9532c86c24eea48f0c2a5efef482572523720d85ed1e3cfabbd1186748a3f30b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxStudioInstaller.exe
Size 9.2MB
Sample260801-thb9dszfjf
SHA256 9532c86c24eea48f0c2a5efef482572523720d85ed1e3cfabbd1186748a3f30b
MD5 2f2c63aa3903cee592d68392f0b5eb84
SHA1 5ffa8767011923c6a964ee0d0fe68d3087042235
SHA512 6b3cba870382d451f0527be76f2f7ad3154e05c304571a592b6805b3fdb65e50ce8a2bccf6517d8affd5f08c6d82d12ad6eb6f9a4d93d0d9f8279463ed01076b
SSDEEP 196608:UxsUubFJrRcF24CilODX0ymaEjJeReBKH1VuJW:UxirRSADX0ZaEjJeFVwW
TLSH
T1FBA6BF22F941C031E5D101F2E6BD6FBA597C89240B3958D3A7C45DB849356E33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4600	RobloxStudioBeta.exe
4104	RobloxCrashHandler.exe

Loads dropped DLL 28 IoCs

pid	Process
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4104	RobloxCrashHandler.exe
4104	RobloxCrashHandler.exe
4104	RobloxCrashHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	RobloxStudioBeta.exe
File opened (read-only)	\??\F:	RobloxStudioBeta.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
900	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\mock-31ab8d40-0.1.0\mock\Spy.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\StudioContent\textures\DeveloperFramework\StudioTheme\search_20.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Flags\GetFStringInExperienceNotificationsLayer.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Providers\Style\BackgroundStyleContext.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\NetworkingAccountInformation\NetworkingAccountInformation\createRequestThunks.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-31ab8d40-1.1.107\RbxDesignFoundations\tokens\Common\Light\Component.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\PlayerList\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\GenerativeAI\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Settings\ReactPageFactory.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Settings\Flags\FFlagIGMChangeCapturesToGallery.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\VoiceChat\Flags\FFlagVoiceVolumeControlsEnableNotAudibleVoiceChatVolumeToast.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\Progress\Progress.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_3x_2.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\Deprecated\StaticFallbackImages.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\String\String\split.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\StudioSharedUI\preview_clear.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\PlayerList\Reducers\DisplayOptions.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\TopBar\Components\Presentation\menuIconHoveredSignal.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\StudioContent\textures\StudioToolbox\FallAnimationThumbnail.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\LocalizationTools.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Navigation\Dark\Standard\ArrowLeft.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\RibbonViewportFrame.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\PlayerList\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\DraggerTools\Light\Standard\Rotate_P.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Toast\ToastIcon.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\LegacyRbxGui\M1Side.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\VoiceChat\Unmuted0.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Lua\Localization\Light\Large\TextCaptureStop.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Server\ClientChat\MessageLabelCreator.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Ribbon\Light\Medium\RibbonLinearVelocity.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Lua\AdaptiveAnimationSupport\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\BasePlate.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\ServiceContractsProto\ServiceContractsProto\roblox\apppageplatform\shared\v1beta1\marketplace_bundle_data.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\StudioContent\textures\StudioToolbox\AudioPreview\play_hover.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\MicroProfiler\RCCProfilerDataCompleteListener.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\utilities\common\maybe.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Ribbon\Light\Standard\SpinboxControllerDownHover.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validationFolders\CurveAnimRotationBounded\CurveAnimRotationBounded.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\avatar\unification\UnificationServerScriptOldScale.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\Controls\XboxController\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\TopBar\chatOn.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Flags\FIntVoiceChatTooltipDelay.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\Server\ClientChat\MessageSender.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\Controls\PlayStationController\PS4\ButtonOptions.