Analysis
- user interaction
yes - max time kernel
1050s - max time network
1049s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:00
General
- Target https://webstaurantstore.com
- Sample261027-1w1bpsvx5p
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 32 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://webstaurantstore.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5500594524055333934,2164218783975711175,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6053387399422376783,16069068207241153384,262144 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,3120948133547668392,5719574676831227206,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,10054859585068938433,2390158823490183686,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,8130147282997584047,14998061850914618922,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4416,i,9813322767603419425,15471864167274812680,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4440,i,9161467844905769988,6879259503918249120,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,10756232694242469356,5512328564254557773,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,6342427304001693502,17067898459521810978,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5412,i,3126647550335216864,9416242604715159489,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2506964419408816896,2390527049285891308,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2506964419408816896,2390527049285891308,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6592,i,14360708606924717012,1374992514052569573,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,6013477656773662078,6443059309197488890,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5832,i,231648178338388304,14312290142279362682,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13526678807960417498,4019740447828879967,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6132,i,11241840193019168133,1072320336001618677,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7128,i,14587105389626766732,17235712390552432149,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,9954989396029082426,4728880105277917402,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,4894552427591275801,4623010011594373210,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,17962610942388306934,11123995217189331601,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2060,i,5340311002301928343,11286680285327656900,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,5762044036466870259,17248431357452311914,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,315279375639711924,2786151942318424356,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3920,i,12924314983188026243,4956987322271065474,262144 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,3197320760384924043,4345544277247560081,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12043995929591346063,3089084946429155350,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,8663266564377280938,5572325788251226228,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3832,i,7003637654183795657,381810563576232154,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3828,i,7882590085800858329,8845979945778180854,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6728,i,4132345453608028625,11873740747369308727,2097152 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7754259056773014620,1991669654363623567,524288 --field-trial-handle=2328,i,12205502663782616614,6117500194964739250,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 42523⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 42523⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x25c,0x2cc,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7482809147518230922,4502041588769692306,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,15394015340958168778,2899474493912967140,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,9575668708927924651,11753410764306200256,262144 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,363396638404476840,1081462238352527097,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,2376500449566029020,15045151558739817359,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,2376500449566029020,15045151558739817359,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,6705223946247928152,7736806872666415650,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,809969816791353359,12322464505559143506,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,65755952365574735,15013749190181554608,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,17732986440844892717,5059179130527249729,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10228067942239582276,15216449378386071904,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,4539650587919990175,6626073836414903654,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2810777867425315389,14741940396525557302,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=164 