Overview

overview

8

Static

static

3

RobloxStud...er.exe

windows10-2004-x64

7

RobloxStud...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    899s
  • max time network
    901s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxStudioInstaller.exe
  • Size 9.7MB
  • Sample260703-rxt2msa13t
  • SHA256 92e1535fbc7308e919611600301249167e065e22c7aa69f1c16e5b0e8097b848
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 28 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\RobloxStudioBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\RobloxCrashHandler.exe
        "C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 4948 --attachment=attachment_0.728.0.7280895_20260703T143628Z_Studio_58475_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.728.0.7280895_20260703T143628Z_Studio_58475_last.log --attachment=attachment_log_0.728.0.7280895_20260703T143628Z_Studio_58475_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.728.0.7280895_20260703T143628Z_Studio_58475_csg3.log --attachment=attachment_log_0.728.0.7280895_20260703T143628Z_Studio_58475_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.728.0.7280895_20260703T143628Z_Studio_58475_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.728.0.7280895 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=d02d3cbeeb145ec46a44f4fd40ff3d10a8ec195c --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.728.0.7280895 --annotation=UniqueId=7026824636016978398 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.728.0.7280895 --annotation=host_arch=x86_64 --initial-client-data=0x47c,0x480,0x484,0x458,0x48c,0x7ff680bfe278,0x7ff680bfe290,0x7ff680bfe2a8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:236
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4948.1116.16337446232730468911 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:5892
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x110,0x194,0x7ffcd6055fd8,0x7ffcd6055fe4,0x7ffcd6055ff0
          4⤵
            PID:2452
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1760,i,111671889858385514,1948555457886155892,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
            4⤵
              PID:4856
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1760,i,111671889858385514,1948555457886155892,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
              4⤵
                PID:4900
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1760,i,111671889858385514,1948555457886155892,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                4⤵
                  PID:4224
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1760,i,111671889858385514,1948555457886155892,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
                  4⤵
                    PID:3540
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4948.1116.9879535241465647282 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                  3⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of WriteProcessMemory
                  PID:2144
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffcd6055fd8,0x7ffcd6055fe4,0x7ffcd6055ff0
                    4⤵
                      PID:4452
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                      4⤵
                        PID:1328
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                        4⤵
                          PID:1600
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2808 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                          4⤵
                            PID:4168
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3572 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
                            4⤵
                              PID:6004
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3940 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
                              4⤵
                                PID:5864
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                4⤵
                                  PID:6724
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4780 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6884
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4288 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                  4⤵
                                    PID:4844
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                    4⤵
                                      PID:6992
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                      4⤵
                                        PID:2904
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                        4⤵
                                          PID:3180
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4928 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                          4⤵
                                            PID:2284
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5076 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                            4⤵
                                              PID:4260
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                              4⤵
                                                PID:5280
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                                4⤵
                                                  PID:1984
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5104 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                                  4⤵
                                                    PID:4304
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 728, 0, 7280895" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4996 --field-trial-handle=1796,i,2293133544168505932,17122162437407630737,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
                                                    4⤵
                                                      PID:4080
                                              • C:\Windows\System32\GameBarPresenceWriter.exe
                                                "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                1⤵
                                                • Network Service Discovery
                                                PID:3124
                                              • C:\Windows\system32\OpenWith.exe
                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                1⤵
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5536
                                              • C:\Windows\system32\AUDIODG.EXE
                                                C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004E8
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:416
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                1⤵
                                                • Drops desktop.ini file(s)
                                                • Checks processor information in registry
                                                • Modifies registry class
                                                PID:1412
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:3220
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                  1⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:2512
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  1⤵
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1704
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe /LOADSAVEDWINDOWS
                                                    2⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2304
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1068
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3644
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                  1⤵
                                                    PID:4176
                                                  • C:\Windows\System32\SecurityHealthHost.exe
                                                    \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                    1⤵
                                                      PID:4360

