Overview

overview

7

Static

static

3

RobloxStud...er.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/10/2026, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxStudioInstaller.exe
  • Size 12.8MB
  • Sample261006-2rf8psgh44
  • SHA256 47f69d69053f0fc544fba146153bf0d3e5eb7d9639a532957a13df085beaad84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxStudioBeta.exe
      "C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxCrashHandler.exe
        "C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 4216 --attachment=attachment_0.741.19.7411056_20261006T224952Z_Studio_346F0_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.741.19.7411056_20261006T224952Z_Studio_346F0_last.log --attachment=attachment_log_0.741.19.7411056_20261006T224952Z_Studio_346F0_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.741.19.7411056_20261006T224952Z_Studio_346F0_csg3.log --attachment=attachment_log_0.741.19.7411056_20261006T224952Z_Studio_346F0_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.741.19.7411056_20261006T224952Z_Studio_346F0_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.741.19.7411056 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=36cf9c7a24f926610345817749e9b91309044bf7 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.741.19.7411056 --annotation=UniqueId=662297271506980180 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.741.19.7411056 --annotation=host_arch=x86_64 --initial-client-data=0x440,0x444,0x448,0x41c,0x484,0x7ff70e04b918,0x7ff70e04b930,0x7ff70e04b948
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3040
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4216.1560.13378356301735122592
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:5476
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffbd28bb078,0x7ffbd28bb084,0x7ffbd28bb090
          4⤵
            PID:5768
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
            4⤵
              PID:648
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2000,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
              4⤵
                PID:2900
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
                4⤵
                  PID:4776
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
                  4⤵
                    PID:5828
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3368,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:1
                    4⤵
                      PID:5056
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4376,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
                      4⤵
                        PID:1540
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 741, 19, 7411056" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5004,i,13979528569034710994,14909596068987172620,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
                        4⤵
                          PID:4932
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D4
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4284
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:1284
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2712

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        AppSettings.xml
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\AppSettings.xml
                        • Size 144B
                        • SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qgif.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Plugins\Qt5\imageformats\qgif.dll
                        • Size 31KB
                        • SHA256 dece9af97994b58962a3aab7da662527e509b4c86a8881bc93fda31d048cb18b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qjpeg.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Plugins\Qt5\imageformats\qjpeg.dll
                        • Size 437KB
                        • SHA256 beecab928e1a2adc179db2f959c38798bfe06d6a84c8720d4a62a71a61388884
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qwindows.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Plugins\Qt5\platforms\qwindows.dll
                        • Size 1.4MB
                        • SHA256 f389819f6aaab61aee384e93996d5e4326b8e3b8c956f55d62b042c1dcef9866
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qwindowsvistastyle.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Plugins\Qt5\styles\qwindowsvistastyle.dll
                        • Size 134KB
                        • SHA256 7adcaa0e2d1f2837280adee6df339b3e7b934e7edeab653fc80bf390e622317f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qt5Core.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Qt5Core.dll
                        • Size 5.8MB
                        • SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qt5Gui.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Qt5Gui.dll
                        • Size 6.5MB
                        • SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qt5Network.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Qt5Network.dll
                        • Size 1.0MB
                        • SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qt5Widgets.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Qt5Widgets.dll
                        • Size 5.3MB
                        • SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qt5Xml.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\Qt5Xml.dll
                        • Size 204KB
                        • SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QtitanBase.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\QtitanBase.dll
                        • Size 1.1MB
                        • SHA256 307f9d3a48141ec58b26e6eb2958a415c2393b31de2d2194aa83fa0e34372fb8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QtitanDocking.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\QtitanDocking.dll
                        • Size 615KB
                        • SHA256 d8735d4564267ee142a3c32733751f1c2e9dfd41b42e3903874878d9917cba15
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QtitanOffice2016Style.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\QtitanOffice2016Style.dll
                        • Size 217KB
                        • SHA256 32e666e364b663f0d0a784451664fe39b533b4e29b56527c2e3b4b7370083855
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RobloxCrashHandler.exe
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxCrashHandler.exe
                        • Size 11.6MB
                        • SHA256 ef775e68fff5a474f9978ca2303e79bb109923c4f50af8880163930595db60f0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RobloxStudioInstaller.exe
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\RobloxStudioInstaller.exe
                        • Size 12.8MB
                        • SHA256 47f69d69053f0fc544fba146153bf0d3e5eb7d9639a532957a13df085beaad84
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WebView2Loader.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\WebView2Loader.dll
                        • Size 162KB
                        • SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dd-win-prof.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\dd-win-prof.dll
                        • Size 3.8MB
                        • SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libfbxsdk.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\libfbxsdk.dll
                        • Size 7.5MB
                        • SHA256 3869e66e3648956844950fb001c968e7fd922e7835f2f9a0257627b3588be732
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        msvcp140.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\msvcp140.dll
                        • Size 540KB
                        • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        msvcp140_1.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\msvcp140_1.dll
                        • Size 34KB
                        • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcruntime140.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\vcruntime140.dll
                        • Size 120KB
                        • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcruntime140_1.dll
                        • Path C:\Program Files\Roblox\Versions\version-76e1a02649ad4f35\vcruntime140_1.dll
                        • Size 46KB
                        • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        settings.json
                        • Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
                        • Size 2B
                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                        • MD5 SHA1 SHA512
                        Submit Download

