1fd94ed0ce29148795374939b1f58c65bc3f2bf8fe7c7416f2aaf9c069a121e4

Analysis

user interaction
yes
max time kernel
1799s
max time network
1803s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxStudioInstaller.exe
Size 9.6MB
Sample261009-1debhswt5l
SHA256 1fd94ed0ce29148795374939b1f58c65bc3f2bf8fe7c7416f2aaf9c069a121e4
MD5 e90c385415acc105def8a2170a82363f
SHA1 3ad04d79307daa9ce39cd7cb10da6c8e140b2aba
SHA512 f77dfc6c1e6c38b58f6f7c253b039fabbee4e5ebe5e2edad87a2ade531ba4d4b5864a96455e99768d2c0f4aaa99b6828f1c8b7f662803ba43987a6dedd10d66e
SSDEEP 196608:ey0xhEz4kAlLAR1ss29msxpd87NByR7XalYZjFa:eoLAG29msxL85ByR7Xno
TLSH
T18AA6BF22B900C032E8D200F2A6BD6FBA597C9A340B3954D7A7D49DBD59305D33B39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
3292	RobloxStudioBeta.exe
2608	RobloxCrashHandler.exe

Loads dropped DLL 31 IoCs

pid	Process
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
2608	RobloxCrashHandler.exe
2608	RobloxCrashHandler.exe
2608	RobloxCrashHandler.exe
2608	RobloxCrashHandler.exe
2608	RobloxCrashHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
209	raw.githubusercontent.com
228	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	RobloxStudioBeta.exe
File opened (read-only)	\??\F:	RobloxStudioBeta.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2748	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\Clipboard\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\equals.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Utility\Stories\Shared\StorySection.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\ReactSceneUnderstanding\Cryo.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\AnimationEditor\img_timetag.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\textures\ui\LoadingScreen\BackgroundDark.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\AvatarImporter.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\textures\ui\PlayerList\UnFriend.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\llama\llama\List\push.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\Debugger\Breakpoints\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\optimism\anyEntryTypes.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Dash\Dash\trim.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\scripts\CoreScripts\Modules\Feedback\Resources\Assets.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Lua\AlignTool\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Graphing\Graphing\Components\SidePositioner\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\DeveloperFramework\StudioTheme\search_16.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\avatar\characterR6NoFace.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\textures\ui\Settings\MenuBarAssets\MenuSelection.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Enums\Placement.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-31ab8d40-5.0.0\RbxDesignFoundations\Default\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\configs\DateTimeLocaleConfigs\zh-cn.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\fonts\Roboto-Bold.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\FileSync\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\ReactIs.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Utility\Stories\Planned\Autocomplete\Autocomplete.code.md	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\Validator\validateGradientInfo.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Directional.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\RoduxCall\RoduxCall\Actions\UpdateCall.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_purple.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\assetQualityFolders\Measure_Texture_Complexity\Measure_Texture_Complexity.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\MaterialManager\Gradient_DT.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\link\http\HttpLink.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\StudioToolbox\AssetPreview\vote_up.