Analysis

  • max time kernel
    222s
  • max time network
    273s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-02-2024 22:09

General

  • Target

    RobloxPlayerLauncher (18).exe

  • Size

    4.7MB

  • MD5

    71add7b85d2f54ceb8f29441ac289ff9

  • SHA1

    aff84fe9d9a02041efcc1c31d8832f5c6e568c61

  • SHA256

    ca60b1b987cc86a5e3ef20aadb809afd866ad28291ee0493f396dbd5bc36d444

  • SHA512

    73ade50aabc1b290f215c50702deaaf8969f019883e96544a2403789c611860a2e4fe8a4fe03f817e5c10f3b2913a9034652462f82ba7a67fe171a2dedf0a671

  • SSDEEP

    98304:CFvW3v7lBiz5aaV6natNgusbwIbp7swZEV0eEObn:wov7a5hbguylKV0POb

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 36 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=252144ad201c7c0df361af1230d28cc870855239 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x6b8,0x6bc,0x6b4,0x6a0,0x754,0xcc0368,0xcc0378,0xcc0388
      2⤵
        PID:872
      • C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5cc,0x5d0,0x5d4,0x5a0,0x5e4,0x10186c0,0x10186d0,0x10186e0
          3⤵
          • Executes dropped EXE
          PID:3252
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2624
      • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
        "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" -ide
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
          "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x720,0x724,0x728,0x69c,0x748,0x11725c0,0x11725d0,0x11725e0
          2⤵
          • Executes dropped EXE
          PID:2088
        • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\RobloxStudioBeta.exe
          "C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
          2⤵
            PID:2016
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RestoreComplete.txt
          1⤵
          • Opens file in notepad (likely ransom note)
          PID:4264
        • C:\Windows\system32\werfault.exe
          werfault.exe /hc /shared Global\66ab698732bb46a48b680a563c41936c /t 1996 /p 4048
          1⤵
            PID:1120
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1656

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

              Filesize

              2.2MB

              MD5

              884c0532700f3ae25361d1fb0f5cab27

              SHA1

              b074e425ca3ca37121c63db2c8db64c0067c8fc4

              SHA256

              f7a133dd4edb151d96b5c0ea1e808b3974210c8d388ef338744c2166da4d9854

              SHA512

              5205b105e004b72c22c91f0c0e241e67e16e1a367f799e096afd1194428c6fc904368c18a87822e90a6d41d1f55236b06092e010f7b28737fedcfb705b356f3f

            • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

              Filesize

              486KB

              MD5

              970bafee67fb576048e77e7018f94364

              SHA1

              7458ce698121a1e05a18c851c6bf3ab7a012cc37

              SHA256

              91befc42563554a8f2e20f008bc17efc4da5407815b4cf97fdb249dfa93f7928

              SHA512

              ab8e4f2c114e1dfe9b16d7103c7876ee760ac60257755d2fab673bb881d8c189085d1fdeddee2cab787034e13f89f306b51758e1f426432b8e22ce8e06a20a02

            • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

              Filesize

              64KB

              MD5

              1e27d49be4486ff61fbbaa412dc89fab

              SHA1

              6f36a1b3085c974fd8674d9dae2d4d4ab8b9795d

              SHA256

              0c888e290401f4c589e2fdc2952ff5b795d5a829d3e632d2f4162edb55569caa

              SHA512

              cf11e4724dbdd41820fbf0c598e3c303388f16474f77f9702bf3335ff6e2fc8c0f3aff236724c899e63cd640780dd7991e31f458053ccad6dd7c3dccb9855909

            • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

              Filesize

              2.6MB

              MD5

              1556a8833c089e61847afe4eb890067e

              SHA1

              4d0343970c1b0e06cb30f66627079b67fa868dcc

              SHA256

              a1d3e65e605e85e028f00df5c3c1c9526ab4107ab755987ee7f8ae37a7496955

              SHA512

              1b1ba580f22110fe06cf9d1c58ccbb22e87ac2d1fc65ca4bf390096d691bf703007203c8f25ecc5e34f2b61fc45c73bb7163958897d7c4704f95f173a557d61c

            • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerInstaller.exe

              Filesize

              576KB

              MD5

              1a6e325b93df6fde4bf82d418eedd89b

              SHA1

              a2ca4e9db628cdfbdd029564368294e4f7d3df1d

              SHA256

              fd34f49c095ac886cb7f601b5b3ef6bbc293055f19a95cfe0902fbacf2098ea0

              SHA512

              4aae46f1990513929d02fbea7c35f1008e75f8e625782f032336ad73cdd13d11288464cf89495e116ed85d9a3ff7ba1aa1fafcae9d3512b97d4c6813ba7461c1

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Plugins\Qt5\platforms\qwindows.dll

              Filesize

              1.4MB

              MD5

              e81f163cbeb67ec8414c2ab3b4119647

              SHA1

              065921e56683b78097e125da120420136258ec55

              SHA256

              117c9b304c2c8f6bc2fb466f9a8323591b9213d388252f142081a3e84d3b638e

              SHA512

              6700efcdae09a40e1907f56ee4fe2308422ce53ef76a13c434d1cd57a77d934e0bd583c8d96ced0fd250fd0ba727be6d7258692a6bbe19053b88fb48d188b13d

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Plugins\Qt5\styles\qwindowsvistastyle.dll

              Filesize

              144KB

              MD5

              04a9a47fa806c912a22af17577566709

              SHA1

              2caca306233ef324d63ef3fd04937793ff2af912

              SHA256

              792ddc958db80cfdb7132acf698c02367c02e27cb69ed04b7f4f542b0478c157

              SHA512

              47c39a2e91f0444bec87055aa1592bea6b0fe5fa1996b4c1f3d38a1928381d8a536522e5f86cea3fb7c655920ccee66c468a1d02af152750a41fbe46c9aad032