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\RopeConstraint.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\PlatformContent\pc\textures\sky\sky512_rt.tex	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\content\studio_svg_textures\Shared\Cursors\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\scripts\CoreScripts\Modules\TopBar\Flags\FFlagAlwaysShowGamepadNavigationDialog.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\InternalTextInput\InternalTextInput.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxStudioInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe\" \"%1\""	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9B2C9C52-B29E-4311-89F7-9FE36078F27C}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe,0"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ff6341faef444107\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-ff6341faef444107"	RobloxStudioInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4600	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2120	RobloxStudioInstaller.exe
2120	RobloxStudioInstaller.exe
2120	RobloxStudioInstaller.exe
2120	RobloxStudioInstaller.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe
4600	RobloxStudioBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4600	RobloxStudioBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4976	msedgewebview2.exe
4976	msedgewebview2.exe
4976	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1380	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1380	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4600	RobloxStudioBeta.exe
4540	OpenWith.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4600	2120	RobloxStudioInstaller.exe	91
PID 4600 wrote to memory of 4104	4600	RobloxStudioBeta.exe	92
PID 4600 wrote to memory of 4976	4600	RobloxStudioBeta.exe	98
PID 4976 wrote to memory of 5188	4976	msedgewebview2.exe	99
PID 4976 wrote to memory of 5940	4976	msedgewebview2.exe	100
PID 4976 wrote to memory of 5940	4976	msedgewebview2.exe	100
PID 4976 wrote to memory of 5940	4976	msedgewebview2.exe	100
PID 4976 wrote to memory of 5940	4976	msedgewebview2.exe	100
PID 4976 wrote to memory of 2176	4976	msedgewebview2.exe	101
PID 4976 wrote to memory of 1468	4976	msedgewebview2.exe	102
PID 4976 wrote to memory of 1468	4976	msedgewebview2.exe	102
PID 4976 wrote to memory of 1468	4976	msedgewebview2.exe	102
PID 4976 wrote to memory of 1604	4976	msedgewebview2.exe	103
PID 4976 wrote to memory of 1604	4976	msedgewebview2.exe	103
PID 4976 wrote to memory of 1604	4976	msedgewebview2.exe	103
PID 4976 wrote to memory of 1604	4976	msedgewebview2.exe	103
PID 4976 wrote to memory of 1604	4976	msedgewebview2.exe	103
PID 4976 wrote to memory of 2248	4976	msedgewebview2.exe	104
PID 4976 wrote to memory of 2248	4976	msedgewebview2.exe	104
PID 4976 wrote to memory of 2248	4976	msedgewebview2.exe	104
PID 4976 wrote to memory of 2248	4976	msedgewebview2.exe	104
PID 4976 wrote to memory of 2248	4976	msedgewebview2.exe	104
PID 4976 wrote to memory of 1892	4976	msedgewebview2.exe	105
PID 4976 wrote to memory of 1892	4976	msedgewebview2.exe	105
PID 4976 wrote to memory of 1892	4976	msedgewebview2.exe	105
PID 4976 wrote to memory of 1892	4976	msedgewebview2.exe	105
PID 4976 wrote to memory of 1892	4976	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\RobloxStudioBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\RobloxCrashHandler.exe
    "C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 4600 --attachment=attachment_0.732.0.7321040_20260801T160451Z_Studio_FDCC8_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.732.0.7321040_20260801T160451Z_Studio_FDCC8_last.log --attachment=attachment_log_0.732.0.7321040_20260801T160451Z_Studio_FDCC8_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.732.0.7321040_20260801T160451Z_Studio_FDCC8_csg3.log --attachment=attachment_log_0.732.0.7321040_20260801T160451Z_Studio_FDCC8_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.732.0.7321040_20260801T160451Z_Studio_FDCC8_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.732.0.7321040 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=1156fa98c4a70f733ebb6000d6ec2e8168132a4f --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.732.0.7321040 --annotation=UniqueId=6273674601451897380 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.732.0.7321040 --annotation=host_arch=x86_64 --initial-client-data=0x478,0x47c,0x480,0x454,0x48c,0x7ff6b5c0f708,0x7ff6b5c0f720,0x7ff6b5c0f738
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4600.4124.13015526498006789522 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x140,0x7ffb66695fd8,0x7ffb66695fe4,0x7ffb66695ff0
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3772 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 732, 0, 7321040" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3728 --field-trial-handle=1752,i,5532256993601561561,13603341824145709839,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:1892

