f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxStudioInstaller.exe
Size 9.7MB
Sample260925-tp8aeass5j
SHA256 f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884
MD5 1af32d57481feea13059c4a5e4a88ad4
SHA1 5cb4ecb9f5455a037a47c97ca88e246e91029f9d
SHA512 80a79ff4071a16d2b9d8fda93eedaa198b5682f9e27e005c384fabd12491041b03c0adf6f1fd4a0e0bc890f7e7c5870ad534176591195891f7d08fb28ad8c849
SSDEEP 196608:QjpoO6empKfLco4G97msxy3Sd23X+dccBfHYlUBUTSMn:Q2eQKL7msxzd23X+dZBfHYdL
TLSH
T1EAA6AF22B900C032E9C200B2D6BDAFFA997D99341B7954D3A7D41DB959305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5144	RobloxStudioBeta.exe
8	RobloxCrashHandler.exe

Loads dropped DLL 23 IoCs

pid	Process
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
8	RobloxCrashHandler.exe
8	RobloxCrashHandler.exe
8	RobloxCrashHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	RobloxStudioBeta.exe
	\??\E:\	RobloxStudioBeta.exe
File opened (read-only)	\??\F:	RobloxStudioBeta.exe
	\??\F:\	RobloxStudioBeta.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\utilities\graphql\storeUtils.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\StyleDefaults.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\unification\testScripts\CodeBlockTestScript.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioContent\textures\StudioToolbox\Gallery.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\ui\PlayerList\AddFriend.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\ui\VoiceChat\MicLight\Unmuted80.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Large\warning.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\CustomFolder.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioContent\textures\TerrainTools\radio_button_bullet.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Lua\AvatarInstances\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\Common\LegacyThumbnailUrls.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence\RoduxPresence\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\SignalsReact\SignalsReact\rotriever.toml	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\Collections\Collections\Array\map.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\ActivityHistory.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Clipboard\Light\Large\Undo.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\NetworkingChat\NetworkingChat\networkRequests\createGetLatestMessages.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\ClimbController.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Actions\OpenReportSentDialog.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\Graphing\Graphing\Components\GridLine\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\MomentsCreationFlow\MomentsCreationFlow\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Lua\StartPage\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Debugger\Light\Standard\StepOut.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\Progress\Progress.code.md	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\ReactSceneUnderstanding\ReactSceneUnderstanding\traversal\useLazyInstanceCollector.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Analytics\FireEvent\fireDiagCounter.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioContent\textures\AnimationEditor\img_dark_scrubberhead.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Clipboard\Dark\Standard\Paste.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\FTUX\Utility\MockFTUXStyleAndLocalizationComponent.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\ToggleSwitch.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\TestMatchers\toBeOneOf.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Container\HorizontalPageMargin.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\ViewRecyclerReact\ViewRecyclerReact\Stories\Demos\DemoResponsiveCollection.story.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioContent\textures\Debugger\debugger_arrow.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\ui\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\ui\PlayerList\Block.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Debugger\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\LocalizationTable.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\Cryo\Cryo\List\removeIndex.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\TopBar\Components\MenuIconContext.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\scripts\CoreScripts\Modules\Tracker\TrackerPrompt.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\StatusBadge\StatusBadge.code.md	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-31ab8d40-4.0.11\RbxDesignFoundations\KineticEnergy\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\AvatarEditorImages\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\textures\ui\Controls\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\BodyPosition.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateFacsJointBounds.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioContent\textures\StudioToolbox\AssetConfig\[email protected]	RobloxStudioInstaller.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_434858098\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_434858098\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_434858098\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_434858098\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_434858098\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxStudioBeta.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe\" \"%1\""	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-c792f79abddd41bd"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe,0"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c792f79abddd41bd\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-c792f79abddd41bd"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place	RobloxStudioInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5144	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