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          AppSettings.xml
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\AppSettings.xml
                                                          • Size 144B
                                                          • SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          qgif.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Plugins\Qt5\imageformats\qgif.dll
                                                          • Size 42KB
                                                          • SHA256 50d4baa1db453301c19c091995fc7010206d7c97e59b21431baa5ef46a980219
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          qjpeg.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Plugins\Qt5\imageformats\qjpeg.dll
                                                          • Size 447KB
                                                          • SHA256 582054e0a0d49c5e5eb60e09200dc236ae69459fab9894f39a7521786c2be2be
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          qwindows.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Plugins\Qt5\platforms\qwindows.dll
                                                          • Size 1.4MB
                                                          • SHA256 117c9b304c2c8f6bc2fb466f9a8323591b9213d388252f142081a3e84d3b638e
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          qwindowsvistastyle.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Plugins\Qt5\styles\qwindowsvistastyle.dll
                                                          • Size 144KB
                                                          • SHA256 792ddc958db80cfdb7132acf698c02367c02e27cb69ed04b7f4f542b0478c157
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Qt5Core.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Qt5Core.dll
                                                          • Size 5.8MB
                                                          • SHA256 096b9818d0c825487069deba7709b718e78a53053e22124b8e4c537deb72ace3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Qt5Gui.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Qt5Gui.dll
                                                          • Size 6.5MB
                                                          • SHA256 946a04ae8bcb2c33fcb8c98ce7280dd4599974e85ffb86d9101e595c678ad6d2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Qt5Network.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Qt5Network.dll
                                                          • Size 1.0MB
                                                          • SHA256 bed1870edbf831cd654f1e609cb2f785b5904f743a3a14c70a1d624f9a8e0172
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Qt5Widgets.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Qt5Widgets.dll
                                                          • Size 5.3MB
                                                          • SHA256 24b14e67f6ae8a8b0191d68a3576300bd0ecc240ec9417e94f0f04dcc15a12f2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Qt5Xml.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\Qt5Xml.dll
                                                          • Size 215KB
                                                          • SHA256 7315e183382b81e65be9e3efb2ae151f6c95fad914a0dbfbf0400dfab868af48
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          QtitanBase.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\QtitanBase.dll
                                                          • Size 1.1MB
                                                          • SHA256 2d33074b73eec970efc643265d41d847e59c5f57f2800c62102c063a9ee1795d
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          QtitanDocking.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\QtitanDocking.dll
                                                          • Size 617KB
                                                          • SHA256 ce26007acabfbcc8ab61a26dc303d68fb29d5ec848e6c4d65cb5d65bbccb1b3f
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          QtitanRibbon.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\QtitanRibbon.dll
                                                          • Size 3.1MB
                                                          • SHA256 c7be116bc4b4e37a21987c0c721b3332abd14abc45518a75afed6654bb05784f
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          RobloxCrashHandler.exe
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\RobloxCrashHandler.exe
                                                          • Size 11.7MB
                                                          • SHA256 fc0f4a9ea85095b0943d579f52ebb5a2f121c1c8c749d7d7fbe311984f169c72
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          WebView2Loader.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\WebView2Loader.dll
                                                          • Size 162KB
                                                          • SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          dd-win-prof.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\dd-win-prof.dll
                                                          • Size 3.8MB
                                                          • SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          libfbxsdk.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\libfbxsdk.dll
                                                          • Size 9.7MB
                                                          • SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          msvcp140.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\msvcp140.dll
                                                          • Size 540KB
                                                          • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          msvcp140_1.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\msvcp140_1.dll
                                                          • Size 34KB
                                                          • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          vcruntime140.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\vcruntime140.dll
                                                          • Size 120KB
                                                          • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          vcruntime140_1.dll
                                                          • Path C:\Program Files (x86)\Roblox\Versions\version-8b44d8f2067642d8\vcruntime140_1.dll
                                                          • Size 46KB
                                                          • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prep_Activatable Class_Hermes_perf.cache
                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                          • Size 595B
                                                          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.json
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
                                                          • Size 2B
                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 58f2e18f976888530f22ae1e342508723019f9041d7d8a8f7facfc45f9ea1b30
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 071b4c0a557ae68f8440e771dc6baf2c04b71bcb8723db956ee1e031db5cf2a2
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 eb2fa8a3dcd88d4197796c753c78a236c3197784d12dc7874d3617118f6940e8
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          throttle_store.dat
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
                                                          • Size 20B
                                                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 2KB
                                                          • SHA256 506197df492727bc1f70ae1b29f151e42728e0ce12dcc2d6bdd6beaa4140f2f1
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          CURRENT
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\CURRENT
                                                          • Size 16B
                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          MANIFEST-000001
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
                                                          • Size 41B
                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          History
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\History
                                                          • Size 164KB
                                                          • SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Cookies
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Cookies
                                                          • Size 20KB
                                                          • SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
                                                          • Size 61B
                                                          • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
                                                          • Size 1KB
                                                          • SHA256 332649d087b9aa4ed65eeea638c0ca0dd4c7cd4e162d9c1cc165b3b5272a0e39
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
                                                          • Size 111B
                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SCT Auditing Pending Reports
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                          • Size 2B
                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          TransportSecurity
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
                                                          • Size 2KB