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Core.dll

              Filesize

              2.8MB

              MD5

              67326c5b038d7c9536ed4e2cb281bd0c

              SHA1

              06f65bd8e39a272bbbed407636a85344e08c1cc6

              SHA256

              8bb083332efd3bfbe2930ccf5e88d55992d2c2971281964cfc707e41376e2e9a

              SHA512

              22319184e1447caac33f5046622c709d70261d2f7578f8118742b6ad7963e3bbb98d00d313cdda7e102bc1d80893a5416cf53fe34b2936d6b354019df05a13f6

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Gui.dll

              Filesize

              2.8MB

              MD5

              c3e662a132746896d4b985aa2b7ba0a2

              SHA1

              3596ed8a9c203ebbb7bfb06d97e39be7a1e19f6b

              SHA256

              1090c53c0ff68da73e835ebe6f1cc6cbbe6057f8df605a6490e4e833768d13b2

              SHA512

              781d7ab05ebbc7fa27a0d45ece654709eb950afa10c7abb0e38a1c8153297049deeefb93237b722c0bf83e5cabad58c4e65f14de24621d983ddb7aea8bfe8753

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Network.dll

              Filesize

              768KB

              MD5

              f24f7ded78976104aebfd98f2aba09d3

              SHA1

              fee2857030bc4ef4c39097c49c92e9a6a44a7043

              SHA256

              c21440e0274443ff5c154f5080cedf62d0ca07f5a108ad730b24eecff0f49ed5

              SHA512

              0b7a036d4a3431b4e58e962d0796c19d484a0813ebbe3777e87c53b1b018dd2de24e3f4cc10eda24e64e10b0e9fb3342d83492bbb8607d14313faa2febe2ced3

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Qml.dll

              Filesize

              2.8MB

              MD5

              608ca9aa8c2288e72184d29dfd702478

              SHA1

              3fd2bc9f07d2f2236e8da948b3262cc19b6b2a19

              SHA256

              7aed504dab50b73f14c0365329a628205304e996e82d17f546dad3f2d366fccc

              SHA512

              9f3e441b8853d29d6972b65e2ea137e4792d4620f826eb2a20d24a3b89db60b948cb6118a29c465aeaeac0bd37e801bd4fa62e8cc141001ae0ff88a5ab0c4bcc

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5QmlModels.dll

              Filesize

              434KB

              MD5

              3dc45bf971e92b79c15b5484b64cd264

              SHA1

              d3d9518fa010a32f90692930910adbf6464c19f6

              SHA256

              4dbc827fbc94dda107d3e4004ca93b0fd97f66bf615da478944f0c1e0e0c422c

              SHA512

              3af883e5ed7e8fd0033e87d7e5fbf9c0da85ef6da559f37bbcbf10c027408d2ce6b7cfaf1210cd556ad8a12baebb00328ceb5d63ffd9752d7400d260a7eb16d4

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Quick.dll

              Filesize

              2.9MB

              MD5

              81f2b9a55e19a513fe9a1dec0aa1b563

              SHA1

              dfd71493ea035556d9b8080351d2f52da8409296

              SHA256

              c6b0e0d13b3c089abc232add76e23daa50d1fd1a8e10588d392080423efd5809

              SHA512

              ca049d3976c0eae9eac0a859a2607ef38a781bfd9b1345c8b9bd3e848456f2247338e9ec4311ddaa26371c10456586878818095871baf51152e214c7e63084b4

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Widgets.dll

              Filesize

              832KB

              MD5

              266d2fd94c43b80a387b7f6eeb9232e8

              SHA1

              aa78d2bb6202d9fbcdf0878c50403faf0b441746

              SHA256

              2347e23ca8fe362015ccccc1d33d52c355d6602e64acee7acc1568f6586628ab

              SHA512

              340fd041acc3bd275ef2e43f284a290dc35c6959658ba0ef689c4956a80144724df98937f2a317f3f73ef4ff604de698ea56b23800c60860240de14fbf32152a

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Widgets.dll

              Filesize

              768KB

              MD5

              c00aaf1ece0aec5f88e6bbb127cb600c

              SHA1

              ef1fd75467e6c60bef939854b02e5d742e41d30f

              SHA256

              ac1648e741c0713ecdddc541c1b43c0836b2054975bd251f36d72de5e3c41b21

              SHA512

              301c1069abd61aa4edb24aa121be48063391dbf2ee7ec674bc3574e2d1c03297d773fcca950b7ab809d9aecf8a61c6c93feeced17536605bb8dc3d8b511762ca

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\Qt5Xml.dll

              Filesize

              215KB

              MD5

              a24011ba1cba9e517da2d89d530329cd

              SHA1

              867f44a65128db05ec1c2842a52b2752ba22346e

              SHA256

              7315e183382b81e65be9e3efb2ae151f6c95fad914a0dbfbf0400dfab868af48

              SHA512

              76d7115d7b5f57a609cae61e768b28cc873f30a4aea46a2b385e9c8be1e5bba7c73ce84731708fe12f28d691b06ec6dbb8579f5eb9eca92ecf83d94e97b98620

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\QtitanBase.dll

              Filesize

              1.1MB

              MD5

              ce939f2cd9ffa31ef3f1c233ced66229

              SHA1

              b090710f006ba3c1cf6a5fa761bf0db769752153

              SHA256

              a6b6eccd789260e780d2409058a1bc032f86cb168a7112ad1a5f4faa49aa4b16

              SHA512

              000c1f4056ed4c3ce63e5775f7c2e6e0307a03575f921a0510eb58d99075b8f328618ba9e86228a40e747c1ed6e910da40a349d0620d08b526e056bd50b2eab6

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\QtitanDocking.dll

              Filesize

              612KB

              MD5

              536a4648d214f5069547afde708f3e77

              SHA1

              d9a363e5b047f9f15844c15c3ec32ae1c6d60947

              SHA256

              eb71c47e48d68f4087d3270f1d70499a7e701790658c50515132d992ea74af24

              SHA512

              a8bb6d8ea6ea65b48f11c1a8901162c0ed02117ccf13b9490adfc391f498ab225acfb52dd272c3f905dc16299db0593fbf818e3ffcf2cc1a42866cb396cae4d5