984	RobloxStudioInstaller.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5144	RobloxStudioBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
940	msedgewebview2.exe
6056	msedgewebview2.exe
6056	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5004	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5144	RobloxStudioBeta.exe
5144	RobloxStudioBeta.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5144	984	RobloxStudioInstaller.exe	91
PID 5144 wrote to memory of 8	5144	RobloxStudioBeta.exe	92
PID 5144 wrote to memory of 940	5144	RobloxStudioBeta.exe	95
PID 940 wrote to memory of 2384	940	msedgewebview2.exe	96
PID 940 wrote to memory of 3800	940	msedgewebview2.exe	97
PID 940 wrote to memory of 3800	940	msedgewebview2.exe	97
PID 940 wrote to memory of 3800	940	msedgewebview2.exe	97
PID 940 wrote to memory of 3800	940	msedgewebview2.exe	97
PID 940 wrote to memory of 5888	940	msedgewebview2.exe	98
PID 940 wrote to memory of 432	940	msedgewebview2.exe	99
PID 940 wrote to memory of 432	940	msedgewebview2.exe	99
PID 940 wrote to memory of 432	940	msedgewebview2.exe	99
PID 940 wrote to memory of 5060	940	msedgewebview2.exe	100
PID 940 wrote to memory of 5060	940	msedgewebview2.exe	100
PID 940 wrote to memory of 5060	940	msedgewebview2.exe	100
PID 940 wrote to memory of 5060	940	msedgewebview2.exe	100
PID 940 wrote to memory of 5060	940	msedgewebview2.exe	100
PID 5144 wrote to memory of 6056	5144	RobloxStudioBeta.exe	101
PID 6056 wrote to memory of 5780	6056	msedgewebview2.exe	102
PID 6056 wrote to memory of 1176	6056	msedgewebview2.exe	103
PID 6056 wrote to memory of 1176	6056	msedgewebview2.exe	103
PID 6056 wrote to memory of 1176	6056	msedgewebview2.exe	103
PID 6056 wrote to memory of 1176	6056	msedgewebview2.exe	103
PID 6056 wrote to memory of 2964	6056	msedgewebview2.exe	104
PID 6056 wrote to memory of 1308	6056	msedgewebview2.exe	105
PID 6056 wrote to memory of 1308	6056	msedgewebview2.exe	105
PID 6056 wrote to memory of 1308	6056	msedgewebview2.exe	105
PID 6056 wrote to memory of 4496	6056	msedgewebview2.exe	106
PID 6056 wrote to memory of 4496	6056	msedgewebview2.exe	106
PID 6056 wrote to memory of 4496	6056	msedgewebview2.exe	106
PID 6056 wrote to memory of 4496	6056	msedgewebview2.exe	106
PID 6056 wrote to memory of 4496	6056	msedgewebview2.exe	106
PID 6056 wrote to memory of 744	6056	msedgewebview2.exe	107
PID 6056 wrote to memory of 744	6056	msedgewebview2.exe	107
PID 6056 wrote to memory of 744	6056	msedgewebview2.exe	107
PID 6056 wrote to memory of 744	6056	msedgewebview2.exe	107
PID 6056 wrote to memory of 744	6056	msedgewebview2.exe	107
PID 6056 wrote to memory of 5964	6056	msedgewebview2.exe	112
PID 6056 wrote to memory of 5964	6056	msedgewebview2.exe	112
PID 6056 wrote to memory of 5964	6056	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxStudioBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxCrashHandler.exe
    "C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 5144 --attachment=attachment_0.740.19.7400931_20260925T161637Z_Studio_6FCA4_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.740.19.7400931_20260925T161637Z_Studio_6FCA4_last.log --attachment=attachment_log_0.740.19.7400931_20260925T161637Z_Studio_6FCA4_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.740.19.7400931_20260925T161637Z_Studio_6FCA4_csg3.log --attachment=attachment_log_0.740.19.7400931_20260925T161637Z_Studio_6FCA4_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.740.19.7400931_20260925T161637Z_Studio_6FCA4_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.740.19.7400931 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=07c234fd1c25eade6b6d878706568f9f7e5b22e3 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.740.19.7400931 --annotation=UniqueId=8178711278619966697 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.740.19.7400931 --annotation=host_arch=x86_64 --initial-client-data=0x48c,0x490,0x494,0x468,0x49c,0x7ff7e4237688,0x7ff7e42376a0,0x7ff7e42376b8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5144.1876.17907414438581773233 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x140,0x194,0x7ff873485fd8,0x7ff873485fe4,0x7ff873485ff0
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,7701034445782015280,10374109251377163312,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1720,i,7701034445782015280,10374109251377163312,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1720,i,7701034445782015280,10374109251377163312,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1720,i,7701034445782015280,10374109251377163312,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5144.1876.8347611587702122321 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x168,0x16c,0x170,0x164,0x1cc,0x7ff873485fd8,0x7ff873485fe4,0x7ff873485ff0
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1932 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3872 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 740, 19, 7400931" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4184 --field-trial-handle=1736,i,12732269171461117553,4941582195873021776,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