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Lists\VirtualizedList.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\scripts\CoreScripts\Modules\VoiceChat\Components\onClickedCameraIndicator.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Graphing\Graphing\Components\Positioner\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\ManageCollaborators\arrowRight_dark.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\R15Migrator\Icon_Error_Checkmark.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\textures\ui\MenuBar\divider.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Lua\StyleEditor\Dark\Standard\Size.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\ExtraContent\LuaPackages\Packages\_Index\Collections\Collections\Object\preventExtensions.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioContent\textures\DeveloperFramework\Votes\rating_up_yellow_darker.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\StudioFonts\BuilderSans-Regular.otf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\studio_svg_textures\Shared\Ribbon\Light\Standard\RibbonRadioButtonCheckedDefaultSmall.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\PlatformContent\pc\textures\plastic\diffuse.dds	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxStudioInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxStudioBeta.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9b554450a0fc4e65\\RobloxStudioBeta.exe,0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9b554450a0fc4e65"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{8C507059-59F9-4594-9E5F-4D7FC051AB5F}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{4DF3C1F3-DD6F-4FAB-B439-9E796B5A569F}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9b554450a0fc4e65\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9b554450a0fc4e65\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open"	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9b554450a0fc4e65\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{15D07480-CF23-49D0-BE98-1EFAEDA5B33A}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{2FD2D763-CD26-4F22-94D7-A489EB5CD5BD}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place"	RobloxStudioInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3292	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3776	RobloxStudioInstaller.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3292	RobloxStudioBeta.exe
4920	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2980	msedgewebview2.exe
3356	msedgewebview2.exe
3356	msedgewebview2.exe
4768	msedgewebview2.exe
4768	msedgewebview2.exe
4768	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5408	AUDIODG.EXE
Token: SeDebugPrivilege	4920	taskmgr.exe
Token: SeSystemProfilePrivilege	4920	taskmgr.exe
Token: SeCreateGlobalPrivilege	4920	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4920	taskmgr.exe
Token: 33	4920	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4920	taskmgr.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe
Token: SeShutdownPrivilege	2884	explorer.exe
Token: SeCreatePagefilePrivilege	2884	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
3292	RobloxStudioBeta.exe
5068	OpenWith.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
4920	taskmgr.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
3292	RobloxStudioBeta.exe
7876	StartMenuExperienceHost.exe
4892	SearchHost.exe
2884	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3292	3776	RobloxStudioInstaller.exe	91
PID 3292 wrote to memory of 2608	3292	RobloxStudioBeta.exe	92
PID 3292 wrote to memory of 2980	3292	RobloxStudioBeta.exe	98
PID 2980 wrote to memory of 1680	2980	msedgewebview2.exe	99
PID 2980 wrote to memory of 5636	2980	msedgewebview2.exe	100
PID 2980 wrote to memory of 5636	2980	msedgewebview2.exe	100
PID 2980 wrote to memory of 5636	2980	msedgewebview2.exe	100
PID 2980 wrote to memory of 5636	2980	msedgewebview2.exe	100
PID 2980 wrote to memory of 1440	2980	msedgewebview2.exe	101