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\QtitanRibbon.dll

              Filesize

              832KB

              MD5

              23932da75a79f94970135d4846bdd990

              SHA1

              1975fc4b51e641f69cba0284d50b805ab9cd75d7

              SHA256

              1b77f94e5816c6a7c8ebc0e3b70f40fabbc7dc8400fc6e8058a21f0bc1b2a00d

              SHA512

              3d1a860a0be9aef2265cd09a168874e957518fbd5d8d904712deb574e070b31d93cc1ed701d94ebaff0a199576337a340c41f9e18eaefd6caccb403997bf8afc

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\RobloxStudioBeta.exe

              Filesize

              1.2MB

              MD5

              e5fea289619cd103604975621e411f64

              SHA1

              0ea9aa44e2b5ae1557eeb9737d5e98f9f5f4ae6b

              SHA256

              06d4c3b3880f32b41d54240f8695da051bcc78eca03625433dfe6a92e418f79c

              SHA512

              e6d699c9cd455d2bfff494659de1ed12d2a2452e59fe990e5b2e3458323de36e158bebccd848242339ab648201e73b248bddfc32c6612e41478cfe6d2ae71808

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\WebView2Loader.dll

              Filesize

              154KB

              MD5

              577f05cd683ed0577f6c970ea57129e0

              SHA1

              aedf54a8976f0f8ff5588447c344595e3c468925

              SHA256

              7127f20daa0a0a74e120ab7423dd1b30c45908f8ee929f0c6cd2312b41c5bddf

              SHA512

              2d1aea243938a6a1289cf4efcd541f28ab370a85ef05ed27b7b6d81ce43cea671e06a0959994807923b1dfec3b382ee95bd6f9489b74bba59239601756082047

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\libfbxsdk.dll

              Filesize

              3.1MB

              MD5

              7d0cb654fb084c0a0f9103fec5197356

              SHA1

              6cf0ec26904ef27316afbd31293dcefb29b74047

              SHA256

              4cea2d6e309a09eceddc8d788e1cb69df5a4002b28b77981eb338cc9ce47042f

              SHA512

              cc8ed1d573c535710bf5cc046b74f246ebbfea6c80c8f70d86d8ec4c2a0b0a995888df858dde58d6bdee06a1965d48016b52d0e9076160b27de8e973835ce65c

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\msvcp140.dll

              Filesize

              552KB

              MD5

              cd0c37f1875b704f8eb08e397381ac16

              SHA1

              249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

              SHA256

              d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

              SHA512

              d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\msvcp140_1.dll

              Filesize

              23KB

              MD5

              8ad9c7cffbb2413f4d5ff9f3aaa1a69b

              SHA1

              2b5116e49ac5913ef8a512a7299e9a459dab4778

              SHA256

              18aef42187072c35b537be80e3b2da7ce4919b2c9574add19409d98e3026d916

              SHA512

              d489b82ce896a06cd37905bc5b2fe9620f4e7feb2a9b77fc93f94e0270b67e7a2f3879afba6b546ad44f2ee96f050e83bfc93830010a707126667857be79028a

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\sgCore.dll

              Filesize

              704KB

              MD5

              4080d5d4c119e4417e876c9d4c10cde3

              SHA1

              86207bce624ff949a2d3adc0e23cf32880ba6578

              SHA256

              7bb6012be654af5168b33f2727370cdd193a9927903913563bbb0cca545741b9

              SHA512

              24c3a3f4e7d0461c02bf54ec04d29773c9e2e3475e0ad4bf2e11a92c446b2aa95b7689b8a2fc4e2525c8f89780a4046700fc7e34dc4fa4b13e99154ab372dd3e

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\vcruntime140.dll

              Filesize

              94KB

              MD5

              11d9ac94e8cb17bd23dea89f8e757f18

              SHA1

              d4fb80a512486821ad320c4fd67abcae63005158

              SHA256

              e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

              SHA512

              aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

            • C:\Program Files (x86)\Roblox\Versions\version-b0be9ce0740f40b4\vcruntime140_1.dll

              Filesize

              36KB

              MD5

              7667b0883de4667ec87c3b75bed84d84

              SHA1

              e6f6df83e813ed8252614a46a5892c4856df1f58

              SHA256

              04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

              SHA512

              968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnk

              Filesize

              1KB

              MD5

              237956042ebca7eaf2a886794295276c

              SHA1

              4624407c7a3577362200d67c4824c9547a06c29a

              SHA256

              e73dbc1406d11d3097886d88c8af5cc79c0908382e2a6b47b56d582746be8aa0

              SHA512

              9c1157df40ee9729120a3fcd3446809e8ae4fb79142ebf46d7a1f6c11381a9d0c0de85276a3cf78674d7692ab32ddac37825941f32e03a52b3416b7e07b5b250

            • C:\ProgramData\Roblox\Downloads\roblox-player\e5d3b8a1a30406c5f0899e94020cc821.part

              Filesize

              3.5MB

              MD5

              f9c0d5c34ed31d0d00ae77e93705b57a

              SHA1

              fa3ea0f32b61fc26ed4429a83689fc6581d046b5

              SHA256

              07886299dc16299526ca1cbfbfaf4386ad7b80e3b39d744df3d20ec1b05f17e8

              SHA512

              55ea3d2788086cd9db536419acfd08ad6053071548f24be5049061d1dc1509d08c70d3e69d4bb768a2a548ccdcb474085e349e935c75470e3d6a7fab7cf35e17