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,15036245885059532460,779577105596100907,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11517574246511782890,2023070457309075246,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,8589865699877152273,5862935887270676086,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2972,i,1124409192213336356,12817144471901496279,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4636,i,13747167805463928442,10881600537934808954,262144 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1121135669192424769,15373229232466278771,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2944,i,7922931826931542007,9383760601027623346,2097152 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3748,i,14621552406720586916,3690401866231172605,2097152 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,11467303431228415447,4391237598864037022,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,12538308880140374189,7987663665227799286,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5984,i,10086573081469958813,12179189919068556749,2097152 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5572,i,12376449867109944579,3971094550274570530,2097152 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6568,i,13727006667473547985,18308660157693551508,2097152 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3723284131941599322,9442806615060118756,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,12876612325192913900,15155682729263603501,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3439060222385819489,2453677913222224190,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8417844303864004818,16180194127046507274,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,2706761594982843706,5799759503893357357,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,4691781081101654903,10363914318491620291,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,13367675590705723213,9575631518855725873,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,7436245651170689716,16403379656455940878,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10663986629675227143,2603368239127019846,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,17929341368802133776,16193391259976320209,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,17858144254861392562,13985163834171196231,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,3093608086773897945,6456077545811861814,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,9140514304087095181,17872889250211328469,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,7934958002730129473,13744745947194537261,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,14995383556611325455,5731764899457746546,524288 --field-trial-handle=2236,i,6015123117217050690,14853095056231259417,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-7062aec9dbe74b14\RobloxStudioBeta.exe"C:\Program Files\Roblox\Versions\version-7062aec9dbe74b14\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Roblox\Versions\version-7062aec9dbe74b14\RobloxCrashHandler.exe"C:\Program Files\Roblox\Versions\version-7062aec9dbe74b14\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 932 --sentryUrl https://sentry-relay.rbxinfra.com/api/15/minidump/?sentry_key=c17c3208072138b08e2d48575a4b31a7 --sentryDbPath C:\Users\Admin\AppData\Local\Roblox\logs\crashes --sentryLogPath C:\Users\Admin\AppData\Local\Roblox\logs\0.745.0.7451137_20261027T220823Z_Studio_6D962_last.log --sentry-upload-via-crashpad --attachment=attachment_0.745.0.7451137_20261027T220823Z_Studio_6D962_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.745.0.7451137_20261027T220823Z_Studio_6D962_last.log --attachment=attachment_log_0.745.0.7451137_20261027T220823Z_Studio_6D962_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.745.0.7451137_20261027T220823Z_Studio_6D962_csg3.log --attachment=attachment_log_0.745.0.7451137_20261027T220823Z_Studio_6D962_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.745.0.7451137_20261027T220823Z_Studio_6D962_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.745.0.7451137 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 11 - PlatformId 2, Version 10.0, Build 26100" --annotation=RobloxChannel=production --annotation=RobloxGitHash=d2664f400cfdcaac1737922bdc152abd0f363f90 