qgif.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Plugins\Qt5\imageformats\qgif.dll
Size 31KB
SHA256 dece9af97994b58962a3aab7da662527e509b4c86a8881bc93fda31d048cb18b
MD5 99975861a5d0d911055bc3a74c6a9678
SHA1 7aa39db708751a6f5b4c70f0a459acf8757640b2
SHA512 5e6f24b1c717fac7d363a2753a2fdbb07d4162567c6149bd10e1f823f7b372db991fdcdb62e8f6e9d2a5c017a0b069837bc898d69ed0bab5efd78131bcc1d902
SSDEEP 384:pk2xgrGXnLxRwrbos5k3Xjsz77RoFXRnxqVbn+rPCHJ9RPzN4XNuBSMhOliycGNe:dVRwrbBk3Xj+7OFZx17nMgxfNGyMh
TLSH
T1B5E21A51AB7800D2E153C278C82B4E2AE63AB9309B6397CF476255790E337D17E39778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Plugins\Qt5\imageformats\qjpeg.dll
Size 437KB
SHA256 beecab928e1a2adc179db2f959c38798bfe06d6a84c8720d4a62a71a61388884
MD5 0b9d61478c31e86b146ece524e0ee7ae
SHA1 ada89e70eb76728ede965b9f1c119590ffcb5961
SHA512 0673249659ec54b8f773fbe951592ab4de9f4380ce073198ee386d5440ea64d80539aff1efcc6cf49220cb877ffaf9797af40fb9cf7f5d819f6daf12563068e8
SSDEEP 12288:20bdHW+4bJKYjtnLqgYIqcUcYHtpP880E3JxbwEcS0vPh10syMLzBhfywIsD51PZ:20bdHW+gF0
TLSH
T182949243F2605C87C7E54474EE6AC1A6E785B81CC7FB46F779C1ABD97A226F0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Plugins\Qt5\platforms\qwindows.dll
Size 1.4MB
SHA256 f389819f6aaab61aee384e93996d5e4326b8e3b8c956f55d62b042c1dcef9866
MD5 884071d45df422efbbfb24a07172d9e4
SHA1 80540a7878e896dfcca1539e692c52fa76f44c2a
SHA512 63ea7de2f6363a2fb774a683a7fe9d95a82ddd521b5145b6bc97c4f51d9f1ab889b19ec2eeb5fe60c3d29aec5c224881050d9b59cd725e8d4cd4a283c17ca510
SSDEEP 24576:IeEQtwlTkBnj3Htp4ysAqV3QXscl+HflpWkiVPaEzeZji:ElTkBnLHtp4yslV3L//naVlzA
TLSH
T119659D47A3A48298C26BC23DC65B8B17D6B1700503619BCF11A9CE597F63BE3277EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Plugins\Qt5\styles\qwindowsvistastyle.dll
Size 134KB
SHA256 7adcaa0e2d1f2837280adee6df339b3e7b934e7edeab653fc80bf390e622317f
MD5 59f7f63e9c0a42bfb6bddd77150dd9e2
SHA1 ac5524db6f171941b51d09c0df160004bba95dab
SHA512 b405747868030d63c8173bf8d51552d05e326938389470246fe6a3df3f45eb1ea9eb75dd910df5faba61891c11d5444fe8d35b5b03de40b779479e24c15e2e9c
SSDEEP 3072:UYfJgCoOdX7MNwr80k7OTGD+FJ+FOa/MFWxmqd0SRVdff:9BBXwLGva/MFWxmqd0SRVd
TLSH
T1EDD34D13726602CAC463D2B8C55F0517F7B3705453224BEF06A7CEA92F632E27E3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Core.dll
Size 5.8MB
SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
MD5 5979d6d629dbe9bb074bf2c771f22499
SHA1 a28a748f5fd712fdad425dbb6f1f53c4b97bab6e
SHA512 5c296a8eb3f48ca741bef70e44aa6103edeaf903637c83fd9695e5be4465188a0aa5d5d2c4b707cd5233c0a19782e2857b11aca1ef33e408ff0b2e1cb739fd15
SSDEEP 98304:Zp4b13+8FH9aoHVJsv6tWKFdu9CwjiC6ExqfUCAgw:Zp4b13+8FH8EJsv6tWKFdu9CwjEExqfi
TLSH
T1E7568C8776AB0254D0B7C23CCA97811BE672B8018B218BCF126CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Gui.dll
Size 6.5MB
SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
MD5 b8a2735292a7d9d69bc4a09da80a5f00
SHA1 0d3691aaa492bb5b8a1f25e00d5179894f2973f5
SHA512 4103ee4ac9ff72bb766a4dd5bc1b2e3de0ab101de3b19c787856685301a9829c20f75785ea4243bf62ff5e33dae07df6c47cabf84cfc69bb84d8ea9277b7349e
SSDEEP 49152:GxTskH658roWctQZMvBFlAdOqymGH7tTZDsY3hotW6pgCnuoyiugWam/5zmKxwJR:aTs4oNyKVlaWGuraUeJrZxcZ
TLSH
T1AE662986725A6252C977E27E8B4F452EE1F3785283428BC748159B480F737EA1B7FE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Network.dll
Size 1.0MB
SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
MD5 dcf774c4da98b2142e2db51b5a86b510
SHA1 e1481f0af6accafcedc683d69ac6ea47a18dc782
SHA512 2b6094586c95c9701aa5172a40423e585cf74e15bb41735180ebce1ed42479c14e8a51fb73b51cfd8e7283800eb679fc1b8016f25107e4670ff11279e08312e3
SSDEEP 12288:3KmUigw+uCeCrGwtfA8v7Q5EGiVnBOzXvEfZxgzwyU1DC9:3Km5guCeCrdtf/vMKG20YHgzwN1DC9
TLSH
T1E4355B57B36103A5D46AC1B9CA8B8616F272700187279BDF5629DF693F337E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Widgets.dll