                                                          • SHA256 114e0a340916d9f65062336474a36d99749f1b6011c52baf98819e6ac381a9a3
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          TransportSecurity
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
                                                          • Size 2KB
                                                          • SHA256 389d38fffffdb568ad37b7103a6f86d5337693046c66378ac509093684c6d760
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          TransportSecurity
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
                                                          • Size 2KB
                                                          • SHA256 4690d1a80dd295d7fecbf4be2afd81de71dfbf8f792fccc9ddace2dabb908f96
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          TransportSecurity~RFe59dd47.TMP
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59dd47.TMP
                                                          • Size 2KB
                                                          • SHA256 e72a497f072515035717adc1b5ed545169ba444f3538509b973dec27ec3bb7c1
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Trust Tokens
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Trust Tokens
                                                          • Size 36KB
                                                          • SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
                                                          • Size 5KB
                                                          • SHA256 5be0bcaaf073a3df3500af7dcf8dfd9e80c75a4e2dd90084967df6c5d4ff59ec
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 3c60608391e159a95e29da9d1e6cf91db5053ca487d09041f6370f3b3b3f974d
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 2b5fb705ea1ad53e29a73535f5d0e413ce23ad8a5e5c23c994373bbba0606f32
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Secure Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences
                                                          • Size 6KB
                                                          • SHA256 f228abe4952b85a8f61b136ecd561748cb24218e248240cbcf08e4d806517a5a
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          index
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index
                                                          • Size 24B
                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                          • Size 48B
                                                          • SHA256 491bdd39df1553462045b38713d2a5efd0fa20e9bdf5c2636ac5a8c7d0c18dea
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          db
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\db
                                                          • Size 44KB
                                                          • SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          LOG
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\LOG
                                                          • Size 335B
                                                          • SHA256 59c9421e25f74b06a346f10d54569a5d289791398a89acc2a3395f0f1f238961
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          LOG
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
                                                          • Size 311B
                                                          • SHA256 71e234bdd91e38402027e64738ea799867906712d49ab75f491da1143e44c326
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Visited Links
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Visited Links
                                                          • Size 128KB
                                                          • SHA256 ced80a71438be8375896487ab374bdabaee23da26e76cb480dc3e6fcd88f0f29
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_0
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_0
                                                          • Size 8KB
                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_1
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_1
                                                          • Size 264KB
                                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_2
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_2
                                                          • Size 8KB
                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          data_3
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_3
                                                          • Size 8KB
                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Last Version
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Last Version
                                                          • Size 14B
                                                          • SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                                                          • Size 2KB
                                                          • SHA256 377a8c74a40f81d804b9523527b8fb27c70a0475fcb780f157a141de394addf9
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                                                          • Size 3KB
                                                          • SHA256 6a10209e4205bc5450b54444b653195b77c8ea2c52dec97db1abd45e190e4406
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                                                          • Size 3KB
                                                          • SHA256 a96fddaf120028c271908081eaaf9a0c2f58dc0b98bc45b9f49e3e7df3eb607b
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                                                          • Size 3KB
                                                          • SHA256 807b094d4701626a523f46012df7436124821892b9d106d51ef29e8fb81a5627
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                                                          • Size 15KB
                                                          • SHA256 770d82ce302601202376f222c3fa3ad72b3bbe5c998f44d2c5414bd8e445c572
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State~RFe597fc5.TMP
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe597fc5.TMP
                                                          • Size 1KB
                                                          • SHA256 c03e9f0c1f474dfab5246cdb82c5c94379516e13dcb78e054522fb37492ba0a0
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          data_1
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\data_1
                                                          • Size 264KB
                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          index
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\index
                                                          • Size 256KB
                                                          • SHA256 ecc66c6e2bb4a5ee37cac0e233b1921682d00c2a83056ca58fd5b465f8677085
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Variations
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Variations
                                                          • Size 86B
                                                          • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          RobloxStudioInstaller_859DE.log
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_859DE.log
                                                          • Size 6KB
                                                          • SHA256 dc3d1fa80ed80c90bb1708b0d8722d2eb7e4eba8ce2ca7454a6bb9b103edae9b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          cacert.pem
                                                          • Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
                                                          • Size 223KB
                                                          • SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          8913724486d5e3c463c493b25346ca31
                                                          • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
                                                          • Size 64B
                                                          • SHA256 091886471b5a7ac6e4b7565ffd8a0531ff37efdda2b3555bbe6f95d6dddbd96d
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          desktop.ini
                                                          • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                          • Size 190B
                                                          • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-bn.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2144_1560979302\hyph-bn.hyb
                                                          • Size 703B
                                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-mr.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2144_1560979302\hyph-mr.hyb
                                                          • Size 687B
                                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          hyph-nn.hyb
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2144_1560979302\hyph-nn.hyb
                                                          • Size 141KB
                                                          • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Staging
                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2144_164411963\Mu\Staging
                                                          • Size 36B
                                                          • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          memory/1068-840-0x0000014714890000-0x00000147148B0000-memory.dmp
                                                          Download

