Overview

overview

7

Static

static

3

RobloxStud...er.exe

windows10-2004-x64

7

RobloxStud...er.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/09/2026, 23:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxStudioInstaller.exe
  • Size 9.7MB
  • Sample260905-31dplsbm4y
  • SHA256 fb34893244fe4fb1ad194fd915f38d8cefcbe905284b543bcfc98dcfb345bee8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxStudioBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe
        "C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 1068 --attachment=attachment_0.737.0.7371584_20260906T000031Z_Studio_0B982_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.737.0.7371584_20260906T000031Z_Studio_0B982_last.log --attachment=attachment_log_0.737.0.7371584_20260906T000031Z_Studio_0B982_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.737.0.7371584_20260906T000031Z_Studio_0B982_csg3.log --attachment=attachment_log_0.737.0.7371584_20260906T000031Z_Studio_0B982_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.737.0.7371584_20260906T000031Z_Studio_0B982_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.737.0.7371584 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=5edcedc5242d3cc71d4f9fbc9e73967ed4bf1c87 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.737.0.7371584 --annotation=UniqueId=8124873968034670913 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.737.0.7371584 --annotation=host_arch=x86_64 --initial-client-data=0x434,0x438,0x43c,0x410,0x448,0x7ff6342edaa8,0x7ff6342edac0,0x7ff6342edad8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3924
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1068.4568.6432740468977994930
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x118,0x7ffde58eb078,0x7ffde58eb084,0x7ffde58eb090
          4⤵
            PID:2340
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,10824134376516232546,11466211212792197160,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
            4⤵
              PID:4672
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1352,i,10824134376516232546,11466211212792197160,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
              4⤵
                PID:4352
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1732,i,10824134376516232546,11466211212792197160,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
                4⤵
                  PID:4932
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,10824134376516232546,11466211212792197160,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
                  4⤵
                    PID:5424
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
              1⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3252
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x344 0x458
              1⤵
                PID:2216
              • C:\Windows\System32\GameBarPresenceWriter.exe
                "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                1⤵
                • Network Service Discovery
                PID:5572
              • C:\Windows\system32\OpenWith.exe
                C:\Windows\system32\OpenWith.exe -Embedding
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:5996
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                1⤵
                • Checks processor information in registry
                • Modifies registry class
                PID:6132

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    AppSettings.xml
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\AppSettings.xml
                    • Size 144B
                    • SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qgif.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\imageformats\qgif.dll
                    • Size 31KB
                    • SHA256 dece9af97994b58962a3aab7da662527e509b4c86a8881bc93fda31d048cb18b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qjpeg.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\imageformats\qjpeg.dll
                    • Size 437KB
                    • SHA256 beecab928e1a2adc179db2f959c38798bfe06d6a84c8720d4a62a71a61388884
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qwindows.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\platforms\qwindows.dll
                    • Size 1.4MB
                    • SHA256 f389819f6aaab61aee384e93996d5e4326b8e3b8c956f55d62b042c1dcef9866
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qwindowsvistastyle.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\styles\qwindowsvistastyle.dll
                    • Size 134KB
                    • SHA256 7adcaa0e2d1f2837280adee6df339b3e7b934e7edeab653fc80bf390e622317f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Core.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Core.dll
                    • Size 5.8MB
                    • SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Gui.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Gui.dll
                    • Size 6.5MB
                    • SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Network.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Network.dll
                    • Size 1.0MB
                    • SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Widgets.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Widgets.dll
                    • Size 5.3MB
                    • SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Xml.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Xml.dll
                    • Size 204KB
                    • SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    QtitanBase.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanBase.dll
                    • Size 1.1MB
                    • SHA256 43f05f34af9eab78549c1b636b1560176decaf4b685526c3833d8c4d89d52e54
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    QtitanDocking.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanDocking.dll
                    • Size 620KB
                    • SHA256 bf24fd350b7166addcdb68fcc7204c6ff092bd071a0e456042583843359ea0cc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    QtitanOffice2016Style.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanOffice2016Style.dll
                    • Size 218KB
                    • SHA256 3b248e50012469038589b3a8a0976570b28021a5b3349dc5d9b166b7d19cdeb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    QtitanRibbon.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanRibbon.dll
                    • Size 3.1MB
                    • SHA256 e99860d832931bfd751db819f88f553c37d7e905f33f116efba2870116816e26
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RobloxCrashHandler.exe
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe
                    • Size 11.7MB
                    • SHA256 85e4cdc59d30fd9a3ee4fd3eac5fe251af9f9b3f2ec717761617b101d01bc57b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebView2Loader.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\WebView2Loader.dll
                    • Size 162KB
                    • SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dd-win-prof.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\dd-win-prof.dll
                    • Size 3.8MB
                    • SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libfbxsdk.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\libfbxsdk.dll
                    • Size 9.7MB
                    • SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msvcp140.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\msvcp140.dll
                    • Size 540KB
                    • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msvcp140_1.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\msvcp140_1.dll
                    • Size 34KB
                    • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\vcruntime140.dll
                    • Size 120KB
                    • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140_1.dll
                    • Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\vcruntime140_1.dll
                    • Size 46KB
                    • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    44b95492bd8693f310fc4b2c4fbabe53
                    • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-studio\44b95492bd8693f310fc4b2c4fbabe53
                    • Size 9.6MB
                    • SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 2e94e80b9aee870aa712170d7b2198ea71f78afb858e89fd7031e00a15488a4f
                    • MD5 SHA1 SHA512
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 6851d82d02d3e212ef536dbe2f59215693f33cf70f8cab9034d9a1042036487e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    throttle_store.dat
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                    • Size 264KB
                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    SCT Auditing Pending Reports
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512
                    Submit Download