Size 5.3MB
SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
MD5 e0f661dbc795f2794a392250819a803e
SHA1 01b41f59675e50074fc16267e5265659ad43e199
SHA512 1ebec23d6439152f6b00b87002c0df67dcda52b255a9f1a44a4629423c6ecf581a0b78e6aa6c3f5b5bf7846b3af0c3f5319d07142ab69e2f268972a77ca33fd6
SSDEEP 49152:MHiz1l7ZWKSwEaNjsSvVFrta9oxH57t/5yE6fkpQEVE5llmbx/qUqjfQdwXtmLu8:Nw2ELwHkWSUbdwXtmLuxY7pCQ6E
TLSH
T135466A5BB3A54195C56BD238CF8B8613E6B2700447228BCF256A8F592F337E12E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Xml.dll
Size 204KB
SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
MD5 5a283d1709c6dae688f071ca0c092b48
SHA1 57fa6cf1fece16ac0cf29323ff8ee5cc49044952
SHA512 410fb85952a9dc98f80b3ecf87dc4d9fa22ce4eb27983dc1b10919130e9d2ddeed64e199f72de69edd4ea9060aaab6f4092cb1241b911043ad3ffacf02386197
SSDEEP 3072:n1pI5DweOktRkjiHRv6XG1/tGACswdqB2dLKskgCjHT5Dn9S7Y4OlK:n/IZweXWoRv6XG1/tdDB2dYz19S7
TLSH
T1EE243A4777254596E42BC238CE1B890BE6B3B8501762DBDF81558B792F33BD2B83E250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanBase.dll
Size 1.1MB
SHA256 6648c8b957438f2347650faf24db6cb357670a3f17785bc1a01c833992e9c04b
MD5 c7be913e6e60f367b872d6df72a3e33f
SHA1 c925c99442a7a2d2b21e6d9b17827395d0e0f609
SHA512 f27ac5b83eb94275765326f1e37eac23aadc7e2cf496e430f84c79cebb13a56783eba7efbda33bd17dc0af37aab64d79c09e5646d82baacaa4128a35e1883f4a
SSDEEP 24576:8zfUc8wqLxv+otWr8wY6S8dtuTbwQusPvsM+S:Scc6xvNdwVu/lvsM+S
TLSH
T11D45AE4B33964356D16BC278C69B8114F477341197438AEF9A1BFE2D1E332E1383BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanDocking.dll
Size 615KB
SHA256 8c2d9a85cd59d745a30a8f751711d24f52d6040b74b0dd4b616140f7dbcf9d9a
MD5 92f76dbf7be4d37f870705a4896cea14
SHA1 52d358d954c7aab62f215686adf0588f37c8e4dc
SHA512 e0803c52ebf69907e75ce0100cbfee195f9ebeb0febaa58e22133968ba8508fdbe7f4c8212672d75c5e91c3fb9934a4e0004b9345f58c223e5c510c549f5aefb
SSDEEP 6144:Bgrl+UK4SXZcUKzbw19sweH9f0vLmBIX75ZTi3Ilx2W9tfF1a+tpqouMIBKhgl3d:BOwUPR72SHlkLqamF+Pqki
TLSH
T1C4D44A4B726903D2E067D138CA67C526E5B37851436246EFA616CA2D2F33FE13A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanOffice2016Style.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanOffice2016Style.dll
Size 217KB
SHA256 b0de38e2af6816a15346256d7fdac98cef86aec0793bc6453fa9b7f4ec4bf3f4
MD5 bce9cabf64d242fe45ab70ddaf618e15
SHA1 39baed9cb9ee7f4a10d7404de78d47a192fc5fea
SHA512 025fc1a711a110bd30939f9f818fdf9bf5ddc2c66f963c3bb0135f164243e698dc35e7d65bb0da9fae8d8e0a2d0f3be959d00e989f2cfe006e5cab718fe11a69
SSDEEP 6144:HlwWygSAAqMV0LZPHIZCfY4Ra9B06WnZwfwP8o9+3n/CXyLSPE:FwWygS/eJX
TLSH
T1F124F70BB2960796E467D278C68F0125F6B7705483028AFF052BDE7A1F33395BD3A985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxCrashHandler.exe
Size 11.7MB
SHA256 63782efaa43cc2c489ac311cb154f8504971d0930eb7ee00aea73f1fade9b317
MD5 cf533760c872c70cdedef6b05a2b8374
SHA1 fa4bd11ba77e954e72ce77b1fd4928b39ddcf33c
SHA512 9d1bf1b3a12222c16c25dbc98567661652fe64da377c4b359df50d982c2a0816d6957530d1e8f0500b1ec157c06c16638b69bf91e061c51e69f1f17311a029eb
SSDEEP 196608:8QwK2JYg7T8AJNHRFHtrKTA09/ZI5zl54q2gJY:8Qpkv3zFlKTA0lZIqqK
TLSH
T1EEC68D6AB2BC00E8D4BBD1B8C6465617E772781603709BDF16A046FA1F63AE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\libfbxsdk.dll
Size 9.7MB
SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
MD5 51d82c0e8ad65126413ed39246b5cf46
SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
TLSH
T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e430edffcc83462c3e09bb075f35388f3ace50b90dba5628cb39a6d0ac03e5d2
MD5 de4991399d97f1224a3de205d0e743b9
SHA1 ce4f9d5c0d211a43d0c1e4a9f15a23009cf12f32