                        OTAData.json
                        • Path C:\Users\Admin\AppData\Local\Roblox\OTAPlugins\Deployed\OTAData.json
                        • Size 29B
                        • SHA256 72de5cd3124d642aafeb64a4562c31204bb506a5c4fe37de302849aef41f0d40
                        • MD5 SHA1 SHA512
                        Submit Download

                        45def1fb-6261-4e3b-822a-c13a544811a4.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\45def1fb-6261-4e3b-822a-c13a544811a4.tmp
                        • Size 3KB
                        • SHA256 be045c23bc6d5acda1161ae9280bfb49f9081272c4aa91269d0da55a3c008519
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        74c2094e-d18b-48d6-b8a6-952edd0a5178.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\74c2094e-d18b-48d6-b8a6-952edd0a5178.tmp
                        • Size 1KB
                        • SHA256 28d9d5e53d0171cd88d2f5e7718afe8382f4a8c340d7a064f7e11e2c60774ad0
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        980580b5-f3a6-4238-b565-09ae7f269298.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\980580b5-f3a6-4238-b565-09ae7f269298.tmp
                        • Size 2KB
                        • SHA256 ab507d0a5b7e9025e03b0cdd0731025f58b65e0084258037caf038d5c0da80d1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        crl-set
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                        • Size 22KB
                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        manifest.json
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\manifest.json
                        • Size 113B
                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 c3f421db146497d81bd39ceedad12f82ae6b68b0b36c87f063c3dbeabb3986bf
                        • MD5 SHA1 SHA512
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 29e1ae0a0713ae6824727b1fbb69c83ab55ab8f77cd87b42befd391589526e32
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        throttle_store.dat
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
                        • Size 20B
                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                        • MD5 SHA1 SHA512
                        Submit Download

                        33c272cd-6c6c-4b09-b637-dbd908eac1a2.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\33c272cd-6c6c-4b09-b637-dbd908eac1a2.tmp
                        • Size 7KB
                        • SHA256 aec36f98d2b78c1c8079506893e2b02349ccc299660da96bdca93b16f5129d3d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        temp-index
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
                        • Size 2KB
                        • SHA256 fae5ef94807e4511ec19913830a55b9187281b76b6768fbf890c35336bf1549f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                        • Size 48B
                        • SHA256 18e8090ebde38ad10f4c50e6fb92c7c076b3ccb1d41cf5c624d742b32290aa6f
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
                        • Size 48B
                        • SHA256 0539b47978848f968d6551c3add2e1c917f518ce070b6f837cfa8653514f36cc
                        • MD5 SHA1 SHA512
                        Submit Download

                        data_0
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\GPUCache\data_0
                        • Size 8KB
                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_1
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\GPUCache\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_2
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\GPUCache\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_3
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\GPUCache\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        History
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\History
                        • Size 184KB
                        • SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Network Action Predictor
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network Action Predictor
                        • Size 52KB
                        • SHA256 2f80b3d97ed21bb40f2fb613ed996eb9735ce6993034397ccfecf1f37a1abe98
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        482c3c3d-d468-4e1a-9610-f7b96c13b266.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\482c3c3d-d468-4e1a-9610-f7b96c13b266.tmp
                        • Size 2KB
                        • SHA256 1cc3c4c27c5e0e1f1cfb02976d35746bab08b6650e4ffdf4624e3f6c063afde1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
                        • Size 111B
                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        TransportSecurity
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
                        • Size 2KB
                        • SHA256 527bcd0d82aadaa4a9fa8625937a491c1c5675de1773249167c6cb264792589b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Trust Tokens
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Trust Tokens
                        • Size 36KB
                        • SHA256 d772e24f4fbec8a21439ffb57c335e6f2c945dd9f70fb56e5a84115e752e3797
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        c51c500e-623a-4352-8c39-4d9c3962f1c5.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\c51c500e-623a-4352-8c39-4d9c3962f1c5.tmp
                        • Size 2KB
                        • SHA256 51ab4af2fa1d52d1631e05f9f87e68aefa216fba11a22ebe4154d59c8a4af47d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        c556015e-a944-4d2e-a14a-285323405da9.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\c556015e-a944-4d2e-a14a-285323405da9.tmp
                        • Size 40B
                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ce78e4eb-556b-4706-a856-f07a74e38315.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\ce78e4eb-556b-4706-a856-f07a74e38315.tmp
                        • Size 2KB
                        • SHA256 8cd60b4699aaffe01a35766c4d2a3ae4dec447eb985d108a4ae0411be021a946
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        d4496fb8-db10-4a21-bde4-0837bd931501.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\d4496fb8-db10-4a21-bde4-0837bd931501.tmp
                        • Size 111B
                        • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dd6ca515-5137-46ff-ab89-fae29b9c48a9.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\dd6ca515-5137-46ff-ab89-fae29b9c48a9.tmp
                        • Size 2KB
                        • SHA256 d3a32f092171b2ca9ead8895aaddc19089820722f76150ba927832e0ff4980e9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        fb6716c0-a041-4bce-ba2a-e76fc6848851.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\fb6716c0-a041-4bce-ba2a-e76fc6848851.tmp
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512
                        Submit Download

