0_0
1d7c60b5404987ae_0
1e3d426f0ddc5737_0
205a05a8fe2dfb45_0
26eade7f035762dd_0
26ed5c65b9ce1f71_0
2ed183d46af5954b_0
2f4680e8f8f8a14f_0
315b923d00942d97_0
39a5e623cac641bd_0
455553e6ff6e3fdf_0
4936e18e37efba56_0
499a8e9f143d50e7_0
4bec85e7c1a9b45a_0
4e9c7baa78a69a65_0
4ec812136b471b04_0
566bcc2cb4a918ff_0
5dd016d767bf505a_0
6048c53dd280a81c_0
61a0b4d20ae0e222_0
64332b9188264870_0
65954a0d3d3bf00a_0
690ccc8eea086670_0
6d723393df390ab2_0
74e83ea294c1e371_0
76e61c1c89c5ebe1_0
77542a4b99d3c413_0
7853c5422f7aa119_0
7a6268d420b60dbf_0
7d6189b66755de2b_0
8baa13f7b32fb253_0
909cf8e39fbfd013_0
92aa708729096273_0
92cf754e9613ae27_0
94c716e67c5c1427_0
94cfeea19fd46961_0
95d0e2f4fb6a690f_0
9820ef3cdc166065_0
9aed89595095f39f_0
a188f0c52c64be86_0
a2509c30c6083168_0
a2c2b7678606fb5f_0
af6f9265fdad4b1e_0
b019f52d95dcae6b_0
b5901ac71d8cfbee_0
b827c624dbf27111_0
baebc51da491b2bc_0
c6aa8e61aaa87dc0_0
c796a9a28320e412_0
d4ca7cbb89bea0c4_0
d6fdbdb985d38cad_0
d79e0a2891fc014a_0
dc7b47f23bfbb5eb_0
e0513585c34859ad_0
e320b988c0beb026_0
e38d9f099a86bbd6_0
e6eb2583ac5e2cd0_0
e93bf8a6b9ea2225_0
e9c7e700cc3e33cf_0
eae8ac79bdb269e6_0
ee55d30cdd191adb_0
f4aeffbce202bf58_0
f89ee544d7fe3a97_0
fa188f63f9980d47_0
fc15564f196d27a8_0
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
27d53659-6509-41e6-aba1-058f4298436d.tmp
000003.log
LOG
LOG
LOG
CURRENT
MANIFEST-000001
05d9a081-c6b0-4c99-a89b-43899fd8f073.tmp
07ef2e60-6fd7-4769-b130-6444989167ab.tmp
0af339ec-27d8-4fbf-9276-1519c5678fd9.tmp
1377e442-47b5-4582-ade5-396889cb5a8c.tmp
71710049-3cba-412d-9c92-bc2319a1780d.tmp
88faa94f-ff11-49e5-9731-5d01e930a67b.tmp
Sdch Dictionaries
a134d51c-ba07-4d7b-b193-c8220112206e.tmp
the-real-index
temp-index
the-real-index
01e3f40f30b277a6_0
01e3f40f30b277a6_1
28a70529f6095360_0
28a70529f6095360_1
44775383a35d81e2_0
44775383a35d81e2_1
59c60817ff9e5d10_0
59c60817ff9e5d10_1
6bc1803d8a198e39_0
6bc1803d8a198e39_1
6e89888019d5c28f_0
6e89888019d5c28f_1
74fb955605608caf_0
74fb955605608caf_1
7c5364b51a589eda_0
7c5364b51a589eda_1
92c51f28b6b2fd04_0
92c51f28b6b2fd04_1
a69ca6c58b82f2da_0
a69ca6c58b82f2da_1
acd2d9dcb79bb3a1_0
acd2d9dcb79bb3a1_1
b049bdb83e27aea8_0
b049bdb83e27aea8_1
b46dba7adb9e3b79_0
c260bfade8ced552_0
c260bfade8ced552_1
e4641ef292e4c171_0
e4641ef292e4c171_1
e957d8f7e66803ef_0
e957d8f7e66803ef_1
e9e0cdfbb013e977_0
e9e0cdfbb013e977_1
f7efedd8f5debd8f_0
f7efedd8f5debd8f_1
temp-index
the-real-index
temp-index
temp-index
temp-index
the-real-index
todelete_85b0b4bcd163e841_0_1
todelete_85b0b4bcd163e841_0_1
todelete_85b0b4bcd163e841_0_2
1d54aca837018128_0
temp-index
temp-index
temp-index
the-real-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
ba23d8ecda68de77_0
ba23d8ecda68de77_1
temp-index
the-real-index
Session_13437290551070524
temp-index
c75692d1-e32a-4ac2-b791-3412fa54d992.tmp
dab2e2a4-d728-476a-8614-c1ae61901352.tmp
ebca86f2-9955-4706-84fe-c5bf4b7432c5.tmp
f3c5b86b-65a9-48d5-9216-212432ce0089.tmp
940135e9-14b3-45d0-a549-f715f948edc4.tmp
RevisitationBloomfilter
aad5f934-0808-4e5c-b16a-344b036f3524.tmp
ac072275-96ca-4473-a3d6-9a9135411dd2.tmp
c7af72ec-d7ae-46cc-82e6-9657ac1a4f3e.tmp
d688e664-4da0-4bae-b26b-f4a5c79b0b2d.tmp
da8fb5f1-9e8e-49ee-b80b-a16aa7b9881b.tmp
e6d6f39f-c38c-4b44-915d-b56b4dd97213.tmp
eb4edf46-e5b2-43b8-a7a6-0fb05a0780ec.tmp
ec7145bc-dca3-4c55-b404-3ec369876ba4.tmp