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

qgif.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Plugins\Qt5\imageformats\qgif.dll
Size 42KB
SHA256 50d4baa1db453301c19c091995fc7010206d7c97e59b21431baa5ef46a980219
MD5 9600a70636894f6a934f2a7f14d6ae0a
SHA1 d0a4e0dc7e4c61bebbd91579bf15d260c1fc7230
SHA512 6a80ca6c6b8ba3fcb1be5de6ea39bf6a75a6206266112bf23a81a249684b567e50babf257d011d0272d28d3d345c501d0f3e576f397a22abdea8b94abb3412bf
SSDEEP 768:dVRwrbBk3Xj+7yFZxK7+WHUgnNx1+MhYWeEJPxUo:d3wrbej+G3U7+lgnNx4MhYWLPxr
TLSH
T1E9136B56AB7844D2E513C678D9AA4D2BE935FA305B6297CF432181780F323D23E3C66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Plugins\Qt5\imageformats\qjpeg.dll
Size 447KB
SHA256 582054e0a0d49c5e5eb60e09200dc236ae69459fab9894f39a7521786c2be2be
MD5 81b6df8cd8de9db1eeca252958ea9d1a
SHA1 e1ec20f7e3575d9595d38ca2ad8b5c521c7eccb4
SHA512 8cf35cc5b7a11aa7e7cdbc9dc626c5429b8f59079590092343b9b207839d34c46c1b9a2a7bbd4c5e136fae71396a698474c432428edcdc809825f003b6919231
SSDEEP 12288:/WbtMZ30x6oT93baQIYnMEMI3dZfsskUn5BLvUMCk//RFEciccjxRPCA4cTJF/eN:/WbtMZ3y1B
TLSH
T133A4A243F2605C87C7E54474EE6AC1A6E794B81CC7FB46F779C1ABD97A226F0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Plugins\Qt5\platforms\qwindows.dll
Size 1.4MB
SHA256 117c9b304c2c8f6bc2fb466f9a8323591b9213d388252f142081a3e84d3b638e
MD5 e81f163cbeb67ec8414c2ab3b4119647
SHA1 065921e56683b78097e125da120420136258ec55
SHA512 6700efcdae09a40e1907f56ee4fe2308422ce53ef76a13c434d1cd57a77d934e0bd583c8d96ced0fd250fd0ba727be6d7258692a6bbe19053b88fb48d188b13d
SSDEEP 24576:BgRZTqnadX9G01nyfcdGxOsFciSKi3kmbe7WAiYdZs9UIrIqrtQQ:oTqnadXw0xyfcdN8JQbOWAE/
TLSH
T11F658D57A3A48298C26BC23DC65B8B17D7B1700503619BCF11A88E597F63BE3277EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Plugins\Qt5\styles\qwindowsvistastyle.dll
Size 144KB
SHA256 792ddc958db80cfdb7132acf698c02367c02e27cb69ed04b7f4f542b0478c157
MD5 04a9a47fa806c912a22af17577566709
SHA1 2caca306233ef324d63ef3fd04937793ff2af912
SHA512 47c39a2e91f0444bec87055aa1592bea6b0fe5fa1996b4c1f3d38a1928381d8a536522e5f86cea3fb7c655920ccee66c468a1d02af152750a41fbe46c9aad032
SSDEEP 3072:AYfJgCoOdX7MNwr80krOTmUMVa/MFWxmqd0SQV8lWTxf:RBBXwL2Sa/MFWxmqd0SQVwWV
TLSH
T12BE34C13326602C6C463D2B8C55F0916F7B3B05853228BEF0667CEA92F533E27E79A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Qt5Core.dll
Size 5.8MB
SHA256 096b9818d0c825487069deba7709b718e78a53053e22124b8e4c537deb72ace3
MD5 f6c86aacc6126b0d2f442c6a88e57efe
SHA1 df1b891829c3005d045e3ba048292789d5e28fef
SHA512 8cb4d26c069074e2c5dd734e5d1cd085afd0742795024460d80b9b0b333dc01b5df7c5691c03ece34be20956daa63184eb8f028c5e1c27814124937ecb7c8ed5
SSDEEP 98304:kFO2h8E4EwNrZJsv6tWKFdu9CsViJQ8xqfSgw2:kFO2h8E4lNdJsv6tWKFdu9CsVOQ8xqfZ
TLSH
T10C569D8776AB0250D0B7C23CCAA7811BE672B8018B219BCF125CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Qt5Gui.dll
Size 6.5MB
SHA256 946a04ae8bcb2c33fcb8c98ce7280dd4599974e85ffb86d9101e595c678ad6d2
MD5 3bce6b45e07a747167349865b4bf4ac3
SHA1 d24d4b87ed035f897009cf0b5b711e6485533d89