                        Preferences
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
                        • Size 5KB
                        • SHA256 5c3cbacb67a006371df1368df4554b281af1beeb112e829abd0aed340bfd60d0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Safe Browsing Cookies
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
                        • Size 20KB
                        • SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Secure Preferences
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences
                        • Size 6KB
                        • SHA256 cda87f0e4b2a5e199f5f7e96dccce38b5f6fe861a3be2ad1740f0fd58fd2a40b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        index
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index
                        • Size 24B
                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
                        • Size 48B
                        • SHA256 8b7c22567c32c476e86bef4736e04c2c154b49fadd57db9ee2485b79aba02a61
                        • MD5 SHA1 SHA512
                        Submit Download

                        db
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\db
                        • Size 44KB
                        • SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MANIFEST-000001
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512
                        Submit Download

                        CURRENT
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512
                        Submit Download

                        c65b4f39-0c13-40bb-8f68-63ef65671667.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\c65b4f39-0c13-40bb-8f68-63ef65671667.tmp
                        • Size 7KB
                        • SHA256 a4bd089e4e55c1207826c1462b2a575a810d8a6743ce09497077cdb8ad8967e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
                        • Size 1KB
                        • SHA256 f9e2f4dda954c0fde5b1d7510d31ee94c23467e06f7dccba584ba27466d92655
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        fa1418a8-6462-4d79-b405-99f9d405ff76.tmp
                        • Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\fa1418a8-6462-4d79-b405-99f9d405ff76.tmp
                        • Size 16KB
                        • SHA256 eccd6ebc9b2d162fb6a74769a0906545e4b3ff8afeb1ecfae224482629b8eb47
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RobloxStudioInstaller_BD363.log
                        • Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_BD363.log
                        • Size 7KB
                        • SHA256 402af3d67f6ef2bd690c7bfa780d6b0370803dfe63754e00053542463ec0a467
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cacert.pem
                        • Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
                        • Size 223KB
                        • SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        8913724486d5e3c463c493b25346ca31
                        • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
                        • Size 64B
                        • SHA256 5da7948ee1f10188158d136b62de6714aa23ffcdbc22765ec7abf6e141923465
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RBX4FF3303E47C14A259828CDB1C8B45AC3
                        • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX4FF3303E47C14A259828CDB1C8B45AC3
                        • Size 64B
                        • SHA256 7f9b07d3590e66664da94d6f5da14c4a5a84bd4b438930cb9120235d4d363cc1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RBXE67CB417169A46F9A6F2D0A7C56ED579
                        • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBXE67CB417169A46F9A6F2D0A7C56ED579
                        • Size 64B
                        • SHA256 3ea5eaf359522f536ad2b5cc5ecc88967b227af31f274f697f60af036cefb337
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        manifest.fingerprint
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_458854622\manifest.fingerprint
                        • Size 66B
                        • SHA256 bc8d4367c67f869cbf134ee18cc34007003022251fd5d54980fae22d990f1563
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/648-829-0x0000028344710000-0x0000028344715000-memory.dmp
                        Download

                        memory/648-818-0x0000028343F80000-0x0000028343F81000-memory.dmp
                        Download

                        memory/648-822-0x0000028343F80000-0x0000028343F86000-memory.dmp
                        Download

                        memory/648-821-0x0000028343FF0000-0x0000028343FF3000-memory.dmp
                        Download

                        memory/648-826-0x0000028344D20000-0x0000028344D22000-memory.dmp
                        Download

                        memory/648-824-0x0000028344720000-0x0000028344722000-memory.dmp
                        Download

                        memory/648-819-0x0000028343FE0000-0x0000028343FE2000-memory.dmp
                        Download

                        memory/648-828-0x0000028344D30000-0x0000028344D33000-memory.dmp
                        Download

                        memory/648-816-0x0000028343F80000-0x0000028343F81000-memory.dmp
                        Download

                        memory/648-817-0x0000028343FD0000-0x0000028343FD2000-memory.dmp
                        Download

                        memory/648-265-0x00007FFBF4AD0000-0x00007FFBF4AD1000-memory.dmp
                        Download

                        memory/4216-640-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-639-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-642-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-636-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-123-0x00007FF700970000-0x00007FF701970000-memory.dmp
                        Download

                        memory/4216-627-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-537-0x000001BE5A490000-0x000001BE5A59A000-memory.dmp
                        Download

                        memory/4216-225-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/4216-122-0x00007FFBD5120000-0x00007FFBD566D000-memory.dmp
                        Download

                        memory/4216-625-0x000001BE73130000-0x000001BE73530000-memory.dmp
                        Download

                        memory/5828-381-0x00007FFBF4AD0000-0x00007FFBF4AD1000-memory.dmp
                        Download