Overview

overview

8

Static

static

1

659207bf81...18.exe

windows7-x64

8

659207bf81...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    659207bf817436dcdd520b561895c017_JaffaCakes118.exe

  • Size

    956KB

  • MD5

    659207bf817436dcdd520b561895c017

  • SHA1

    b8325100e8a0eb0c8d805c6564bcbc3994566aef

  • SHA256

    7801bba52470698f00cefa50e4a1697ce6e8c5f248ba75946349bb031779d74a

  • SHA512

    085aca4f77f40d9060e23f71c6851f90388215dc85cbe46ce68f1da9672763874efa7746c42a848d345f5c8cb61e2c597c2907413d3646603e724a75d77b0455

  • SSDEEP

    12288:JKT1g/Pbyrr7hTaawgTdtyRV0LesJoUKaXLpD2TvWTmwXnF5Kl8:JKTGXw7NxpOtUtXNyaT3XbKl8

Score
8/10
evasionspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\659207bf817436dcdd520b561895c017_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\659207bf817436dcdd520b561895c017_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Users\Admin\AppData\Local\Temp\RBX-4606747C.tmp
      "C:\Users\Admin\AppData\Local\Temp\RBX-4606747C.tmp"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\RBX-4606747C.tmp
        C:\Users\Admin\AppData\Local\Temp\RBX-4606747C.tmp --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=fde48f439a9af7a7f1b323bea0e4a5d1febc3390 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5b8,0x5bc,0x5c0,0x594,0x5c8,0xa5a1f0,0xa5a200,0xa5a210
        3⤵
        • Executes dropped EXE
        PID:2084
      • C:\Users\Admin\AppData\Local\Temp\RBX-6034D15C\RobloxStudioLauncherBeta.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-6034D15C\RobloxStudioLauncherBeta.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Users\Admin\AppData\Local\Temp\RBX-6034D15C\RobloxStudioLauncherBeta.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-6034D15C\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=d2f995026f4963b40bd37e1eada84a7698834d8f --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5b0,0x5b4,0x5b8,0x474,0x5c0,0x1814c84,0x1814c94,0x1814ca4
          4⤵
          • Executes dropped EXE
          PID:2376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
    Filesize

    2KB

    MD5

    1cdbd089dfcb9336cceb0e56e816580a

    SHA1

    4ed213ef423e682c031419b16d24dc4bafb95b2c

    SHA256

    939fce76714a5874729618de5fc0a9e2b2c6c7da35f7d0128a6be705c603939a

    SHA512

    71bba557a607e9916d60d3bd27c9a10f7613ca8242ba2d11e224228719a02915f83f2c4484d5e408a8e4110590a1cc335fb17c7915e4c48522a4ec9fa99e100c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
    Filesize

    1KB

    MD5

    d5c2865a15b36c4ec07454e0a5c49f3f

    SHA1

    067cf71276571a338ed60c74037b2aaf15e8d647

    SHA256

    6069dcbfa2a34c0a887a035a9bfff1771c7583a031375b0c6f3f4269322c2821

    SHA512

    9e6851e2f536fec7de68a6d23e475ba4b9e221d6b0da70c5607c2832cdb6e65b4fb8646bcb75a5bbdb4ab3aef6a527bed1bb8913079f1686c1f47ad1e43f9957

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    d8e0e108bd3225ee4823e2501a9c59b8

    SHA1

    90ee76ccb7a8c1cee70959c25f1cfffcb399aaeb

    SHA256

    482fed17ea597c86abe64224786bd51836c64071c1047ca970c09ae96185c1cf

    SHA512

    d7bd3501cf8a9a5d1f8cc34c5bd88af6228f40c97bb48f58cdfdded4775769d215c8029fb9fad8cfb27628e2550092c1bd82574f1218540c4288da141d581d48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
    Filesize

    471B

    MD5

    8f25fd27c91bf81a14823685b5a7b317

    SHA1

    c7f7cf2229c0807f600c935f471ab46a098218a5

    SHA256

    5c4a768009a95db49d5b6b1e4747f37be0bc8168e7bf683272594f9537e3484c

    SHA512

    c6c0c0b81e761d651eb535632fe2ebe439dc3ae36bf0d98c7bb2ac47b76292116d2b505c2d2021d79f81118c7c4caff2463101485be2a662966626e2412bc500