                    CURRENT
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                    • Size 1KB
                    • SHA256 71741e006d78b972952f904c12644b502608e8a2e2cb3dc6cbdce1d74760aef9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                    • Size 2KB
                    • SHA256 09e33cda005fc1315bc9a1488cc895e97565e647f645206e84bcc200d134744e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                    • Size 3KB
                    • SHA256 261615b47d6f4df99834cf0199e46e23549f460d0449cbc8a39df4254a97d921
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                    • Size 3KB
                    • SHA256 a2858e5164353fba6fd31172c4125ccad7749e1dccd03f3898fdcdce226c9fcb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State~RFe5a72a1.TMP
                    • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5a72a1.TMP
                    • Size 1KB
                    • SHA256 da5cb39ba18a432dc232dc01e43055ee27898e2757c28a6aed55591c22ef0d8d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RobloxStudioInstaller_36996.log
                    • Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_36996.log
                    • Size 8KB
                    • SHA256 da6de7ea6b814f7ab2b7db2a566a79e8f0afac2a42495bb74f5fd2092296b217
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cacert.pem
                    • Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
                    • Size 223KB
                    • SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    8913724486d5e3c463c493b25346ca31
                    • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
                    • Size 64B
                    • SHA256 0b7a31b36eb9575c23fa2b4b516c3e8d66cc3d88fbb73d1a1b6fefc379fae05a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_khpeadq5.ykn.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khpeadq5.ykn.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1068-382-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-380-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-125-0x00007FFDE73F0000-0x00007FFDE793D000-memory.dmp
                    Download

                    memory/1068-194-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-127-0x00007FF6271D0000-0x00007FF6281D0000-memory.dmp
                    Download

                    memory/1068-374-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-376-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-378-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/1068-373-0x0000025A4B4F0000-0x0000025A4B8F0000-memory.dmp
                    Download

                    memory/3252-5-0x00000210F66E0000-0x00000210F66F0000-memory.dmp
                    Download

                    memory/3252-16-0x00000210F8C70000-0x00000210F8CE6000-memory.dmp
                    Download

                    memory/3252-17-0x00000210F66E0000-0x00000210F66F0000-memory.dmp
                    Download

                    memory/3252-15-0x00000210F8BA0000-0x00000210F8BE4000-memory.dmp
                    Download

                    memory/3252-14-0x00000210F6660000-0x00000210F6682000-memory.dmp
                    Download

                    memory/3252-18-0x00000210F66E0000-0x00000210F66F0000-memory.dmp
                    Download

                    memory/3252-6-0x00000210F66E0000-0x00000210F66F0000-memory.dmp
                    Download

                    memory/4672-263-0x00007FFE13800000-0x00007FFE13801000-memory.dmp
                    Download

                    memory/4672-545-0x00000249C5E10000-0x00000249C5EDD000-memory.dmp
                    Download

                    memory/4932-291-0x00007FFE12F70000-0x00007FFE12F71000-memory.dmp
                    Download

                    memory/4932-297-0x00007FFE13630000-0x00007FFE13631000-memory.dmp
                    Download