            • C:\ProgramData\Roblox\Downloads\roblox-studio\99a7511e154cbce73843fad1b433d28e

              Filesize

              4.5MB

              MD5

              99a7511e154cbce73843fad1b433d28e

              SHA1

              6be733a679796d39b6ca56d90ccd1fd43af1ca71

              SHA256

              b80a2aecaf37ada0b7e10886203208cb88e429f727d00a227867d48c8daddc1a

              SHA512

              4015f4615c8eca3128ea2de127625a64f436826eb85ca5eba4daaaa330fca9647cde26b6435f53f8108698ed8b68a2185a61fd7a3bf975e5380b2811f3ae8fb3

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

              Filesize

              2KB

              MD5

              414cc78543240371588e915fa02e9ce3

              SHA1

              bebe937c284acb073bb1303b11617de2f8d13220

              SHA256

              0234a2984a42356327f2648005b74b80a13d4caa1fa15ce72aa1c1ae7559976a

              SHA512

              2f0ba4a508e3351a04fb065865eb7b00da2fb0baa1a1aa7968e6c192e9cc17b26e3024f3260a07ea58beb499befe2688a484180ad88ead5f665b41f2c06b9b87

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05

              Filesize

              472B

              MD5

              90e7f05c6bd3719bd73d825a8625154a

              SHA1

              54d83e0bbaa567ea6071b98910e2368a26523c53

              SHA256

              dad7d236792743797d90bc4ac7419728df99ad88bfa88f2818add6f8a22a5c5a

              SHA512

              1dfc3cf86fcc308fb5b54b2a08007ac734876aef95fdd23381ebbdb360e8c5ec7dbddf850a6c4e0e3a51ffde9aae935db3c30ea78f5ed8b2de072b00b35c6e36

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_23696E1BCE0146132E9940E9F4229A2E

              Filesize

              472B

              MD5

              bad15c4cb3891da0d1f70f77b757e231

              SHA1

              b37213ccb8c359268d4aa7e249dae68d0b60f25a

              SHA256

              236a0b0780dee940a7c22e1c1b7f5c27cd718d7335a128e112c528dcfc55cbb1

              SHA512

              2bfae03a4393e09cf4438ac5d4a060d43c139e3a0c7b067edabb3a0f47db0591f988f39ed111bf2abe8a8b3c7c12a5aaaddd8af6dea6a6daa101be2d9717f1a1

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

              Filesize

              1KB

              MD5

              76e13853e71ffa71ba76664bbdbee1e8

              SHA1

              6af60fbdff49089b3e7c94f19e88eba5c948d03e

              SHA256

              21831a03f8be39a43e73b568475286b1f6a86b63a1415cf11001eb0f7d745977

              SHA512

              00102eee75aaec5166200d9b4fdd41865884fc33600bd5c756738d03037a47e89991039eb94802d411cd668e35970aad1640260203e7ec5cb77b5ba0ffe163f4

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

              Filesize

              1KB

              MD5

              5b9dc51eb6ca5e3eb57730ccccac4f46

              SHA1

              07defab0c9026042c3c2163c7f62c3cf1bd0b2ae

              SHA256

              43dfc1607db310f03dcf964636f54ff9dbd749b80ff34f5f2d508e0ae8b4b6c8

              SHA512

              eb4dfcab07d111894bf57dd3f15d2ea1ee2535c492ea94587fd89fe282909d660b9218930a3ada93371b2d58640dc2fb3a9756c44a958d658b758ea91f3373d4

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

              Filesize

              471B

              MD5

              572ea307898c8c6eaa8dc4985a77e177

              SHA1

              07f16d7a86f8b799364a5c654253e9a2058667af

              SHA256

              a0af8a9e91c0c0e591be7382e2e875d6ad52eb6fa86dbba599704a5d5189e298

              SHA512

              01f77c6cd80e50006476a66170dcf4238b6b8d5173a20c071605411dc49610d88950b52d6d8935e07301dd69a42c84c713fa50f7d6bc75686b452f77a5a6d191

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

              Filesize

              2KB

              MD5

              f95bd71a77c00c29a93e2af6fdf201fd

              SHA1

              4ebbc400e4ee80a714bd6dd4f745e4defad223fc

              SHA256

              5d5d9b76d2bde2a8707bcf90736295dcfe6f1f16b71fe56c2259dadfb7218891

              SHA512

              cf1bfa4240dda937615b8002623ca14782c9301cb86e96d7bdb40456cac2d07a1856b095c7c6fc95b7ef8050ccda66dc81987b26ecd1f60d3088c6a5aeb6167e

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

              Filesize

              1KB

              MD5

              ee312d0cdef286ecc6116c770dbdffcd

              SHA1

              b16485959a655ef42e98fda3391eb83b4bd91922

              SHA256

              52bc0dea85163eef64a11acb9e95e8c287c487579be1d1fb25161e5a2b7e5be9

              SHA512

              3891cdbb13a401db459b2d5eb5962b8b87bd0b735f58db23f7ac3551d5d3a93287d8d4d8b4ae4f294b3ca207cebd934683db3ce507db2babe73952b724b7cc91

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

              Filesize

              488B

              MD5

              bd07c09ff8ebe6b8d3a322e59441d316

              SHA1

              11d5f9d76261af0a1b553ee5f3ffca1306102680

              SHA256

              ee596765c6907e390bb4ca8717c068981d1ac3906c87ffe8970c3dd7942bf9db

              SHA512

              ba75e183403ec13333a63b6bee96fbde539bfd50d86a8ac877b1f416c35e13f69e242043348266580cbc67edd505b0098ba2b90859a01ca576de9be6870f9b37

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

              Filesize

              488B

              MD5

              df1256ff2e476c4b23cddde237ac5eaf

              SHA1

              f7598de23f0b93aafe51d42fb19927dbca328c89

              SHA256

              11838de0bf7949af999be46f29c77b2c5280287c17d1b567286b282c38181fc7

              SHA512

              121c5eb15b1e1e3426677ac7988103e0222341349f5cd4bb4a4dffa8c02bb3b86e95b68d323e5e2289734abb0ec793773e6d69851c975239dc5c84621346d36d