SHA512 d7584ddd3c6cfc9bda1ddddd02b883aa974309770a478f138202f7540ae92b38cdc658149e4e8b4e76eb0280ab066e096558bd942367c20c018f0f716c09d1e4
SSDEEP 49152:jWM6LDUqcvRiHZHjTpTFpFEOPVQJqguaf5Q/J+5mkU7vo3qsJAGUD4topffcLnZN:wLDFv/+RmFaqBpfkCgnAiYCHecbp
TLSH
T18F662886725A6262C977E17D8B4F052EE1F3785283428BC748199B480F737EA1B7FE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Qt5Network.dll
Size 1.0MB
SHA256 bed1870edbf831cd654f1e609cb2f785b5904f743a3a14c70a1d624f9a8e0172
MD5 bb5ede48a003b21b63bb134435c4f5ff
SHA1 55d6cd8128d80c81a5fea49b9de4daa21d4a5ccc
SHA512 e5e62f3fbf1a9c82c13d0c192c1033d2c55d08ad3830ebbbe3b9252d0721651225ac39ab92d863ecd11bba62ac1c51f86422ffab9fcef6f5f20fdcf847a33afc
SSDEEP 24576:XKF0Nu0gZmVnhqMpH6Q7pX9U2BgrExZ8Wv:bNu04mVnf6cgrQf
TLSH
T10A355B67B36103A5D46AC1B8CA8B8502F67270018B669BDF5639DF693F737E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Qt5Widgets.dll
Size 5.3MB
SHA256 24b14e67f6ae8a8b0191d68a3576300bd0ecc240ec9417e94f0f04dcc15a12f2
MD5 5309de309fb00a4be24bb465f0053455
SHA1 a14ef29356dac72d882f663a426f16ab29bc3529
SHA512 0cebf0e1560f2ef8b140bfd4fba2b3d7a562923f1b45c84eff41dd02b5ce04a9402c937cb4708d4623ab02a8991bbe6a31acc3cbd17fe2079130313f33daa1e7
SSDEEP 49152:T8LcMQHZ/gD0bTG5/Zh4w0I6Lr86R21sQGxTkaeduxK6PBZrGBqfjoWjmqYjYhIb:qPQg6CHliIYKsonnYhIv7uP3S6x9W
TLSH
T122466B57B3A54184C16BD238CF8B8613D6B2700487628BDF256A8E592F737E22E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\Qt5Xml.dll
Size 215KB
SHA256 7315e183382b81e65be9e3efb2ae151f6c95fad914a0dbfbf0400dfab868af48
MD5 a24011ba1cba9e517da2d89d530329cd
SHA1 867f44a65128db05ec1c2842a52b2752ba22346e
SHA512 76d7115d7b5f57a609cae61e768b28cc873f30a4aea46a2b385e9c8be1e5bba7c73ce84731708fe12f28d691b06ec6dbb8579f5eb9eca92ecf83d94e97b98620
SSDEEP 3072:4rZx2zOZ+kzW8MWXJBPlGyGv+RQxm7uFkgs7pkV9p7RM7jJWTx/:4FxyOZtLMWXJBPlBbaxp6kV9p7CVWl
TLSH
T18C245B4777258596E427C238CE5B881BE673B85017628BEF81548B792F33BD2B87E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\QtitanBase.dll
Size 1.1MB
SHA256 f664bb3d87b127ab46650413a675f09784fd2d27cb98eae9f77e0c233a66a285
MD5 3c3626b2e692510326b71658f424e891
SHA1 6dfc8d44ab9a9dec11111c6f35138daf8d37c16b
SHA512 e7faabdbfd44ada8e579f9a9483bbad738f3c33fa2afec47d987db1456b2e0c3407f76d5067886991c423b43edcd2a1aa661a8dc3d09f2e7f57c7778c7b7663d
SSDEEP 24576:r3nRLlUv+otWr8wY6S8dtuTbwQitevsM:rXXUvNdwVu/kcvsM
TLSH
T14C45AF4B33964352D16BC278C69F8114F07734159B4286EF9A2BFE291E333E5383B6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\QtitanDocking.dll
Size 621KB
SHA256 ad5761ba9bee506bc9a1f4f0397fbc739eb8ad8544016a564cacb60979ad1273
MD5 c58473c626de265e2cead165e65c3d21
SHA1 3aa3d53110d01d51ec0f56fd988dce73f23076df
SHA512 b996e05ab9eed7d46b3fd21cb6f9432168ae6784a33e564cd9f138d36ff52e7ef594dcdb9ea7491be46f66c19f81c0d593a720f7f56b4490e5d63a4fcbc19b3f
SSDEEP 6144:qqpZco/36jOCZ0NesIZSNfFBg8UYS164o4TNQre4NMqINZIyavAj4vCDOZ4BVhg9:qs/CIkZ8fzvU564N4EmCDAnNg
TLSH
T16FD46C1B72780391E067D138C65BC626F4B77842476295EF6216EA2D6F33BE13A3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanRibbon.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\QtitanRibbon.dll
Size 3.1MB