PID 2980 wrote to memory of 1308	2980	msedgewebview2.exe	102
PID 2980 wrote to memory of 1308	2980	msedgewebview2.exe	102
PID 2980 wrote to memory of 1308	2980	msedgewebview2.exe	102
PID 2980 wrote to memory of 6108	2980	msedgewebview2.exe	103
PID 2980 wrote to memory of 6108	2980	msedgewebview2.exe	103
PID 2980 wrote to memory of 6108	2980	msedgewebview2.exe	103
PID 2980 wrote to memory of 6108	2980	msedgewebview2.exe	103
PID 2980 wrote to memory of 6108	2980	msedgewebview2.exe	103
PID 3292 wrote to memory of 3356	3292	RobloxStudioBeta.exe	104
PID 3356 wrote to memory of 4648	3356	msedgewebview2.exe	105
PID 3356 wrote to memory of 4820	3356	msedgewebview2.exe	106
PID 3356 wrote to memory of 4820	3356	msedgewebview2.exe	106
PID 3356 wrote to memory of 4820	3356	msedgewebview2.exe	106
PID 3356 wrote to memory of 4820	3356	msedgewebview2.exe	106
PID 3356 wrote to memory of 2492	3356	msedgewebview2.exe	107
PID 3356 wrote to memory of 868	3356	msedgewebview2.exe	108
PID 3356 wrote to memory of 868	3356	msedgewebview2.exe	108
PID 3356 wrote to memory of 868	3356	msedgewebview2.exe	108
PID 3356 wrote to memory of 3432	3356	msedgewebview2.exe	109
PID 3356 wrote to memory of 3432	3356	msedgewebview2.exe	109
PID 3356 wrote to memory of 3432	3356	msedgewebview2.exe	109
PID 3356 wrote to memory of 3432	3356	msedgewebview2.exe	109
PID 3356 wrote to memory of 3432	3356	msedgewebview2.exe	109
PID 3356 wrote to memory of 3352	3356	msedgewebview2.exe	110
PID 3356 wrote to memory of 3352	3356	msedgewebview2.exe	110
PID 3356 wrote to memory of 3352	3356	msedgewebview2.exe	110
PID 3356 wrote to memory of 3352	3356	msedgewebview2.exe	110
PID 3356 wrote to memory of 3352	3356	msedgewebview2.exe	110
PID 3292 wrote to memory of 4768	3292	RobloxStudioBeta.exe	114
PID 4768 wrote to memory of 1372	4768	msedgewebview2.exe	115
PID 4768 wrote to memory of 1784	4768	msedgewebview2.exe	116
PID 4768 wrote to memory of 1784	4768	msedgewebview2.exe	116
PID 4768 wrote to memory of 1784	4768	msedgewebview2.exe	116
PID 4768 wrote to memory of 1784	4768	msedgewebview2.exe	116
PID 4768 wrote to memory of 3840	4768	msedgewebview2.exe	117
PID 4768 wrote to memory of 4164	4768	msedgewebview2.exe	118
PID 4768 wrote to memory of 4164	4768	msedgewebview2.exe	118
PID 4768 wrote to memory of 4164	4768	msedgewebview2.exe	118
PID 4768 wrote to memory of 4832	4768	msedgewebview2.exe	119
PID 4768 wrote to memory of 4832	4768	msedgewebview2.exe	119
PID 4768 wrote to memory of 4832	4768	msedgewebview2.exe	119
PID 4768 wrote to memory of 4832	4768	msedgewebview2.exe	119
PID 4768 wrote to memory of 4832	4768	msedgewebview2.exe	119
PID 4768 wrote to memory of 4864	4768	msedgewebview2.exe	124
PID 4768 wrote to memory of 4864	4768	msedgewebview2.exe	124
PID 4768 wrote to memory of 4864	4768	msedgewebview2.exe	124
PID 4768 wrote to memory of 4864	4768	msedgewebview2.exe	124
PID 4768 wrote to memory of 4864	4768	msedgewebview2.exe	124
PID 4768 wrote to memory of 6404	4768	msedgewebview2.exe	125
PID 4768 wrote to memory of 6852	4768	msedgewebview2.exe	130
PID 4768 wrote to memory of 6852	4768	msedgewebview2.exe	130
PID 4768 wrote to memory of 6852	4768	msedgewebview2.exe	130
PID 4768 wrote to memory of 6852	4768	msedgewebview2.exe	130
PID 4768 wrote to memory of 6852	4768	msedgewebview2.exe	130
PID 3376 wrote to memory of 2884	3376	sihost.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\RobloxStudioBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\RobloxCrashHandler.exe
