Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Explorer' = '%WINDIR%\resources\themes\explorer.exe RO'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Svchost' = '%WINDIR%\resources\svchost.exe RO'
- [<HKLM>\SOFTWARE\Classes\roblox-studio\shell\open\command] '' = '"%ProgramFiles(x86)%\Roblox\Versions\RobloxStudioLauncherBeta.exe" %1'
Creates or modifies the following files
- <SYSTEM32>\tasks\svchost
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %WINDIR%\resources\themes\icsys.icn.exe
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\permanentmarker-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\pressstart2p-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\robloxemoji.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\roboto-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\roboto-italic.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\roboto-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\robotocondensed-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\robotomono-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\romanantique.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sarpanch-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sarpanch-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sourcesanspro-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sourcesanspro-it.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sourcesanspro-light.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sourcesanspro-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\sourcesanspro-semibold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\specialelite-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\titilliumweb-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\titilliumweb-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\twemojimozilla.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\ubuntu-italic.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\ubuntu-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\zekton_rg.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\accanthisadfstd.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\amaticsc.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\patrickhand-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\arial.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\oswald-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\nunito-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\gamecontrollerdb.txt
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\gothamssm-black.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\gothamssm-bold.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\gothamssm-book.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\gothamssm-medium.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\grenzegotisch-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\grenzegotisch-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\guru-regular.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\hwygoth.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\inconsolata-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\indieflower-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\josefinsans-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\jura-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\kalam-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\luckiestguy-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\merriweather-italic.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\merriweather-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\michroma-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosansbengaliui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosansdevanagariui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosansgeorgian-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosanskhmerui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosansmyanmarui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosanssinhalaui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\notosansthaiui-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\oswald-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\sarpanch.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\ouch.ogg
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\comicneueangular.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\titilliumweb.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\ubuntu.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\zekton.json
- %ALLUSERSPROFILE%\roblox\downloads\1d0390337d1a4a58e5514be1a9481ad6.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\bn.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\cloudadvection.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\clouddetail.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\clouddetail3d-bc4.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\clouddetail3d.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\clouds-bc4.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\clouds.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\cloudsfb.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\moon.jpg
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\noise.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\noisefb.dds
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sky\sun.jpg
- %ALLUSERSPROFILE%\roblox\downloads\f4df135a7a5ba4eb2a2bb525c22db6e6.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_falling.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_footsteps_plastic.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_get_up.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_jump.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_jump_land.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\action_swim.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\impact_explosion_03.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\sounds\impact_water.mp3
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\specialelite.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\fredokaone-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\sourcesanspro.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\romanantique.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\creepster.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\denkone.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\fondamento.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\fredokaone.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\gothamssm.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\grenzegotisch.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\guru.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\highwaygothic.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\inconsolata.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\indieflower.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\josefinsans.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\jura.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\kalam.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\legacyarial.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\luckiestguy.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\merriweather.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\michroma.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\nunito.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\oswald.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\patrickhand.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\permanentmarker.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\pressstart2p.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\roboto.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\robotocondensed.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\robotomono.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\balthazar.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\families\bangers.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\fondamento-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headh.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositextraslot0.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositextraslot1.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositextraslot2.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositextraslot3.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositextraslot4.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositfullatlasbasetexture.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositfullatlasoverlaytexture.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositleftarmbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositleftlegbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositpantstemplate.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositquad.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositrightarmbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositrightlegbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\compositshirttemplate.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\composittorsobase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\composittshirt.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\r15compositleftarmbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\r15compositrightarmbase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\compositing\r15composittorsobase.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\head.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\heada.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headb.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headc.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headd.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\heade.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\morphereditorr6.rbxmx