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05

              Filesize

              492B

              MD5

              98a595ea002e06232ac1b84aef87e7e2

              SHA1

              d2f37b237a8a1095c2a40be590bc1394a86fe234

              SHA256

              9008f2f0806fa236926bdcbd4f87ba0784a56cc7ee849a6a5ce77c73fc457cf9

              SHA512

              223d5acd003f6322ad1e292db002eb83aa719017ef2ad2092dc8240086308ec399011c0fdfa60f52c15a1fb5c31b5db4f0a3d184c14b9eb007760709cfcb9096

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05

              Filesize

              492B

              MD5

              fc2a708addf96447c3a213745bdddf64

              SHA1

              f1c53a7b7215ae44c4501815abf405cdc151c267

              SHA256

              ac757fb7f836b64b352d138ffc8a0acfd0e3e8609c6ef21f90588bb23e29e32b

              SHA512

              8c435380e9c73907915031d68755f0645be867e23c2ac573a8972b711615318baaa1367517a91503c39aa85d4b1c990389967c6e7cfd9ae2ca2d4bffd220b92b

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_23696E1BCE0146132E9940E9F4229A2E

              Filesize

              484B

              MD5

              493dfeecbefeb5839ee9465274d201c0

              SHA1

              28159c4e195110b994594d32f3e4135e7d8ecbae

              SHA256

              58d7afc1edc72d3cb21453ab9728379bcfaea939fc8ae5f9a13783d1ed2cce12

              SHA512

              34373f95cc09bf736b61c92feb5ee27bad2baa51c9fba6cbbb327d1fbf9d9bf77e9a57be68cf6bc52e18f0448ebde1eecf7e3ba1c469731dac4e94d1bd4549c2

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

              Filesize

              434B

              MD5

              1a9da560019e74314cbd733555cd9ada

              SHA1

              2fd8069fb2cdd7c7658f63ed06107dd9a80c7959

              SHA256

              d46a91cfaec3147a3ea439e584126ff6ec44466dd1c0eddeb36bccdfb90b02c7

              SHA512

              65306771281f7348078c796d59d1e83b57abe65215b50e142a51a013d085245e68ae3b34b3f62c4629fd83b197d9af40f8ca904a3e34ef0437203afab8b88677

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

              Filesize

              482B

              MD5

              47024659163004a83fc5efdba6aaeb95

              SHA1

              4121fbed951bfa41258c84f22098d41a69d7949e

              SHA256

              85be3198090bd09fe32c8adedbdb6817eb0cc3a654e1eb03b144c7514c057083

              SHA512

              679cdce33f322855f20162c7e4c3f9ac7c3cfce1e5f2059d1d096aabd737cb124616969e28ad5f075f28b6e0a759875f802ad7a2275d6a05be6e63f3d7952762

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

              Filesize

              400B

              MD5

              eb1082f06f7b98a55046e40055e4ee31

              SHA1

              e845b2530c402287258eb2d368691bbf8bd440b0

              SHA256

              9236df922085c472cc35bf5652f13a9a81d096f84be50837df67e0072daaebd6

              SHA512

              824ac83458fdd8cd489a081d588c29d2b9c1b1e402aff3a24e732623b868a039a74c82f4eabb5a44cd7af35866c68e5e6aa1803276c73aa57adfa8ab1d542f63

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

              Filesize

              458B

              MD5

              df184803519ffaf86ec00d7609c60100

              SHA1

              f57947c9f24433bde263c93093ebbf2b7c879f7d

              SHA256

              fae0a0a7607e888eafb3d71bf9fed7f05990ce1bcf705b2a16a45ce89b360af1

              SHA512

              16257f35a1c43719055931b5c248690cf3e2f5f2f1bfa50268a7127684fd3261ad7c488a58e71548c11d9b3826f3b41f02309c2bdc5c06ca657e056f22bfc158

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

              Filesize

              432B

              MD5

              e183cb29bc820ac1b82d75a075d299b3

              SHA1

              92c0bb1aad1cec95fb5cb38e0676cbd921ea012a

              SHA256

              9edc86d2a2db2c95485d5d740232352f042ef87eccae44efccae30122e20a0f5

              SHA512

              209263834738e5dee4399ec931e6162d03e49a9921a0cde2a35072374b464157a166112151e363d75fda0dd2076c84494448ff0c1ecbac5c757db31ad1dc1bba

            • C:\Users\Admin\AppData\LocalLow\rbxcsettings.rbx

              Filesize

              96B

              MD5

              b8103cff5ff17476e28744770a7a8104

              SHA1

              8cef04bcc6fd35d9b10194c8c71b8162c392dc97

              SHA256

              f8092b0e1985fff05d3ea09059cb16a2bd01f47c13355da3d1e2dc9b7a218e8c

              SHA512

              e07b4d16f14d0d3ff7dc30d28b6f30044dcb87bb818347e8e8f763ce43f340e96f791762c8ff338817ca17222f4f8b79e2dff2afc381cacfdab9ea0ee781d234

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\PCClientBootstrapper[1].json

              Filesize

              5KB

              MD5

              b700df352d5763b27bf39a495ae842ee

              SHA1

              1e4e5dbd1a1fff0679ef278eda973df1931108ec

              SHA256

              c298f9618d15dd32ae9030e6b068a590ed3adc2091539bd84eef11d15f3bffec

              SHA512

              4469dc3b1adcf7a5dfaf752c7160cc769df1a53abcb9a6479070dc0b51c7a16f1c30a5930fb4b9897c094073285ff758da5b9c15201e7a106aaec2f3359db3e8

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\version-70a2467227df4077-rbxInstallerPkgManifest[1].txt

              Filesize

              83B

              MD5

              a878b4db0816b20bee0302c919b78c7a

              SHA1

              bc56e5cc23baabb8b5d485fbad90112784088ec9

              SHA256

              43ea54ae7dd93e1c7c506b8a8cf28745364b482c1f8e31357a05debccc593766

              SHA512

              f43bde5f6c8a0812866003025920fcdb55ee7053cdcff500be90b106df3ff23b3eeb0514a6c9cab986a31d7d089a87222b7fe5af9d402bd41e1bb29aef03c4f0