SHA512 9972d7461ab954c37605eeff379c9330bbae7293290598db5799745bc6a446c627953f85b58ba2f0166b169576af9b1a51f3eed536e2999e708073c844e72e1e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2a4ac1ae6629b51d2cbbb63360be849f5f22bcc0d3c941ffd04f241da02e8afb
MD5 2a23b9075ad4a28ac7334530e9e2f160
SHA1 5ec301a7ca2f1f486ecbbde18d4d94cd97d35341
SHA512 8e8b6638fa4687b97587b9674302bc03f8df918a3cf8deabe25bf456198ba4cb744e3fdd300805641daf09e20233712b7a0606bfc6755c665b82b8a8b6855f95
TLSH
T1ADD0122732514138C010A4334602E1880440C31B420A4002943C891E2A080601A0A459
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 278903a89b43ee158612bd551b418061af3b27c752808197dc878e4766baf186
MD5 5fd9f570e5ab9a9a3e02574c04a0d7aa
SHA1 5b4c7cd05307d94b02937005503ec7e2966ec46b
SHA512 88908e03f8a8a488723cd4e48117e446823f28c0ba3a4ac0679b48455796c3c320e6b065fa313301e44dbfe3861d9bc9deca4b74bf62cb8fcdf6604fe43871b4
TLSH
T15AD0122736514138C010A5324601E1880540C21A430A4102943C892E2E080601A4A459
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8f6105dfd0f324d12574e14eaa227a568ef81138bf7b7792f689b1ddaa79995f
MD5 d1a4f7628320cd03f7f8f721a1fbe31a
SHA1 804cda53dc7f660a62c46c14230baaf67bba327a
SHA512 efe8a79f116a20821a30de54c1ef9dde50b05774c0b2364cab2ea3e7e0713b597942f4b52a749fbd4ffedc703cf36260a95f423e1b06a90cacf52882974820d0
TLSH
T1CD41811556CD7417CF9F71F12EEC6C22AA20091C5B127B673E41F1E2A3439CA6532F84
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 40c896ecd4a5b59afa9d50b51445b31861a13fa3238b4253c553bed2d9da97b0
MD5 5477442940cc4b56539a6bde222705a4
SHA1 76039743722ef1903065c41cb1d3af608dc3f1b1
SHA512 3cc0b9878c6e820aded01079234b463b241bdd083799b27464785255c18c6602c86d476288dd0917e4db9bcef7236fc4a349d5ee8925bb5dfa44e3c9497344bd
TLSH
T14E5189F353B0CA6DAA1652F42A19AD1BCF8C0130071C25B6C5D0BF9393B35A1E211B9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 2KB
SHA256 909a056555fef50063520fccf561d82c0f5652824b3a6f8e1277ad729dcc10fd
MD5 a383c9f5fa6c68ac5299b432fa5ca706
SHA1 df75cd6fa594fc5ef629e9512b7fd7a57c01f0ef
SHA512 3faac03c1996f260a8ffb1c1f5a1240515386131d3752947cd1c59cefedb74729c0afb3b8489e5a1ea38686730813bc38f3ea4e51f5d40dc19d9b4e3263165c5
TLSH
T1294129A7C27FF4AA106C497B1D487C2AA6F7B434129268F8CB57C23DF0C55F2666601E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 2KB
SHA256 505d2eead6a7ef349c7c16208c743c860fc070402f467f2942871e5fec0bc69c
MD5 a9122db3f7c8369f508d5c80af018db4
SHA1 127e543652b65a5a54ecedd17ab8cdfb7f3c6bc3
SHA512 d84e62a4d3d504fba9e4e7ff33172203e639b0fd6d7b6fbc8ba2a11965d1d15d67bafef210e767ac5e6be1a879834ab1cb540be7a6e464d5f057043ae9ecd856
TLSH
T1DA413BA7C27FF4AA102C497B1D487C2AA6F6B434129268F4CB57D23DF0C55F25666019
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5ab94f.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5ab94f.TMP
Size 2KB
SHA256 76c5ceaadc2569fe7905c2ef4e1253e349e7f2ec3d6c5879aa99050a13a0c070
MD5 1eb3e5d9c5649df22f1938359d3c0683
SHA1 bdbb94ac4a4b1dbdbd15d79a3e2b02557a1d7aa7
SHA512 42e1c50e033474db3b0d1489ac35bf4969a57fdf9226fad38e7b1fc5dd51660fcc03255cc7ac824e17ef1c5669a61e1b7e4f9bc41d30b9a63e935efc77b4d7e5
TLSH
T1D84129A7C27FF4AA106C497B1D487C2AA6F7B434129268F8CB57C23DF0C55F26666019
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 3f74aa8154719d597dabe987f19250058b0895801fe0c2c03ac233c84f2861f7
MD5 8799d49bd503958e28297dc02ced3df8
SHA1 223137431341934097bfcedc3567ec3320b2a73f
SHA512 13cb2246b3fbe791655699ca5d79bb523a54f881c993d945ef2f77f3ccd1766c6bd81042f11d6c55ad7ca3f5000bc952ccba613e88070e007a2e91bb600819c3
SSDEEP 96:rT6/dhsHeoHb9okkdo616ZZs7/x+6MhmuecmjeVK+gdI8XM1C7K:rTigNK5ojsV+Fijfvg6K
TLSH
T148C187065F24797B8C8AE509FA357B03D2FAA03275D51D58E7F8872C14DA5CC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 5019f961e2f9d3881d9124cf29ec8997c3a3f0a06261539d40d08539f870f88f
MD5 7f4367250b400b536d2ef8e4a29c2dfe
SHA1 99a80405ae675cd6fee684062035159bc081d012