SHA256 f02d3c963f8af77b638280c089ec607a891a291f6839dd815ffcf66764683aaf
MD5 01bd3e3ba233106d464db5a112f48154
SHA1 90b2270567b26225e0e5f8fa7927a7d15cdaf37a
SHA512 1dc29cd9d416164a1995b148ae37e2fd8d1e6ebb75a1025f7ef41233b96137785e0c43871266a723f44baa71020f1989b30d4adf6c06404f7cfb5ca3ba5414f0
SSDEEP 49152:BrTyq/LVyjq4LbhndL1ZsY0LUGGnVGvYEnCWCLn+XYKMcc/RotRNC7C7C7C7C7Cl:BvLUjbLnL1ZsY0LUGRjCWCL+IE
TLSH
T198E5CF8B77AA0298D2AEC13FD28B4555F5F7749A835386EB4926CD1A0F333E06C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\RobloxCrashHandler.exe
Size 11.7MB
SHA256 884c98d21a41763ea14040455e946bda1d5cdab602fbe0efa45c3645096e30b2
MD5 915ecbdd8c8614d8318a97158aefbbba
SHA1 d7ad5cd0dadfc9bedbe8868805850371849339b7
SHA512 d953444179cb4d7b9a4a595a49663975f28b1b408288a277bc942adad56d2fe970c9fb8346b50bbddd4f29daaab97b559c5ef8c6c83f7b4b4038a7942bf35271
SSDEEP 196608:mAQpXVhmGKh5617XA9B2VtHK7aT+w5wixNQ:IVHfJXKatHKM+NiHQ
TLSH
T163C69D6AB2B800E8D4BBD1BCC6469617E772741603709BDF1AA046F61F63BE41E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\libfbxsdk.dll
Size 9.7MB
SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
MD5 51d82c0e8ad65126413ed39246b5cf46
SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
TLSH
T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ff6341faef444107\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aa0e188985caeb3f33bf927317e65652d07bd71f43c50e60794b2ada345ee0cc
MD5 431c647a9bf76738690c713d08681f77
SHA1 993c8ee4c8ba04e4bb98a633205ea6c377d55578
SHA512 27e0c7a0056ab5caee37b03cab694720678b1ac964b8cad6439e1426a8af8bb41474997459287499b6e6a050aa9922c182910bfa43d5b1fe261450e8b7bd5338
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56991de7e5b849a28049a6a32afa1cd5c068b92600d139515b40290d69f950ec
MD5 318e8d1fa02a4ef4469963c70b2a480d
SHA1 c6d9d084eb1efc4188b1c9b1010bb7c577159433
SHA512 5a01710c0b8c4687ec09d843e61da9ac0d467363c2df82a3a7b064bc1af96e8193ba977698e5521f5a7fbf6a25f436aeacedc09200000e4beea703b5a7b1d86d
TLSH
T1B9D0123232010538C0106173011371090681C20F88094048582D85DD9F144600912461
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d243d0982ce89482d86a982892f3a982bdce103183e66f8a28fe4527863f1c0b
MD5 af55f907973dfb055962db27d358446c
SHA1 a5476c013511b35d7ca3685a78896c607eca7223
SHA512 da1aff77a3ddad04706e1bdada4e64aa4ec3ec454a8188b72ec4307497056f079784f8b7e61b1744eb20215a523cd18d7ed57a6b1e8c32b05ca1c98d3fa66b64
TLSH
T1D041EA3C84E197DECF16807342E0AD08A755DCFC480B5FC7EB000472811FAC23A22195
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad87f.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ad87f.TMP
Size 48B
SHA256 618f477730a9f0304f850b31e022fd3cecd0247fa87351a2cdb0096be8e7844c
MD5 faff18f3cea24a1b3f41898115155ffa
SHA1 fb2a1f8b128de7456086eea75f903f3e8dcdd180
SHA512 11ab2a18b1869401866e0ee210f5e9e7ba76798bdb7c8427ab4466aebdc722ef975fdb24b573edf474206b9fe0e32b745760562dc2932dd6f0a95e491aabfaaf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 18d7ab60b1c3bee7b3b572a96a9c3032ca316eb5948e924f6472c6e6eb98b9f8
MD5 41c7a3a1f7f587a2b20158be5a0a8309