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\version-b0be9ce0740f40b4-content-avatar[1].zip

              Filesize

              493KB

              MD5

              01c56c2367b8a4f5c54cea580f6775db

              SHA1

              0f3164d0843d705b3dd49a53047ee7a47a82b99b

              SHA256

              73362c8c6d138714e684d7364967220cdc0e9e2b060781870ef1b95b3f00edcd

              SHA512

              91ef184cc5f89e3c80b11d248fa7aec2a4fd672edd5d01fba5d4068218a1b2ef9b4eb51df7624bf7472124890c4dc675b161b9a3d95689d428b954b284538dd5

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\version-b0be9ce0740f40b4-content-sounds[1].zip

              Filesize

              364KB

              MD5

              cd77e0e77d698260809f8ae8b3993740

              SHA1

              efb2b983dcced8e89fca30e9c6b77a2c57c9dec4

              SHA256

              c21c2ef75edef71ea53dd1fed5470cfa3d513d22f8cdfdf2431e43fe8ff4c95a

              SHA512

              5d56129f15789105b1428712a3fd9cf3ff436f957dc8177e301d1a96c440ea3fe944610eb99b638871a0607d01b555ecea4425ea3a780c95c32df6cf191b73fe

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\version-b0be9ce0740f40b4-content-textures3[1].zip

              Filesize

              384KB

              MD5

              78a892f9c573b744178dfa4212e54892

              SHA1

              9e7abf04985fe4582a69ef8ffa5a12611b988eee

              SHA256

              edf61a7a5306ffa98fe7acfe76c0e7ae6771a82d3f29e991ab86d2710a06ca1d

              SHA512

              5ee7a3bb2d7803190da4467a0ccf5150a37358b54a8b24350722fd4999a1d4535916fadb0b3ad471819add200363f9269bf80f62791dcbbbe5a7194f3819ab70

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\RobloxStudioLauncherBeta[1].exe

              Filesize

              4.9MB

              MD5

              a502990d5df008eb385b5862f37c3a6c

              SHA1

              e6c92247d2ec0a7e823910f096d72a661da19db8

              SHA256

              b9a56ff86f4f6d7ca4c91aba67b55e8487dcd0c31ea75fb8664a4f28aa0411b1

              SHA512

              ff99f05a31be147e15cbfc41d9d9f371749c61dac22c2e46d73a807376c2ef8254f87c83b0d385df8f6d6262a35d95a6ea9790dde10bbb4046ecd6ed1262cbc7

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\version-70a2467227df4077-rbxBootstrapperPkgManifest[1].txt

              Filesize

              82B

              MD5

              0f98ef493a7b65cb2b6cb999e44226a9

              SHA1

              972bd99c5b75a45aaf5bd2c54281ee0b9baeefd1

              SHA256

              a700240448fb42106dc569cc786c0f4d8a83e2a4e8999802a4c32e5737c9f4c9

              SHA512

              f43f4b37158b4d1ae8bd57fd9b86f21d7d8f3e36734bca100670ec5e99b1794ce45ab5da282e44e72511d384ecce45954558e5aea1614d16513f1ee88f93d7d0

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\version-b0be9ce0740f40b4-content-models[1].zip

              Filesize

              256KB

              MD5

              1e691c4ac9fc44e39eb126ad263e4bc4

              SHA1

              a61a3167c596a9cd6ae89d143ca0e6eedda93c71

              SHA256

              46e2b77ae975c79e7312435ff4a0dcd8aa89208be05fd92c20e7d84f7457f460

              SHA512

              8ef4dea83e52fa8bca420e1d9d49401a9c91f48a9c1f7ec3d2aeb9efddb9bfb956b713844ac78f6ea46c9186f3252ad5be55ee2039586a395177fcbe78d849d1

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\version-b0be9ce0740f40b4-content-sky[1].zip

              Filesize

              1.5MB

              MD5

              3cfcd0e000dd5705b25838696f7594d1

              SHA1

              ceff005e1e73a42089826ff103e61f7411a0a1bd

              SHA256

              9c4c33fa8054b0cd18a5fad870ad06affb97f0ca2e531119b1eaf3d3bde5adda

              SHA512

              463d658ad07c9c9cb14bfeb27e0717d9ba4fe8924dd5512f06006efee9ab8b74d8727068cd170304e2c153035d3400e959fb2b0ce41d55e4f9977e0067190b72

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\version-b0be9ce0740f40b4-extracontent-translations[1].zip

              Filesize

              348KB

              MD5

              2ecf1457bce7b3dd09398538dd962997

              SHA1

              6fa4691938e1a2620e8bb40a83a5b2064e638730

              SHA256

              6bbe035934e5dd2df99af988b067b1b2d9a43dcde2444aea7a7b574643d4c3ec

              SHA512

              4d47a770b88d54c979f8eae239e67d4c2426606bf3339102dd6c78e06a841ac766994bf2a88727e166477d85eebc53355d86f40265c52b50a90453ce66881744

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\PCStudioBootstrapper[1].json

              Filesize

              4KB

              MD5

              d6ecb26102287b8687f4c7a9cd4dd289

              SHA1

              14764d8e47d4fe4c4a1eb40c3fdd57dd3a86ada8

              SHA256

              3db69b2d5685fb7ed4d7c2ae5a1f170472ca639aab5d198ec712679abd7897b9

              SHA512

              d30f0fb0270cfadb7b46805b26177775a37a697ff0c653bc6d3beaa591f3a2d6a5f0db2cbb944d53ebaa6a11018071bc41d71a8525015e817908ad7117ebcd75

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\RobloxPlayerLauncher[1].exe