SHA512 c4d1f40425e44a2b8c646ea8924ee9ffd86c7aa51623101652fbce5b7465b0a94dfe6f06e67ce9414a0a5ae6b80b718a1419f754d1f49f871309545fd30425ee
SSDEEP 96:rT6/dxHegbDokcdo616Zm11s7/x+6MhmuecRos1ejeVK+gf28XM1C7K:rTiXWHos11sV+FtosQjfVG6K
TLSH
T1A4D1860A5A24B97B8CCAE509FA65BA07D2FA603275D52D49E7F84B2C14D75CC720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b7272e9a6cee73a382241a0bc9f4603e02155e1eadd646f630e26a971dcf5811
MD5 2985318aecd6b08caeda210e8ef5515d
SHA1 9330f971a8a25721b792a706143f8980e693406c
SHA512 c89e9128f17a8670528824fbb892369ad6d9d51be6e34895dd52b0df59f5902135c1a51f004f6381c9a374014a572b21f11e9231d309d191567cdc709a870827
SSDEEP 96:stT6/dxHegbDokcdo5h16Zm11s7/x+6MhmuecRos1ejeVK+gf28XM1C7K:stTiXWHod11sV+FtosQjfVG6K
TLSH
T1A1D1860A5E24B97B8CCAE509FA65BA03D2FA602275D52E49E7F8472C14E75CC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 f8a37e679f71350f8965411da4c1f23f7f9c6250a010b906b396c91e3a38842d
MD5 a4c86455a04e29593b66f86c24e350d0
SHA1 758070de450f7128ebaee911106577742950b012
SHA512 f5a1abcccee6b5f5306c78a395326a698f946f0b26266a4ad2883390c761cc8bbaf920914cd360569b9265a2aafa5f9a22257c562b67c5e9893ce37e018518f4
SSDEEP 96:v/iJPlf/ROo1pkF5d1/iM7VaTEv9V5h5pg5+e0DjvBjDmWv1P1fKb:SRvzg9lj9fPxW
TLSH
T1ABC1A5A7053CC174AF444BEBEC397ECA99A600DF99D94C0A96D2C58807C1EFD21DE499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 3143190bce3758e074c5dcdd7a641a9507c5b7f1da102ed7b790787d39012c86
MD5 9c006e2ee42bd67e0ca654b18a43e331
SHA1 70106a9429e7894f0bc30f66d30c6b80c0620607
SHA512 687afaba4ee30a84507d8404af402c2b3df0227b5edbb1700d2aaa33613ce661250d38a775ff95518e57b5cb14406b9c7bbe3b6c50a685621e1c74da1c6889b2
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 335B
SHA256 1b5cc61be1ee5e924addfb45e7f66e1ccfb47822312c45f466c11a1a48aacf21
MD5 b3a3fa7e62af5345715a3f3fc755a9ee
SHA1 6852db4d9e1c3514fef20b863b50671286810eeb
SHA512 9c20a2e151f516a27765ee8affe50553b485fde40c5893adb5cd8afce965176788db5ac2f3c25aa88ac1353be5f25caa55b47268586963233a50caeb23a2c4e6
TLSH
T138E0D870A58A863A13C588EF15B2E34DC3657506B6DE1A259E15F60C114B244750B686
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 311B
SHA256 b578c25e7142c4b8f84fb4960f5b143e73e3a83541bf64ec3d259cc73b1003a7
MD5 ae017faa4f6495f703eb65c5ef8bd4c9
SHA1 956bbe057409b59454c615d0d50f80f8ca25de6d
SHA512 e95918febb92e54c2ad46efdb5d7ae7733bfdd3851a7cad2aa6ce63244ead8a9bc79ab21044c46cf63408f67f087ee04fda13b21cc60f43933b358f9e259b8e9
TLSH
T147E086B0E9C9813915C5CCEB46B5E74EC374B90B77CE3B99CF09B50C6547209B61A583
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Visited Links
Size 128KB
SHA256 72b8cf1e996c9fcfa31a2f184f4028625bb96a5c61a52ae517ca3b3ad441c94b
MD5 b19376d73e0b210b154952c243d500af
SHA1 98c21cde8585adb4464d370390fe987136c8c54a
SHA512 b766d58ce6fe8a4b2fcd0a372831d3bd093d25b635e3f98a5b4b585f9b24d9d5a8f03cf7c954cf988fa4175d58b8644e159ae3cffaf88eb182c01fa53ce4ac3f
SSDEEP 3:ImtVYKltll:IiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 2KB
SHA256 a54d60ba845c685ba3191f15b6ad581d2eaedee7ad25c45081ac335b2ef265ad
MD5 b54e9bd1d85b6cc6039fa40e818fde4f
SHA1 f8982dc6da13605c88651682e4ff41aa7a360824
SHA512 f03803c8e87880ce476ebbae447ae1489dde469200c212a6f4ae4afe99fc07d79b921f920633b15fdb65ff2022c7fcb648e9a12b441570154687ff5c642f5117
TLSH
T13D51B937AD106A7BC9E64948B94A3F23DF7AA056AA922F5097DD0B0C01CB44C735BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 bb75b9fc301e04585b60d314acc14af59d0d2d1fa7234d98f36e3526e7075c69
MD5 cb6102c94a78b889378c29d17a40f4c0
SHA1 5439afa5c2523ed2c270caba85e2bd8198ad74ce
SHA512 8242fa40c328f9d3d3742de180ed8f6eec8a75ab014fb4c6033a7875f7c588c21aa76d35f7dc22ce16fef29245093faa2550c3dc3ecd70599df8d2c101ed6dd5
TLSH
T10371B83EA960A93B8DE38D05B9862F17ABA69027E5C53F95D6EC0F0C01C728C2357C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 ac6659dbb1b787728f2310a2a5f8f1dfcf12ab68bc98a95438a3add4e2701b77