87d7a058-7dcb-461c-b415-2b074467d3bd.tmp
fbb19960-137f-46f6-89fd-a93a2e389548.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
settings.json
settings.json
11868893640.json
OTAData.json
OTAData.json
OTADataCache.json
092f9604-4d04-42df-ba54-00fe8f6f4f1f.tmp
1c1d4164-fe04-4014-9337-a2baeae6f7c1.tmp
4b43ce2a-0584-4ad5-8adc-ede6e2ed546c.tmp
72af82fb-016d-4812-aa77-66c77611aba6.tmp
settings.dat
settings.dat
settings.dat
26f69280-2329-40b8-a06d-eb59a1f2f51f.tmp
index
000003.log
594ee32f-3840-43ab-b2e1-16ecd3d978e7.tmp
Cookies
Trust Tokens
Preferences
MANIFEST-000001
e1858244-59b8-4f26-9c32-90c9b97303df.tmp
Local State
43a1805c-c4ed-424e-9e62-879a4fe6762b.tmp
454a60bf-2cf4-44d3-a114-b6f5ec64ebe4.tmp
5f209205-b511-4e38-9650-b1c112873711.tmp
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
0de376e6-439b-410e-8318-e58c14706d92.tmp
2f8c8dd1-50a8-44ce-b819-51f6e8f48943.tmp
630cec76-ccfe-469c-a471-7e1b4cea3540.tmp
67b2ce6d-71f9-4841-828d-49ee898a0ac9.tmp
TransportSecurity
d4476548-e606-41df-b2dd-f810c9946325.tmp
e69f0630-9e2f-44b3-8e66-69ee94fbc957.tmp
Preferences
a8138c87-c7fe-4cba-817d-286111a404e2.tmp
d937cd20-d311-4568-bb45-3d0df48242c6.tmp
attachment_0.744.0.7441077_20261024T043032Z_Studio_A9A97_last.log
metadata
bc6b8f4a-42fe-4512-9f84-8080e6965df6.dmp
47e057006527b43850ac146e634a7338
RBX4455F80E17BD4D6EA4324C8C261DBC6C
default.dic
1cf2b1c2-fa49-4074-a540-e4ef3e366082.tmp
2000a70e-9f1c-4e37-8cd9-05d386bf60d0.tmp
Mighty-Omega.rbxl
RobloxStudioInstaller.exe
desktop.ini
memory/2684-2702-0x00007FF83EBF0000-0x00007FF83EBF1000-memory.dmp
memory/3532-2483-0x00007FF81EB90000-0x00007FF81F0DD000-memory.dmp
memory/3684-1888-0x00007FF634910000-0x00007FF635910000-memory.dmp
memory/3684-1993-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-2773-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-4022-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-4028-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-2767-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-4020-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-1886-0x00007FF81EB90000-0x00007FF81F0DD000-memory.dmp
memory/3684-4026-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-4018-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-4024-0x000002D10EAE0000-0x000002D10EEE0000-memory.dmp
memory/3684-3274-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-3372-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-2776-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-2763-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-2769-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/3684-2772-0x000002D0F1990000-0x000002D0F1D90000-memory.dmp
memory/5536-2622-0x00007FF83F6F0000-0x00007FF83F6F1000-memory.dmp
memory/5536-2623-0x00007FF83E7C0000-0x00007FF83E7C1000-memory.dmp
memory/5552-2548-0x00007FF83EBF0000-0x00007FF83EBF1000-memory.dmp
memory/6428-6747-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6753-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6755-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6757-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6751-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6749-0x00000282E5C70000-0x00000282E6070000-memory.dmp
memory/6428-6523-0x00007FF820920000-0x00007FF820E6D000-memory.dmp