                                                          memory/1068-803-0x0000014704450000-0x0000014704550000-memory.dmp
                                                          Download

                                                          memory/1068-775-0x00000147001E0000-0x00000147002E0000-memory.dmp
                                                          Download

                                                          memory/1068-815-0x0000014704370000-0x0000014704390000-memory.dmp
                                                          Download

                                                          memory/1068-802-0x0000014704060000-0x0000014704080000-memory.dmp
                                                          Download

                                                          memory/3540-329-0x00007FFCFB470000-0x00007FFCFB471000-memory.dmp
                                                          Download

                                                          memory/3644-968-0x000001A407B60000-0x000001A407C5F000-memory.dmp
                                                          Download

                                                          memory/3644-1232-0x000001A407B60000-0x000001A407C5F000-memory.dmp
                                                          Download

                                                          memory/4856-314-0x00007FFCFB470000-0x00007FFCFB471000-memory.dmp
                                                          Download

                                                          memory/4948-228-0x000002648A630000-0x000002648AA30000-memory.dmp
                                                          Download

                                                          memory/4948-114-0x00007FF6744D0000-0x00007FF6754D0000-memory.dmp
                                                          Download

                                                          memory/4948-113-0x00007FFCD7BF0000-0x00007FFCD813C000-memory.dmp
                                                          Download

                                                          memory/6724-1037-0x00007FFCFB470000-0x00007FFCFB471000-memory.dmp
                                                          Download

                                                          memory/6724-1036-0x00007FFCFB6D0000-0x00007FFCFB6D1000-memory.dmp
                                                          Download

                                                          memory/6884-1065-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1066-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1064-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1068-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1067-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1069-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1058-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download

                                                          memory/6884-1060-0x00000268986F0000-0x00000268986F1000-memory.dmp
                                                          Download