MD5 6a3e0c9c24fdd77b621251098c3a3e6c
SHA1 ae56e089f699a581ef23981ead1b11ecb2042c9b
SHA512 924da8a5d8d10a34a903addb7aeca47fbd52792f53627a14881ce3b92ada10c3f964ca93cc415430aaed1dc3560ebc654e6e8d9e54f7f621a41fa47c26d76ba7
TLSH
T12C81B83A59A4A93B8DE3C905B9853F17ABA99027D9C53F95DAEC0F0C01CB2882357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 5d9c63fdc07ffc46f23f643ce4e2fcc4138f43180d83a66e6fa99bddf5a42aba
MD5 8e05dc93ca646b42215156216ff62317
SHA1 9caad013a6b487cc919802fce8003f0563fd7b00
SHA512 f58fdbe1ec947c54d6b43573eb960a4677e3009257e0fe998a579ab323ba1803b9bed287b40df0fb3a89b52559f2756d1442f75cce73c472dbdf46c0c6670ebb
TLSH
T1B381C93E9864A93B8DE3D905B9863F17ABA9902799C53F95DAEC0F0C01CB2881357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 4KB
SHA256 415838e3798ca1d26d90af7c25705713fcefb8e6a05935c65cd29ff6e64ac51c
MD5 d2d427bd365302aa4ac7fd07f62148cb
SHA1 925e06a6da816254daa83970707739a54fe893a7
SHA512 087265b1dd0751db1321c2611074e617fab3b9f1d77f5924e8709be36265d97665402cdb36895d9ba0a2177f7dc8be37e6510a7c7e261255c89f4f5365e8354b
SSDEEP 96:57NkGSCifZbV58kh/cI9URLl8Dotoi5KBmZm66llZNHi0zANa:pNBSPbFeiDUDwmZO/C8r
TLSH
T12A81A83E6964A92B8DE3C905B98A3F17ABA5A02795C53F95DAFC0F0C01C728C1357C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 16KB
SHA256 c34bfb987348230869396878eb7d351da7daa39462fd6d2efa519932cc61a3c3
MD5 2156125b441dd7b5cad753687b35c399
SHA1 79461157527e29e1a347b6a88608c8b667378bee
SHA512 c6a46914a79e9d3db8c57676b63be8e0799c2d0897f2ee1ffc401dc67db770874cd8fa064ef4e30428981b2c4fb9bf34d8fae03e3e1e3c2e15c339d937952052
SSDEEP 384:S+aQikB+z/xvxjg/qhE5NBS5pq+xF29z1:9/UxvxjgC+KDCF1
TLSH
T1AE729E3F54647D2795F3E9047A4D0B4BCBB9A47294C26EB48AB95F0D07C72981346812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a5804.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5a5804.TMP
Size 1KB
SHA256 4566c32fcc764af40b4e4be8e4e84373e975a2db4c606ecb8aabb6e8629116af
MD5 f002d054e2f7718b5546c3f8448f7e5f
SHA1 6123fbb00a2dae9ff710bec27be41a383a29680c
SHA512 0bdc3ef860d91818ba21f2e6f91fbffaf9543a5d31fc4750421ab032e99135975dd2dd2e327f46b8a9d7d6b68f67ccea0504ab316a70c9d7e628890324476ce7
TLSH
T18931C67AD9801E73DC9659462345BF975F32606A41810E44A2DE0F0C0ACB04CF63FD32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 7782273488ddf579f5af30121d1d02d5102b41bc28ee0d501571ebc39f3c418a
MD5 93e008c8012b5609b247d0faca16ac16
SHA1 3a45843487414d36a54daca7074cb6a977ca29c9
SHA512 a2c0dc91e7f920c08dfc95d239584ceab0ea79f6da9a6145ca89458e323df1be2f24618f0879f47817657c76c952d21e6523a282cc2c038348a71473b6f684cf
SSDEEP 3:LsOllllklkXlY2h:LsUlPYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxStudioInstaller_F4E23.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_F4E23.log
Size 8KB
SHA256 fbf10b8f435a2c2203237efef7c96270e5b8d9ae9f3f03206a44d018749f3b09
MD5 cb352a052bb35d22635927f4a7527dda
SHA1 104a8046f68d9bcd420155e5899b28214bb65185
SHA512 fba1928befac3f17afe8507c68c4c1ba746e992c4e2c16f2e331b3e32b897b42a58e76b0d83cb2d3618971211548725d2ecac8585ba9dd1f1f3947fbd9cd024a
SSDEEP 96:KTLm8LvrEShI3Q40HpHK877oj/IueSnOhgl2WSQr8M/hl/guXyc6q2:iLm8LpIA4psMt2u8OXyc6Z
TLSH
T19602CD6AE3A14039334D218B9743CD6D6B137E467297E77073DF420F67822E8A7E5682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 abc955024d5cb860b3461a863adef75434fc21d7b8f88c6be3b64d0598646585
MD5 d9a5384f77c20ec82a5664d0f6282261
SHA1 f8c193d8115626d37d4f5a1adb4765e3e63651cb
SHA512 eb82554d2756c3fbe61252a23a76b81e928d152f27fad04361dc2bace9a61ec214ea6f97f4fe269eed19172adee54170ca9d3eb552d4608a65135670d9149ac1
TLSH
T1F3A0021460269158D4675262B55F98423935596A7F0375698A0F6591280E6F09904816
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1176-751-0x0000021AC0C50000-0x0000021AC0C56000-memory.dmp