    "C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 3292 --attachment=attachment_0.742.0.7421053_20261009T213357Z_Studio_C0922_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.742.0.7421053_20261009T213357Z_Studio_C0922_last.log --attachment=attachment_log_0.742.0.7421053_20261009T213357Z_Studio_C0922_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.742.0.7421053_20261009T213357Z_Studio_C0922_csg3.log --attachment=attachment_log_0.742.0.7421053_20261009T213357Z_Studio_C0922_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.742.0.7421053_20261009T213357Z_Studio_C0922_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.742.0.7421053 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 11 - PlatformId 2, Version 10.0, Build 26100" --annotation=RobloxChannel=production --annotation=RobloxGitHash=1c8ca3efc668590d4a4a6fa1d1fd55945891d456 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.742.0.7421053 --annotation=UniqueId=8955077997741697438 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.742.0.7421053 --annotation=host_arch=x86_64 --initial-client-data=0x47c,0x480,0x484,0x458,0x48c,0x7ff6b5587cf8,0x7ff6b5587d10,0x7ff6b5587d28
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3292.2064.15696013679221843462 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc395a5fd8,0x7ffc395a5fe4,0x7ffc395a5ff0
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,9600627053413165854,18224405946347022353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1728,i,9600627053413165854,18224405946347022353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1728,i,9600627053413165854,18224405946347022353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1728,i,9600627053413165854,18224405946347022353,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:6108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3292.2064.10953121587802675999 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffc395a5fd8,0x7ffc395a5fe4,0x7ffc395a5ff0
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,7730123855197839813,97428075911992999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1868 --field-trial-handle=1724,i,7730123855197839813,97428075911992999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1724,i,7730123855197839813,97428075911992999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3568 --field-trial-handle=1724,i,7730123855197839813,97428075911992999,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3984 --field-trial-handle=1724,i,7730123855197839813,97428075911992999,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:3352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3292.2064.11499435186365837580 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffc395a5fd8,0x7ffc395a5fe4,0x7ffc395a5ff0
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2144 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3588 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4428 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5044 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:6404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 742, 0, 7421053" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4908 --field-trial-handle=2148,i,12782773335447403087,213757656499648849,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:6852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2752

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3380

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1324

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2884

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3384

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

qgif.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Plugins\Qt5\imageformats\qgif.dll
Size 31KB
SHA256 dece9af97994b58962a3aab7da662527e509b4c86a8881bc93fda31d048cb18b
MD5 99975861a5d0d911055bc3a74c6a9678
SHA1 7aa39db708751a6f5b4c70f0a459acf8757640b2
SHA512 5e6f24b1c717fac7d363a2753a2fdbb07d4162567c6149bd10e1f823f7b372db991fdcdb62e8f6e9d2a5c017a0b069837bc898d69ed0bab5efd78131bcc1d902
SSDEEP 384:pk2xgrGXnLxRwrbos5k3Xjsz77RoFXRnxqVbn+rPCHJ9RPzN4XNuBSMhOliycGNe:dVRwrbBk3Xj+7OFZx17nMgxfNGyMh
TLSH
T1B5E21A51AB7800D2E153C278C82B4E2AE63AB9309B6397CF476255790E337D17E39778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Plugins\Qt5\imageformats\qjpeg.dll
Size 437KB
SHA256 beecab928e1a2adc179db2f959c38798bfe06d6a84c8720d4a62a71a61388884
MD5 0b9d61478c31e86b146ece524e0ee7ae
SHA1 ada89e70eb76728ede965b9f1c119590ffcb5961