SHA1 f6a315df230a21cc9a69e20ca18c0ec5525eedda
SHA512 8acc339368ed94ba5bf2e42aa08cc1f0308ec91af4a7b89fa69d3f46224d928a6393ad5957af113ffeebb5be2ec7ba399a359b3f4087fc40b5ce770f045dea0b
TLSH
T12A41A0ABA1FFB74B102E497B2E407805597AB43E1551A8F5CF63D23DB0828F74721632
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 5e72010721291af6ae0fe8c0e8f3543fe9be69132a6884225a99581c1bda57f7
MD5 74c0cc4cb6f698dbfdc30d2a9cd8fa44
SHA1 9ad17cf1d2bc02633db1e67679eb56fac819b76f
SHA512 e4cc8bdf20866d122ad0cbafffcede7af11cd744927009093c09598f90a9fe0d6e12498de2c6161af707c18789edb3399aa14367a01cbaf3b72702db500d1b57
TLSH
T1D4419EABA1FFB74B142E497B2E407805197AB43E1551A8F5CF63D23DB0828F64721672
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5ad34f.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5ad34f.TMP
Size 1KB
SHA256 73f363357756a45cf059abeac22d2fcb40f9b9ed270a618399e0c60faf53ddcf
MD5 8fd554ac9a9dcbcb4b16260500119bcf
SHA1 c2a5b784c55acd6d001ee1cde16ff4dbb5caed92
SHA512 8338c8509530fa0c6ac77a6801f3ff3bc7bac083cea15d2e6e580f5d3fbd21f80f0b2489c436fb32f5e6254f99d650ab68d2f332b922e9b01a2e86e323dd845c
TLSH
T1E341A0ABA1FFB74B102E897B2E407805197AB43E1551A8F5CFA3D23CB0864F74721632
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 8d933a914ee1150cea03efcb1a5d774ec1b212a351263dce479374b20e73cea3
MD5 a87e2122a439023162e37a3132d15035
SHA1 faf452a47256816a6dbbfcabec364ca7f38ccdb5
SHA512 03bf8ec30f10c10cbe538c98275b95fb8303c61f397bc521552c0b102a6fce1b51790c6800d56e306f5f7fdcdd508f8b792b899b0175078afae5b04a50158c46
SSDEEP 96:stt/dxi8fb9Dkado5h16ZmWs7/x+6MhmuecRs71ejedK+gdkq28XM1C7K:stxXxlodWsV+Fts7Qj7P/G6K
TLSH
T160D195065E28797B4CCAE118BA65BF03E3F5602274D51E58E7FC552C04DBADD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 06bfb941674f5a53dead48bfc10beca789c8737f7f26da644c48b163f565c862
MD5 6f0b8d5bddd9221c6b642a4b6c6e0d32
SHA1 ada1ac531e551d6fa5b0f53d660db990804739e7
SHA512 7192b221529c290e2f32f66fa1dddf77f5e693be5e6828de5c33244441f413bc375aec877653c4b5f023d4242f249ef300b9e7176de7793d97f9c1492910a546
SSDEEP 96:stt/dxi8fb9Dkgo5h16ZmWs7/x+6MhmuecRs71ejedK+gdx28XM1C7K:stxXx7odWsV+Fts7Qj7PxG6K
TLSH
T1F8D194165E2869BB4CCAE119BA297F53E3F5603264D11E58E7FC462C08DBADD630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 2KB
SHA256 66b13264a8fc1e1b15f8b48a5e60ec35878871a6a7fb5ffaaea9cea8530c9d00
MD5 2173360a62d737cfe98c4f6558df0a6a
SHA1 34d69c159ce3eb08969220705bf34ff97594aab0
SHA512 43e0ba2b3ed0be9a2b7a241165b21cd8007582526a7c93d9020cc33caacb87c3098ef112148275e604ac1522740ee17708aa0912d3448249de04fa22bc434c04
TLSH
T1BA5195336D24AF37A9F65A14788B3E238F355065AA412F6096ED0F0C01D7A9C1342C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 f286c77427e468a11ce7fc1ece9ff538b999a16bf307861856ae2475d551f057
MD5 f6633171c159b3e38c019078f2db1a19
SHA1 f0f890eeb5a01c0b595627afc22885b2f9c6ccc0
SHA512 5fda8f99e550d7b8379c8b3dbc1c5b5bf6b8920dbd775c2863021a9069833c3e3e76486d2542b229159e9b395753ced770ad1f772395f9a7685eae77832f8ed1
TLSH
T1527196326974AA275DE6EA04B9C63F17AB655067E9843FA4C6FC0F1C01DB7D81342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 15KB