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headf.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\morphereditorr15.rbxmx
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\defaultpants.rbxm
- <Full path to file>В
- %TEMP%\rbx-79a8a0b9.log
- %WINDIR%\resources\themes\explorer.exe
- %WINDIR%\resources\spoolsv.exe
- %WINDIR%\resources\svchost.exe
- %TEMP%\crashpad_roblox\settings.dat
- %TEMP%\rbx-5a0322ac.log
- %TEMP%\rbx-05af6b91\robloxplayerlauncher.exe
- %TEMP%\rbx-79e54ee2.log
- %TEMP%\rbx-7c02208d.log
- %LOCALAPPDATA%low\rbxcsettings.rbx
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\robloxplayerlauncher.exe
- %TEMP%\rbx-86bba0a2.tmp
- %ProgramFiles(x86)%\roblox\versions\robloxstudiolauncherbeta.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\roblox\roblox studio.lnk
- %HOMEPATH%\desktop\roblox studio.lnk
- %ALLUSERSPROFILE%\roblox\downloads\8637f4e193364feb4f969842709fcf68.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\robloxplayerbeta.exe
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\copyright.txt
- %ALLUSERSPROFILE%\roblox\downloads\46fc969870dbf77f4c89ae195e47aada.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\character.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\charactercagedhsr.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\charactercagedhsrv17.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\characterr15v2.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\characterr15v5.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\defaultshirt.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\es-mx.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\denkone-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headi.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\it-it.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\ja-jp.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\ko-kr.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\pt-br.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\pt-pt.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\ru-ru.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-cjv.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-cn.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-hans.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-hant.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-hk.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\zh-tw.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\gamecontrollerconfigs\gamecontrollerdb.txt
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\reflectionloggerconfig\ephemeralcounterwhitelist.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\reflectionloggerconfig\ephemeralcounterwhitelistmock.json
- %ALLUSERSPROFILE%\roblox\downloads\767d2108079b6b1c3bed64f1d03eda6e.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\accanthisadfstd-regular.otf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\amaticsc-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\amaticsc-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\arial.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\arialbd.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\balthazar-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\bangers-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\comicneue-angular-bold.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\creepster-regular.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\fr-fr.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\fonts\fondamento-italic.ttf
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\fr-ca.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\es-es.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headj.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headk.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headl.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headm.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headn.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\heado.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headp.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\meshes\leftarm.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\meshes\leftleg.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\meshes\rightarm.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\meshes\rightleg.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\meshes\torso.mesh
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\scripts\humanoidanimate.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\scripts\humanoidanimateleakfix.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\scripts\humanoidanimater15.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\scripts\humanoidanimater15leakfix.rbxm
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\scripts\humanoidhealthregenscript.rbxmx
- %ALLUSERSPROFILE%\roblox\downloads\30c6836c370d2d267ffa0735c2476eb6.part
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datamodelpatchconfig\datamodelpatchconfig.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\de-de.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\en-au.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\en-ca.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\en-gb.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\en-nz.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\configs\datetimelocaleconfigs\en-us.json
- %ProgramFiles(x86)%\roblox\versions\version-9045f70ea522489c\content\avatar\heads\headg.mesh
- %ALLUSERSPROFILE%\roblox\downloads\bdfe6a2d6eeacf882cd3a4d5ec4196e8.part
Sets the 'hidden' attribute to the following files
- %WINDIR%\resources\themes\explorer.exe
- %WINDIR%\resources\spoolsv.exe
- %WINDIR%\resources\svchost.exe
Moves the following files
- from %ALLUSERSPROFILE%\roblox\downloads\8637f4e193364feb4f969842709fcf68.part to %ALLUSERSPROFILE%\roblox\downloads\8637f4e193364feb4f969842709fcf68
- from %ALLUSERSPROFILE%\roblox\downloads\46fc969870dbf77f4c89ae195e47aada.part to %ALLUSERSPROFILE%\roblox\downloads\46fc969870dbf77f4c89ae195e47aada
- from %ALLUSERSPROFILE%\roblox\downloads\30c6836c370d2d267ffa0735c2476eb6.part to %ALLUSERSPROFILE%\roblox\downloads\30c6836c370d2d267ffa0735c2476eb6
- from %ALLUSERSPROFILE%\roblox\downloads\767d2108079b6b1c3bed64f1d03eda6e.part to %ALLUSERSPROFILE%\roblox\downloads\767d2108079b6b1c3bed64f1d03eda6e
- from %ALLUSERSPROFILE%\roblox\downloads\1d0390337d1a4a58e5514be1a9481ad6.part to %ALLUSERSPROFILE%\roblox\downloads\1d0390337d1a4a58e5514be1a9481ad6
- from %ALLUSERSPROFILE%\roblox\downloads\f4df135a7a5ba4eb2a2bb525c22db6e6.part to %ALLUSERSPROFILE%\roblox\downloads\f4df135a7a5ba4eb2a2bb525c22db6e6
Network activity
Connects to
- 'cl#######tingscdn.roblox.com':443
- 'microsoft.com':80
- 'ep########ounters.api.roblox.com':443
- 'se####ak.rbxcdn.com':443
- 'se###.rbxcdn.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'cl#######tingscdn.roblox.com':443
- 'ep########ounters.api.roblox.com':443
- 'se###.rbxcdn.com':443
UDP
- DNS ASK cl#######tingscdn.roblox.com
- DNS ASK microsoft.com
- DNS ASK ep########ounters.api.roblox.com
- DNS ASK se###.rbxcdn.qq.com
- DNS ASK cl#######tingscdn.roblox.qq.com
- DNS ASK se###.rbxcdn.com
- DNS ASK se####ak.rbxcdn.com
- DNS ASK se####ll.rbxcdn.com
- DNS ASK se#####fly.rbxcdn.com
- DNS ASK se####hw.rbxcdn.com
- DNS ASK ro##ox.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Progman' WindowName: ''
Creates and executes the following
- '<Full path to file>В '
- '%WINDIR%\resources\themes\icsys.icn.exe'
- '%WINDIR%\resources\themes\explorer.exe'
- '%WINDIR%\resources\spoolsv.exe' SE
- '%WINDIR%\resources\svchost.exe'
- '%WINDIR%\resources\spoolsv.exe' PR
- '<Full path to file>В ' --crashpad --no-rate-limit --database=%TEMP%\crashpad_roblox --metrics-dir=%TEMP%\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotati...
- '%TEMP%\rbx-05af6b91\robloxplayerlauncher.exe'
- '%TEMP%\rbx-05af6b91\robloxplayerlauncher.exe' --crashpad --no-rate-limit --database=%TEMP%\crashpad_roblox --metrics-dir=%TEMP%\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotati...
- '%WINDIR%\resources\themes\icsys.icn.exe' ' (with hidden window)
- '%WINDIR%\resources\themes\explorer.exe' ' (with hidden window)
- '%WINDIR%\resources\spoolsv.exe' SE' (with hidden window)
- '%WINDIR%\resources\svchost.exe' ' (with hidden window)
- '%WINDIR%\resources\spoolsv.exe' PR' (with hidden window)
- '%WINDIR%\explorer.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 16:47 /f' (with hidden window)
Executes the following
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 16:47 /f