SHA512 0673249659ec54b8f773fbe951592ab4de9f4380ce073198ee386d5440ea64d80539aff1efcc6cf49220cb877ffaf9797af40fb9cf7f5d819f6daf12563068e8
SSDEEP 12288:20bdHW+4bJKYjtnLqgYIqcUcYHtpP880E3JxbwEcS0vPh10syMLzBhfywIsD51PZ:20bdHW+gF0
TLSH
T182949243F2605C87C7E54474EE6AC1A6E785B81CC7FB46F779C1ABD97A226F0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Plugins\Qt5\platforms\qwindows.dll
Size 1.4MB
SHA256 f389819f6aaab61aee384e93996d5e4326b8e3b8c956f55d62b042c1dcef9866
MD5 884071d45df422efbbfb24a07172d9e4
SHA1 80540a7878e896dfcca1539e692c52fa76f44c2a
SHA512 63ea7de2f6363a2fb774a683a7fe9d95a82ddd521b5145b6bc97c4f51d9f1ab889b19ec2eeb5fe60c3d29aec5c224881050d9b59cd725e8d4cd4a283c17ca510
SSDEEP 24576:IeEQtwlTkBnj3Htp4ysAqV3QXscl+HflpWkiVPaEzeZji:ElTkBnLHtp4yslV3L//naVlzA
TLSH
T119659D47A3A48298C26BC23DC65B8B17D6B1700503619BCF11A9CE597F63BE3277EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Plugins\Qt5\styles\qwindowsvistastyle.dll
Size 134KB
SHA256 7adcaa0e2d1f2837280adee6df339b3e7b934e7edeab653fc80bf390e622317f
MD5 59f7f63e9c0a42bfb6bddd77150dd9e2
SHA1 ac5524db6f171941b51d09c0df160004bba95dab
SHA512 b405747868030d63c8173bf8d51552d05e326938389470246fe6a3df3f45eb1ea9eb75dd910df5faba61891c11d5444fe8d35b5b03de40b779479e24c15e2e9c
SSDEEP 3072:UYfJgCoOdX7MNwr80k7OTGD+FJ+FOa/MFWxmqd0SRVdff:9BBXwLGva/MFWxmqd0SRVd
TLSH
T1EDD34D13726602CAC463D2B8C55F0517F7B3705453224BEF06A7CEA92F632E27E3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Qt5Core.dll
Size 5.8MB
SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
MD5 5979d6d629dbe9bb074bf2c771f22499
SHA1 a28a748f5fd712fdad425dbb6f1f53c4b97bab6e
SHA512 5c296a8eb3f48ca741bef70e44aa6103edeaf903637c83fd9695e5be4465188a0aa5d5d2c4b707cd5233c0a19782e2857b11aca1ef33e408ff0b2e1cb739fd15
SSDEEP 98304:Zp4b13+8FH9aoHVJsv6tWKFdu9CwjiC6ExqfUCAgw:Zp4b13+8FH8EJsv6tWKFdu9CwjEExqfi
TLSH
T1E7568C8776AB0254D0B7C23CCA97811BE672B8018B218BCF126CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Qt5Gui.dll
Size 6.5MB
SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
MD5 b8a2735292a7d9d69bc4a09da80a5f00
SHA1 0d3691aaa492bb5b8a1f25e00d5179894f2973f5
SHA512 4103ee4ac9ff72bb766a4dd5bc1b2e3de0ab101de3b19c787856685301a9829c20f75785ea4243bf62ff5e33dae07df6c47cabf84cfc69bb84d8ea9277b7349e
SSDEEP 49152:GxTskH658roWctQZMvBFlAdOqymGH7tTZDsY3hotW6pgCnuoyiugWam/5zmKxwJR:aTs4oNyKVlaWGuraUeJrZxcZ
TLSH
T1AE662986725A6252C977E27E8B4F452EE1F3785283428BC748159B480F737EA1B7FE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Qt5Network.dll
Size 1.0MB
SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
MD5 dcf774c4da98b2142e2db51b5a86b510
SHA1 e1481f0af6accafcedc683d69ac6ea47a18dc782
SHA512 2b6094586c95c9701aa5172a40423e585cf74e15bb41735180ebce1ed42479c14e8a51fb73b51cfd8e7283800eb679fc1b8016f25107e4670ff11279e08312e3
SSDEEP 12288:3KmUigw+uCeCrGwtfA8v7Q5EGiVnBOzXvEfZxgzwyU1DC9:3Km5guCeCrdtf/vMKG20YHgzwN1DC9
TLSH
T1E4355B57B36103A5D46AC1B9CA8B8616F272700187279BDF5629DF693F337E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Qt5Widgets.dll
Size 5.3MB
SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
MD5 e0f661dbc795f2794a392250819a803e
SHA1 01b41f59675e50074fc16267e5265659ad43e199
SHA512 1ebec23d6439152f6b00b87002c0df67dcda52b255a9f1a44a4629423c6ecf581a0b78e6aa6c3f5b5bf7846b3af0c3f5319d07142ab69e2f268972a77ca33fd6
SSDEEP 49152:MHiz1l7ZWKSwEaNjsSvVFrta9oxH57t/5yE6fkpQEVE5llmbx/qUqjfQdwXtmLu8:Nw2ELwHkWSUbdwXtmLuxY7pCQ6E
TLSH
T135466A5BB3A54195C56BD238CF8B8613E6B2700447228BCF256A8F592F337E12E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\Qt5Xml.dll
Size 204KB
SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
MD5 5a283d1709c6dae688f071ca0c092b48
SHA1 57fa6cf1fece16ac0cf29323ff8ee5cc49044952
SHA512 410fb85952a9dc98f80b3ecf87dc4d9fa22ce4eb27983dc1b10919130e9d2ddeed64e199f72de69edd4ea9060aaab6f4092cb1241b911043ad3ffacf02386197
SSDEEP 3072:n1pI5DweOktRkjiHRv6XG1/tGACswdqB2dLKskgCjHT5Dn9S7Y4OlK:n/IZweXWoRv6XG1/tdDB2dYz19S7
TLSH
T1EE243A4777254596E42BC238CE1B890BE6B3B8501762DBDF81558B792F33BD2B83E250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\QtitanBase.dll