SHA256 5cd040f2cc88f235ae35c9db116b7d2cfa2eaf5f3d03c5b8acd11b67ec05d737
MD5 427be11f8dd8961e1070fe72ad184af8
SHA1 afdbdef6a162503881242d7b9b5bc122ff702c9a
SHA512 581740e3e129d257557e9e7ea5069c117d2a49247cc68b76c341aec1943cec4af315474ea682c15359da5707c505dbcb1954b2269428403e4904e368a9669d48
SSDEEP 384:2+aQikB+z/xvxjg/qhEb3NBSRQMA8jAVdpxQqr9zU:B/UxvxjgC+bSFTjUqqrFU
TLSH
T1C5729D2759797E23A5F7FA14798D1B5BCBB494B250C12EB84ABD5F0906C77E80302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 75e926f39bbb02ca3895e70a30316055bba3eed89acf65d31267d1b6381dfbee
MD5 d18b35c90b125cbec415f6c6dd21244b
SHA1 510d2abd98f1aba804391770295991150cefc9fd
SHA512 3d4339c0131c097b2978668252737cd2fef633a276569429bd431432360b53eac98d0703f76c93537d3b5c4605d19fb5bc9fe4bfc1155710977967b8c5310dbf
TLSH
T1896152376974AA279DF6AA14B8C63F16ABA55027E5853FA4C6EC0F0C01D77981342C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a790a.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5a790a.TMP
Size 1KB
SHA256 603fdb75e726917d853d881fafe27213f1a413c2cf91564b2af9e39437ccd008
MD5 f6320e8c20fb3f3a1a178268bfd0d95d
SHA1 585d07a7ef157cbed09b13dc024b5ed5bce4e3e7
SHA512 089fe31525bc3f426abdbde07f4810cf1217f0e4a427419964c52cd38706458272ede433b2c214d7a4bb4d34ce6a21d5cb44bad0aba5f67b4e810287849324cc
TLSH
T1E221357398B85F33FCA5775531877D175F21506A92400E1052DE4F1902E778C9676C35
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxStudioInstaller_48B93.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_48B93.log
Size 6KB
SHA256 767d169683063ad0076dfb718f4bfa28c248b2a4fc2d9bfb0e16d58c6499b0a9
MD5 5b7cd1bb1d678cef940d84f5a7b79dbe
SHA1 915ad697fca97698878f8ccf8a64298cfb77b940
SHA512 61d85c8525e883471d1f8b5a0113d12217da2f4a7b2fa522165bc0855a998bb78c7a2c3e00e4a27e36f00f35b40ff984b2cc07423658d248f66b40529b46a4a2
SSDEEP 96:KFmDjoSm8jz8HQH/1QuLSOOhy2PpSoLBp/J6l/2enRpgT9Z2:0mDnf2p4nRpoU
TLSH
T195E10D19C3D64179370E168F9796EC7F9313BD02213AA374F6EF944FE7C4284A586A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 227KB
SHA256 416df7c7a6af3d35b06b3aee5e736b02c8aefd4a3b9be31befc1c97ab323ffa6
MD5 e46c5d007899d693a9d325fbfbbd4bbb
SHA1 9ba4aecc4a92a85513911e1f3b4b8d772953e7a4
SHA512 22854ba77d031021cb04c66fba6bb6d700d8a42e0d1270a20866d16fffd3a63f030eac535b529bdd7f41ea0eaed8970df54f45b75c7f46815ba867669ce55c1f
SSDEEP 3072:gHetHRqCCZjlkKSNY5h61W2BzEY2S1S4dmGf3IcCJjEWh3c+dogltO/ZyOTi1Pj1:sqU9NgI6FdZL52dTOgwQh1hV1AP2u2FZ
TLSH
T13D34AFAACF953C4A28E3E094C9AB037ED919C3629DDAB0B31D593845C78973D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 2c44284c45b0fb08b89affafca0a3fdb9643b041b252c67aadf13b3465171a07
MD5 1c5b8957aa9fb1f09b8b517daeabc8c7
SHA1 047fcbe1ef495afba7de673c8a25115331c3883d
SHA512 db590267f7324edca99fc1775842fa9a6efa51cccce303e491d6adb9647974b8b105c84bea1982386eab3365515077119421d5ca3cbdf43611e959eea1d86223
TLSH
T158A0222022A82000C88F3033300332083C8C080080280C33808A2FC00228BC0EE3CB0A
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-353-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/2120-4-0x00000000089C0000-0x0000000008A00000-memory.dmp