              Filesize

              3.6MB

              MD5

              dbe5822f824254eca487cafddd3cff57

              SHA1

              44e9738b2044e029317e6f3a9c79f140c9ddb7db

              SHA256

              4d1c9135861bfefb610f7f57d31cfd09e53895f58789d9258716d1653b968a14

              SHA512

              42056873882bce3ad52a9f412641d4e852784143184e9cf0c82588c8d4d54d973dc4fe6a92d94392c3f0ba9775278413d8e6207670a591b04c70a12ee19dafc8

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\WindowsPlayer[1].json

              Filesize

              119B

              MD5

              36f9d29123e6d3ba11fc0606e118b42e

              SHA1

              a01ab621c0a4ef112f3c8a22af45335377c6ea6b

              SHA256

              39b4d267880abe6cbbc9db4e89152a3faec2e1f0ea9f4ee208382326f5d1bdf2

              SHA512

              5c07a9b4abc9f9f5daddb3afad82d08f827375085cb17c645b6da321f1f27d406006ab76b47544978f9785ca195ad63cd3123ebf1ce5717adb64204a4aeda680

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\version-b0be9ce0740f40b4-content-configs[1].zip

              Filesize

              44KB

              MD5

              a0c6f56e7695235f259d8bf4fb362c2a

              SHA1

              8400362905ae30413b8f896edfa8e2c4cfb676bc

              SHA256

              49d16fc2d780224b5c0111704558b94370cd8d8ed8596f64782e39b39dc505df

              SHA512

              f1a351435b785dd4fe09ab8fc94b5d0165fbfd79bc12d3d510ffdb86fcadd410ea30ba74091170994937a24416fa738fa7e78bed70eabec67e286c42e17c7aa6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\version-b0be9ce0740f40b4-content-terrain[1].zip

              Filesize

              1.1MB

              MD5

              eb4a0f2c23203b2f64fb8269768cb14c

              SHA1

              237dd0fd182b7ef43107e3168ff5494fcacdd8eb

              SHA256

              f03a2a3badd799da2a16d3b5efb4a21eab77b4964c80d5294bb6647bbca68f31

              SHA512

              1e61040a0db70aaba3035b9d25d4ebb5a3811b095bec56b3f9d38c634f6967b3fe7e6dc78fee54b8e8934536dc9c233677ca8678dbeb44b1f4625548d906f5d3

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\version-b0be9ce0740f40b4-content-textures2[1].zip

              Filesize

              5.9MB

              MD5

              a6bfc98ef4845745b7fe76d82bd295e4

              SHA1

              3487db3614ff2c262111764d7b679060ccbf2d10

              SHA256

              668400bf0ce2f542cb315027e6c43056aaf458cd231b0a2f02259c4787530665

              SHA512

              19d6ef8dc1bbbe505fbdb87698e388b47843422dab69a4a1c4921105af118b3d3f6eff91f484475646fae456e0f669919f39f19c49dc33a27eb0857e31586543

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\version-b0be9ce0740f40b4-extracontent-textures[1].zip

              Filesize

              1.4MB

              MD5

              6557fd3939ca66ac582d9d0555c2d68e

              SHA1

              fe091a839656f4e0e8aa30a192a44140c64ca821

              SHA256

              020607ef614098f6de56f3a636a95903e5b3f306f1d47413a64585204299212e

              SHA512

              a9bea1f668dd6cc0b6121035b0356e54cbdd61f8f44cde6076a9172851ec029c567793d9feb366d3c2207b539eb8ceea6fe66f91c4e9d3f44e51ad7c4998ee2a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\version-b0be9ce0740f40b4-ssl[1].zip

              Filesize

              128KB

              MD5

              cb04a98a01fed3e8ccd2fcc06c3bb957

              SHA1

              76aadec424bea7b0194fec82b6e3ec75dbc7fbb6

              SHA256

              b355070938a4eccd4f9d3f3eb59e06191a1e9bb64415a4c96ae123c727a9cc22

              SHA512

              72b3e84d74e24506f28b29cab9d4e133cb26cb4a3abc8219e6268d3ef5cdc9da48c50e7fc8511e3aaa3ba6e39c8ae835444414e68319af888227cfb4a9d198c0

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\BatchIncrement[1].json

              Filesize

              163B

              MD5

              bedbf7d7d69748886e9b48f45c75fbbe

              SHA1

              aa0789d89bfbd44ca1bffe83851af95b6afb012c

              SHA256

              b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

              SHA512

              7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\WindowsStudio64[1].json

              Filesize

              119B

              MD5

              79b314db88545a41fbd7f8bb1e6b8b0c

              SHA1

              a31747608f9b8e39b6204ca582e042e0e180f340

              SHA256

              2f0521e8858e550c14a524f53fd78c7565eaa7519effda5ffcc61bf798d54621

              SHA512

              862d75545da1d15c6206e5922094c62730473c36f85f0c8eaae39e47a9a73b28655b2ddbccbd9e3b9dac044eb9faaa64ef5484ce7f7e15187f393d3c9dadc0cc

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\version-70a2467227df4077-rbxPkgManifest[1].txt

              Filesize

              1KB

              MD5

              56391f65239bdb2eac877d841a63a964

              SHA1

              74956b20cd045ee4eb7bc07623eb43113d5afffa

              SHA256

              184f6d4cf6105a41c4b651c2f72d7134fe01c0e5824b489b869041f96325fabf

              SHA512

              351eec5e076340835cbe623610fe44a763071d381fb6aea07b02e7dc594c1a3f28c55afe08ffb156e03b001475049c024e390d22487d9d398094f33fa334d0be

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\version-b0be9ce0740f40b4-content-fonts[1].zip

              Filesize

              2.1MB

              MD5

              e81e3b62eca3154a440d1bade5d93f2f

              SHA1

              07d8c7a4e535bd34c19ed8397b00d3615ec8f895

              SHA256

              cab7d92e52513ea9da67c825f62935c0c4dedc7eed2f37d768c40a7cf62fe950

              SHA512

              15aec265ccec10ab1ba2d530c54cbe8682063d3f6c949a37414f1454892576c97539bb5ade426f6f5ff5307f3e952594635039162f5eeb0061ceb17f31693d44