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.745.0.7451137 --annotation=UniqueId=3043933740034354469 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.745.0.7451137 --annotation=host_arch=x86_64 --initial-client-data=0x470,0x474,0x478,0x44c,0x480,0x7ff7b354ac88,0x7ff7b354aca0,0x7ff7b354acb83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=932.1932.2691577255208884744 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff97aa65fd8,0x7ff97aa65fe4,0x7ff97aa65ff04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,6725828748262588870,4894183082317338943,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1736,i,6725828748262588870,4894183082317338943,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1736,i,6725828748262588870,4894183082317338943,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1736,i,6725828748262588870,4894183082317338943,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=932.1932.7535393906956788768 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1a0,0x7ff97aa65fd8,0x7ff97aa65fe4,0x7ff97aa65ff04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3624 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3896 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4804 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4820 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5092 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5096 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4992 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 745, 0, 7451137" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4852 --field-trial-handle=1752,i,16164541145968314842,9360836781144439315,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/account/signupredir?ReturnUrl=https%3A%2F%2Fapis.roblox.com%2Foauth%2Fv1%2Fauthorize%3Fclient_id%3D7968549422692352298%26response_type%3Dcode%26redirect_uri%3Droblox-studio-auth%253a%252f%26scope%3Dopenid%2Bcredentials%2Bprofile%2Bage%2Broles%2Bpremium%2Bverification%26state%3DeyJwaWQiOiI5MzIiLCJldmVudF9oYW5kbGVyX25hbWUiOiJFeHRlcm5hbExvZ2luRmxvdyIsImRhdGEiOiJHeEMzalE5WWYxWS03LWd0bDJ6cmZiTUJURU9IYUFFZVoxTmpTU0gwWTBNIn0%253d%26nonce%3Did-roblox%26code_challenge%3Duh5VI3vcT-0cs-1ULlu2B3E7pzDCAGpDQDNJ2I5i-cQ%26code_challenge_method%3DS256%26rlt%3DGtUvccF6rUUC0YJdWKRlX20FpCfSZ6Nsx7KxtTnteEWelJaNsXx1WJXip0nXGEVdTcfblY_3g02qBuQiDkIoDVPAGrabi0H3D1UlS5u2tyQIkTI-I5AzfU8BFxn6issAzHP1abtAyqpRnSy7BuRlaA3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000005081⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Debugger Evasion
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
5System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
1975be00-0a21-49be-8dcc-2f92afb5aa0e.tmp
1c12dc89-12ad-4afd-a975-6c15ec152455.tmp
1d3c3ee0-edd3-4492-a358-7be9aeb1e8f3.tmp
1e363cc2-ee80-4e12-a3fd-08b97701ded1.tmp
1f0ac3af-6207-4706-be8c-9d79e8425c7c.tmp
31431eab-8f86-4319-a65c-9e07a941fada.tmp
5feac336-fa77-4b2e-a7f9-bad4e2589103.tmp
70198bcb-ee52-4e4d-942d-43688018a5ca.tmp
751ba2ad-a174-47b0-94ec-42b161c97076.tmp
8a0f9fb8-5f08-4d0b-b840-4a8ede67a151.tmp
996d98a8-d2a7-4424-9d8e-c345a4add1ba.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
0432d813-584b-47be-86b4-ea267787fbd8.tmp
09170e56-1a66-4644-b1d5-02e8a47fad1f.tmp
0a4c855b-d4a4-4d6d-9378-8acef62feac4.tmp
1cd277db-1c4b-4520-923c-d1e33f852672.tmp
1f4288d1-abb9-4ec7-a55b-f46f7984564f.tmp
446130d1-a017-4962-968e-7ff4288aa42f.tmp
56f53ca8-8e07-41fd-8314-c38c80a8694c.tmp
5a93c059-f092-4ba4-a34c-7d69e30dd578.tmp
6a90dc3d-6699-4983-bc42-0097d32b8dc8.tmp
7c9149e3-6560-443f-b9ca-fe75d3e60fe3.tmp
991c80bb-004a-4769-b2ca-f2b0370de37b.tmp
9edc233c-f39a-4171-8e50-77d856985c92.tmp
LOG
LOG
LOG
f_00006c
f_00006e
f_00006f
f_000070
f_000071
f_000072
f_000076
f_000077
f_000078
f_00007c
f_00008c
f_000095
f_0000a5
f_0000aa
f_0000c7
f_0000c9
f_0000cf
f_0000d1
f_0000f4
f_0000f5
temp-index
temp-index
temp-index
temp-index
temp-index
f26dd93c-6844-449a-8ee4-6409dfce95ec.tmp
dasherSettingSchema.json
History
2d0ddbe9-a0fd-4351-b812-501c7039ecc3.tmp
5ef29410-0f7e-4c3c-b5f6-7224a922eb7e.tmp
6da44cc0-ecd3-4029-9ad0-445020b13b4f.tmp
Network Persistent State
f90f1be3-b506-4443-b3bc-1b15f653b8b2.tmp
fb1bf825-a3fd-47bc-8bb0-55d58027bff8.tmp
Preferences
temp-index
the-real-index
temp-index
the-real-index
temp-index
the-real-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
the-real-index
CURRENT
000003.log
LOG
sync_diagnostic.log
MANIFEST-000001
a22daf4c-c628-4763-93b8-523f57ad783f.tmp
a53f9661-9179-48b2-aa50-1bf8544cd202.tmp
bdb83e88-6959-4aa4-8516-bc73139509d0.tmp
e0ae2a6a-96ce-4f6b-9a30-ba341d139f8c.tmp
ef754fef-43ef-49f9-b851-fe9f40798c1b.tmp
ef8761f7-3364-45c8-8abc-a43719e7ec48.tmp
2b308db3-66a6-4368-bb17-f54f2fa59406.tmp