Download

memory/4600-120-0x00007FFB683B0000-0x00007FFB688FC000-memory.dmp

Download

memory/4600-121-0x00007FF6A9090000-0x00007FF6AA090000-memory.dmp

Download

memory/4600-224-0x0000015CF3780000-0x0000015CF3B80000-memory.dmp

Download

memory/5940-605-0x000001784EE70000-0x000001784EE72000-memory.dmp

Download

memory/5940-616-0x000001784F2F0000-0x000001784F2F3000-memory.dmp

Download

memory/5940-617-0x000001784EFB0000-0x000001784EFB5000-memory.dmp

Download

memory/5940-614-0x000001784F2E0000-0x000001784F2E2000-memory.dmp

Download

memory/5940-612-0x000001784EFC0000-0x000001784EFC2000-memory.dmp

Download

memory/5940-604-0x000001784EE40000-0x000001784EE41000-memory.dmp

Download

memory/5940-606-0x000001784EE40000-0x000001784EE41000-memory.dmp

Download

memory/5940-607-0x000001784EE80000-0x000001784EE82000-memory.dmp

Download

memory/5940-610-0x000001784EE40000-0x000001784EE46000-memory.dmp

Download

memory/5940-609-0x000001784EE90000-0x000001784EE93000-memory.dmp

Download

memory/5940-351-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download