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\version-b0be9ce0740f40b4-content-platform-fonts[1].zip

              Filesize

              2.0MB

              MD5

              812ab9bba958b4e77c608ec3848f351c

              SHA1

              e44e42dd47a2821bee31c8fd4749655a4ffcfd43

              SHA256

              78604ea0269a34c6581225eb29a60ddff0ab14906247593c2b7cc1ab1b5939ae

              SHA512

              acea29eb069b55f2f9725524c70f542289dca3d2f8dfb6ee9867f42d4294bdf1ad2a8851d06f400b56c12a6ccfe26464764be908d6a17480c7dd78cd89ff4958

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133536320643452457.txt

              Filesize

              77KB

              MD5

              ee2b58ca83c6ddeb6deefa385c0ca96c

              SHA1

              e6aebc901f7d95ffebdbc7ca3b9ae650bc4eb3b2

              SHA256

              1c71ab33a85542ebf6c3d91c3d583b6cc5178d52223e5ec37bc88f52e5d1c02c

              SHA512

              afac1d517b5f37cb9258a29ce3c0233ac6876a8a3652d75e254893645afc90c1b116eb4806f7c4a04357fe9d1fab4116e9ca7e273d5688026f3846f9c390e717

            • C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe

              Filesize

              4.0MB

              MD5

              b3e493e0896ed4b702123387d6731e2a

              SHA1

              ca11a8989719f487e1c1a8576a9d33b4fd6a878d

              SHA256

              52267f03479846ed0d56fbf89841f1318d275dfecfa4594d0d1397ed223b87a0

              SHA512

              d3e22a519a216102d6a39b5675be15e44238e14a69f920c3dcdee64ffbfffe1f62be0c2b4ac2ce436256d7fca8e060e953f539055764705cba2bc955f17f8708

            • C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe

              Filesize

              3.3MB

              MD5

              275b4a2f3b242ef35c755bff2933e890

              SHA1

              ffd70c05d3e166c71526398db17aa467a1b2a0ee

              SHA256

              f82c8b7c1d3d479cdea39b20ed63ad74175e7bbd8e8dc8e728e8bcf58885b502

              SHA512

              18c3a4cf9c8baa0cee1d4dc5a810190ef7d56788b948450dbb2b7d15ab31cd0cdc60c6fe26ce2145d8bc78986bf5d7ffdc5bc4b25140bbf02dc10c94a0c941a8

            • C:\Users\Admin\AppData\Local\Temp\RBX-6E7B0831\RobloxPlayerLauncher.exe

              Filesize

              1024KB

              MD5

              cdf88d3a38a085e45c64bb20fd1c2ab1

              SHA1

              85f81965b57dce020f833ecd102f722e1bfd387f

              SHA256

              398a3578a0332a4f757ded13c0238c53c4a560c0335ce1c974a8232f6feaccce

              SHA512

              4e25b46791819e0f9981694be0f7962c470eb10f2b13f2b798a3d309335385b37692a9f7caa75e19f37f013eb7f70d991e15d11aca3b74d13a465372bce6c828

            • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

              Filesize

              40B

              MD5

              9f7f45c218102a399b48288f9afa2e03

              SHA1

              9e53c4e56734123722da2c211b694cde49a994fe

              SHA256

              85ca2636b89aea161cdab77a71ff2f750a2715bba27ee84fb48107c888b802b5

              SHA512

              d77c86f73d4d084102ea5c5597c6a25f5c9751a3e396d2c3f2797460e41ff6a494353793a1acf5f00177dada9954eb225558192073972d4e0522e5d54789a771

            • C:\Users\Admin\Desktop\Roblox Player.lnk

              Filesize

              1KB

              MD5

              ce1d8d97b473250d04f6f70facd7f6ca

              SHA1

              e8a1f9687ff1dcae621a24eec0665d1a186d1c0c

              SHA256

              a5aa3ba19cf278cd81cc00e6189d3c9e24c3b54cfc7cbde75ab43e2afd87bcfb

              SHA512

              4996f5a417420dcecdcca9beaf5282496a77c6f2ee104079d6f612b1d7c65355cd02a3a2a2744a58b5a6fb7de077acd6af856510d84a548174f4056f88eab3c8

            • C:\Users\Admin\Desktop\Roblox Studio.lnk

              Filesize

              1KB

              MD5

              7ac0f40a611f082c608b17a2d493d648

              SHA1

              674c59840649d97aaae706ce961085a9b803ff16

              SHA256

              fc8e028383880b10266b8030c21cdb10a366e949dec59febc9705cfce05dd561

              SHA512

              a283f38d75d7c92e76e6eab7477e2a1b5edbc4deb1d3369e3b0e6098c2fdfeed3a5cbb3739522a7a4c8911b0c9888bbee3fea6f91d73ec7dff8f6d0b21a5b577

            • memory/1656-582-0x00000267E6CC0000-0x00000267E6CE0000-memory.dmp

              Filesize

              128KB

            • memory/1656-586-0x00000267E72A0000-0x00000267E72C0000-memory.dmp

              Filesize

              128KB

            • memory/1656-584-0x00000267E6C80000-0x00000267E6CA0000-memory.dmp

              Filesize

              128KB

            • memory/2016-540-0x00007FF9E97E0000-0x00007FF9E9BE2000-memory.dmp

              Filesize

              4.0MB

            • memory/2016-539-0x00007FF7A0970000-0x00007FF7A1970000-memory.dmp

              Filesize

              16.0MB

            • memory/2016-544-0x000001EE63510000-0x000001EE63520000-memory.dmp

              Filesize

              64KB

            • memory/2016-537-0x00007FF9E7F80000-0x00007FF9E84CC000-memory.dmp

              Filesize

              5.3MB

            • memory/2016-538-0x00007FF9E97E0000-0x00007FF9E9BE2000-memory.dmp

              Filesize

              4.0MB