Download

memory/1176-746-0x0000021AC0C80000-0x0000021AC0C82000-memory.dmp

Download

memory/1176-745-0x0000021AC0C50000-0x0000021AC0C51000-memory.dmp

Download

memory/1176-747-0x0000021AC0C50000-0x0000021AC0C51000-memory.dmp

Download

memory/1176-748-0x0000021AC0C90000-0x0000021AC0C92000-memory.dmp

Download

memory/1176-750-0x0000021AC0CA0000-0x0000021AC0CA3000-memory.dmp

Download

memory/1176-755-0x0000021AC0EF0000-0x0000021AC0EF2000-memory.dmp

Download

memory/1176-758-0x0000021AC0DC0000-0x0000021AC0DC5000-memory.dmp

Download

memory/1176-757-0x0000021AC0F00000-0x0000021AC0F03000-memory.dmp

Download

memory/1176-753-0x0000021AC0DD0000-0x0000021AC0DD2000-memory.dmp

Download

memory/3800-291-0x00007FF896930000-0x00007FF896931000-memory.dmp

Download

memory/5060-321-0x00007FF896930000-0x00007FF896931000-memory.dmp

Download

memory/5144-568-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-564-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-219-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-572-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-574-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-570-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-566-0x0000029AD7BD0000-0x0000029AD7FD0000-memory.dmp

Download

memory/5144-106-0x00007FF7D68E0000-0x00007FF7D78E0000-memory.dmp

Download

memory/5144-103-0x00007FF875DA0000-0x00007FF8762ED000-memory.dmp

Download

memory/5964-858-0x00007FF896F90000-0x00007FF896F91000-memory.dmp

Download

memory/5964-859-0x00007FF897350000-0x00007FF897351000-memory.dmp

Download