data_1
Last Version
Local State
RevisitationBloomfilter
data_1
Variations
b93f3f06-0634-4e7f-b735-49f70bd80947.tmp
b9b91fe7-e1d9-40b8-b647-5a8c13bc49e4.tmp
c2aad3d4-17b6-46ff-a7c4-c1a6ba0cee52.tmp
ced25ecf-3215-433d-a4f1-e3c4c460b472.tmp
2531771b-effd-445f-9fa0-eaeda0269c5c.tmp
3898a2db-8ed9-45f2-bf5f-20f0b7ff6425.tmp
53c0c9db-5b5b-4f14-ab0d-d42595ad048d.tmp
53e49fcf-6d41-416d-a5dc-d8171be3f4f6.tmp
57e75628-0938-400f-8dca-a63ea259dafc.tmp
72ea3025-b675-4d32-8691-43ffb1e54790.tmp
7be88f22-d671-4df0-aa20-ac3346dcf4da.tmp
a1719f89-0541-4341-a976-503ca1806943.tmp
d0ba4e75-8de1-4fbe-b7ab-107e17bc21bb.tmp
d7b6f07f-1fbe-494c-ae6e-351d6005255f.tmp
ea5eeeb6-95bc-45f7-b624-593851312cb1.tmp
eb2398ac-e6f3-46d6-bba6-dbf28344de64.tmp
d3178669-ae00-49be-80ed-defe9f30c000.tmp
e8e3a053-c19d-4bef-ae6d-eec9c90cbc35.tmp
0b167092-b593-421a-ba39-2f812625b1d5.tmp
f9f52725-43fe-45e3-97af-1bac764f4c1f.tmp
05ad996224bf0ecb21cd232070fbbd2b
10461fdfb35f35cca13dbe35dcf21343
13bd4d729bed81aaed788e7904476fbe
1d0390337d1a4a58e5514be1a9481ad6
563d8cc62e048b6cdf1bee62d5b10f4e
5a42c025c62155a3fc5a56d2daeac79d
7071af81f7fad1d26ec29b7699f2d96f
79e23478b3ddcd4806b0029d1ab9c637
8f379ec2b22ff106b837d79f7fdbf0d8
b0eaea6e38883c2f552ebfc3c49a66a7
eb9dd4d0637fd6ae21747e6b6a281d21
edcdd98952ba768dfb23269dc84a4d40
eeb373c702b98d7ff02b9e6190f607a1
fe7b3ecee91e83f9fade72e8b0f4d47f
OTAData.json
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
InstallerInfo.log
07cf436b-c386-410d-8d78-2b34a861bd4f.tmp
143e69d5-7386-4619-86b2-1472a6786064.tmp
7db969a0-aed5-434c-934f-2d523c11aeef.tmp
946e0f58-7004-489e-ba85-b7148d4fa5aa.tmp
settings.dat
settings.dat
settings.dat
0c3d19aa-3b86-4064-9abc-ed9c8f7e4d30.tmp
2462fc54-9350-4aac-8587-2896a3063ad9.tmp
621f5176-755d-4c67-b6b6-36c9d55c1493.tmp
f_000002
f_000006
f_000009
temp-index
MANIFEST-000001
290bba43-85f5-47a0-97d7-724e208b2bba.tmp
2f1d2391-8609-44f0-9bc1-d95ad949e6ad.tmp
4760070d-0f1e-4d54-9e40-29201591c184.tmp
4ea94b06-f313-41f9-91a9-b0a16bb3ff92.tmp
86a4cad7-89db-42f3-8c80-4a1077448420.tmp
TransportSecurity
a8b6521c-d364-4230-a82d-8554ab7728b4.tmp
be8b05c9-28aa-4ec2-9d08-e0a5620eb893.tmp
dca84cab-5e9d-4d9e-998a-b8924aa09d3f.tmp
index
data_0
data_2
data_3
Local State
bab1c4d1-02f0-4a23-a569-333442367d83.tmp
fcb32235-614d-4d4e-9be9-4501c578bed9.tmp
cacert.pem
48326076-0948-4748-8d65-4c00234a9fd2.tmp
5c1bc39f-c641-43ad-ab72-3bcd7fe205c4.tmp
47e057006527b43850ac146e634a7338
8913724486d5e3c463c493b25346ca31
RBXE6A00C0023B64F979F5385F359812FF6
content.js
messages.json
default.exc
67MKBCWYTAF3KCCV3TYY.temp
6MISWSIKINR6BCM2K8IV.temp
RobloxPlayerInstaller.exe.crdownload
manifest.json
manifest.json
verified_contents.json
keys.json
manifest.json
crl-set
protocols.json
manifest.json
manifest.json
manifest.json
Other
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
memory/932-2401-0x00007FF7A5CE0000-0x00007FF7A6CE0000-memory.dmp
memory/932-2402-0x00007FF97C790000-0x00007FF97CCDD000-memory.dmp
memory/932-2481-0x00000245D2C70000-0x00000245D3070000-memory.dmp
memory/2340-3036-0x00000201A46B0000-0x00000201A46B2000-memory.dmp
memory/2340-3029-0x00000201A4450000-0x00000201A4452000-memory.dmp
memory/2340-3027-0x00000201A4440000-0x00000201A4442000-memory.dmp
memory/2340-3026-0x00000201A4410000-0x00000201A4411000-memory.dmp
memory/2340-3028-0x00000201A4410000-0x00000201A4411000-memory.dmp
memory/2340-3032-0x00000201A4410000-0x00000201A4416000-memory.dmp
memory/2340-3031-0x00000201A4460000-0x00000201A4463000-memory.dmp
memory/2340-3039-0x00000201A4580000-0x00000201A4585000-memory.dmp
memory/2340-3038-0x00000201A46C0000-0x00000201A46C3000-memory.dmp
memory/2340-3034-0x00000201A4590000-0x00000201A4592000-memory.dmp
memory/2536-3720-0x00007FF9A0F70000-0x00007FF9A0F71000-memory.dmp
memory/2536-3721-0x00007FF9A1C60000-0x00007FF9A1C61000-memory.dmp
memory/3080-2619-0x00007FF9A1330000-0x00007FF9A1331000-memory.dmp
memory/4284-382-0x0000023A1D5C0000-0x0000023A1D97B000-memory.dmp
memory/4284-546-0x0000023A1D5C0000-0x0000023A1D97B000-memory.dmp
memory/4300-2620-0x00007FF9A1330000-0x00007FF9A1331000-memory.dmp
memory/4352-2191-0x000001E28B3E0000-0x000001E28B79B000-memory.dmp
memory/4352-2192-0x000001E28B3E0000-0x000001E28B79B000-memory.dmp
memory/6972-3932-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3936-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3939-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3937-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3940-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3941-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3938-0x00000284D9920000-0x00000284D9921000-memory.dmp
memory/6972-3930-0x00000284D9920000-0x00000284D9921000-memory.dmp