Size 1.1MB
SHA256 34ee3ad95d2a5a383ed0d274697e19c9b384ca1fcc7a40917cb97bf3facfd3fc
MD5 7ab68bc1e79a6fb3a9abac42fefedccc
SHA1 94209764e12fa8795cd6fd621fd57f86c286100b
SHA512 5bfa03cd9995cfbe5eccb2733fd3abc7e72544e147480adc0b978c8ab7ad587298beb356a48a3616d198312116fda91b72a80b58f12ef9b06a1f11c43ddb214e
SSDEEP 24576:CzfUc8wqLxv+otWr8wY6S8dtuTbwQ3suvsM+O:0cc6xvNdwVu/jvsM+O
TLSH
T1E045AE4B33964356D16BC278C69B8114F477341197438AEF9A1BFE2D1E332E1383BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\QtitanDocking.dll
Size 615KB
SHA256 7eee34cd94f176e379330e71d833c8cbd4f63a51f8229f53bb87fed6aa89764d
MD5 79ebd57d172b0c076e104043a1d64767
SHA1 225352a66f8946e5bcea3e78d30b64509c48761b
SHA512 63a72340fca0d29d618607a4968dd15c612022266ea572cc4d7a85025aea15e950152ab3f5b106d8a87c4418845214f5b6ccf38a28428bdd5e18fe477df5b2a0
SSDEEP 6144:agrl+UK4SXZcUKzbw19sweH9f0vLmBIX75ZTi3Ilx2W9tfF1VntlqouMTBKhgl3b:aOwUPR72SHlkLqamCnnqX
TLSH
T1C4D44A4B726903D2E067D138CA67C526E5B37851436246EFA616CA2D2F33FE13A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanOffice2016Style.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\QtitanOffice2016Style.dll
Size 217KB
SHA256 e62ccdf0f15a01fac19e30216fa37f0f00566c036fb389cfb61b89615bb6101d
MD5 606aaf6aba90df45d23937e2f2cb625d
SHA1 72775a2aa6450f7724b31beff7a43eaeb9cf9804
SHA512 5f2175eac2b7d154918f7ea1a8948f853409d284d0e85f27d56d31074162e153f004ad4aec6b8179369448a5da6ece4459e6089793f9decfe255aa4568339dd4
SSDEEP 6144:GlwWygSAAqMV0LZPHIZAfm4Ra9B06WnZwfwP8o9+3n/CXyLSPqWR:QwWygS/eJ1x
TLSH
T13824F80BB2960796E467D278C64F0125F6B7705483028AFF052BDE7A1F333A5BD3A985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\RobloxCrashHandler.exe
Size 11.8MB
SHA256 09df5019f1e20d4be596f1b89fb107111d07258c2b6110345203d5b18b7c79da
MD5 21dfc7c8e390262167d1a55a5dfd73e0
SHA1 81b4726479bf65b226fd6c03e5098334b4548d8c
SHA512 0a8e403627b884e68f30aa9bc618ed12883781c2c68780753e349002e9a39e4d15fb53bdb034f68d90479c65bb2fe67accd240b8fcd3bf1113cec257b9da0501
SSDEEP 196608:4kDc6Ul45HAbClxq/FWFZmgKjBeVm/B5LymMjD:4kDJ2I8F+mgKjBeKfyzD
TLSH
T18AC69D6AB2BC00E8D4BBD17CC6469617E7B1741513709BDF1AA086FA1F63AE41E7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\libfbxsdk.dll
Size 7.5MB
SHA256 3869e66e3648956844950fb001c968e7fd922e7835f2f9a0257627b3588be732
MD5 dc80ec446c012c2a5cd2bcc8d7301697
SHA1 433cab3e4a2ca05a83c6948bb0cdb8099e754b84
SHA512 c6e853d4846f61ee895a97399c5789d061c87030e41b62e11e04e4157e976212222b09261297e79b7053c21b40a371fa6181aae85b2d5d2c0af2bc746fc4a4bd
SSDEEP 98304:yV2w6r5ceJRg/lnmCiyBZjr6lGo1EiXYSGUWGdy:yswzeJRg/lXNr6lGp7
TLSH
T183866C5B62AE02E9E1BFD17CCA871803D6B23401533A9EDB02994A5E1F1BBD49D3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mimalloc-redirect.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\mimalloc-redirect.dll
Size 59KB
SHA256 bc3dfdf51fbc80b88cb62cdb6a6784ecc894164bdd4ae7f3885048d870809491
MD5 d37591baffae7afe9ea0cfcf08349a95
SHA1 55e522801d5de7a90a8c44c130a6b1bc124380b8
SHA512 fbe7a2cd904872368ff53a7beb8a89ef7dc655a858dda8d409983297fde5e9462aaa5577863c01413b3aef835dc3170350fbdf1a48c8297785b66f30b201a404
SSDEEP 384:HbtdwSa7lxtuzeeIrFYDi9+DlOvBa02HxJsoYEqUD9NR5SV7wvdpz:HJdSlxtuzfIJoi9+xH3scdr5SwVpz
TLSH
T18243874F9BA920D1E4B9C1389583273DB5A1F0E413358BC796826A1F0F617F8BA3D785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mimalloc.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\mimalloc.dll
Size 173KB
SHA256 5b7684b70916186f19374e32a745fac332708e1be3e586a33c75930839db0b89
MD5 54db51f3a35fc2d697ea780dbc76d709
SHA1 28a3f702f90dd624c69c2b556aa0daf14f2f4988
SHA512 8c3f8b710f168628aee166c806266d74bf5451cc35d092c2370e5f996161aa02e235b180bcc788bfec115f988a215ad49fc8207bac7483549f0d4bcf8b7ea2c0
SSDEEP 3072:ZIv6rv1xqJEQyWfTkZvnPuIIjAfo10T9p0eTYUsUt15uJm8do3nylyebhUX:ZpxqJPyWfTDjjAfo10eUt15Km8do3nyi
TLSH
T1AA04395AB26810BAD567D23CC9571217E3B234291761A7CF07B053BA2F27BE46B7B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9b554450a0fc4e65\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download