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
    Filesize

    2KB

    MD5

    3a483c7557b69126a5920ae944d0e64d

    SHA1

    55e8c86eb877b47b9142f01fb00124e042630957

    SHA256

    9ec32bf3e0954d9e2142a0c2c91803def5aa4e4a1d342e53fb64be38f88c6ac5

    SHA512

    62baabe294f53e7ca8749d05e152d0aeed181e712ee8a7ec8d5db7f185cfd381b7f5bd84542d9b485f844f5f744db9830b1d0241259ad9a924faca8a27be8214

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
    Filesize

    1KB

    MD5

    8ff862b339faa8aa5009eb260331625d

    SHA1

    ec2062a1b2f41a6a1c64c05cf789c5cb6e7c9df5

    SHA256

    01555e41a55a3af58dbf44d1e3d0f158c12306f26ecf35defce0b7fa718ae18e

    SHA512

    058ed31678c6136160699f842f188ee8f94e3ae730a748b75082eb72ae8bf05c0b0e62e7dc102d5529313627a454a591a43ea4bc547758a7d6b3d802d10b1f60

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
    Filesize

    488B

    MD5

    68dc865e65032e4c955719e9155b3864

    SHA1

    6c0930578e1fe965e7246e62cc2a0619c6ac93f2

    SHA256

    924fca1b04eb78890a020e00623b7f75a6bf31cdd390b7cf845ed64a8ec617b5

    SHA512

    65757d8ad79ff09d38a96c7d083d70cd08229d65f47c07be6365b03e60a191cb44e68de5e9a450be92d874c83bd9c789bdb9679ec0259af6355aa4d01e87bafe

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
    Filesize

    434B

    MD5

    5ed0ebe4a01c90db1b6d57e58d266096

    SHA1

    ac6769a57407d2e5930f6cfe7aa8f3db9a42fe48

    SHA256

    f8c67a565d66e1957486ba18d5a0119f2ffba192fcf96e9a7514e9bd2d0f1634

    SHA512

    4cdb86247085fa731ecbeb7c761f758d659a992e3baf115598e16fb10ffc75f4c589855cefd1f1db07f31a1c8a96195bc6a7fae36081047764b9bf9e3d135023

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    5bfaa517ef38b9c4069a291acfd9a45b

    SHA1

    1ac3004bf4d2e246ade1815b2485a8906ed79b55

    SHA256

    ea60bda2932248c080e07b628bdfe2467c4e30143fbe5206c58350c82b639c87

    SHA512

    7ca61ed1f7c5aa0d7792393dae72bfaeff05c71933ae6634653a255b9c37fc53ae6c0ff1096341088d7b8492c33023edab239899ba173c4aa0799b37ad805e8a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    24baf556e73851affc1e2ca278806a44

    SHA1

    b996938d218d3f6f5606ec8913442d66a2bd56cc

    SHA256

    4c25052460464513e6d9675a6a75b98e931c462ee21e65ebfcd0c49c90670f8a

    SHA512

    3cda60c0350cf2bfa5eb88d656ec3928482e668d108d41d84a75536590f88f5bb3aa2c010e01333ec5e52138bcde425680d38740bda84e805988f1ade32e5c45

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    02a30a106f72290ac224834fb169c0e9

    SHA1

    b4ccf0e4127dfd51fee0f5389b88762fadb22af3

    SHA256

    ccc6092d0a20f18257fae07d39bcf6c1ab5935df0924a4f6a3592424ea5ce55d

    SHA512

    0f0685b1c51872fe7f411857ed2215a993dd24d17be92bf622d8209cf811ac191e5e6b3b8a89e8f4ae4cd5e4dc67315b7b9e20b5814e3506567ad854a4029799

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1e2467de5de8298f08581432258e2b97

    SHA1

    d105a804a48f9503118b5b6bd94a54ab6b0d0863

    SHA256

    f385cf6b8d2c9d614dd2eff4190c056fd860ae8b5c73da804223122a38bbe71d

    SHA512

    f857d1f58624ed4fb98c0cf9b915254c0ef3112944fb40a9783083c0933bef96dbedf506f6741d8779e9e428ae57ee2b8c6f1102e0e4652be22735df9a896353

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    43cac4c05a125db3afc415e84d1eb4a7

    SHA1

    700ebf7fa65e6ec4192313db64318bef97280e94

    SHA256

    5347c76950d48332b9cba9fd7011dc18e36d69735e36d94bd9d1199d7612bc86

    SHA512

    dc2025651473ceb5b5b302b7740c467966e2a98b6f9ddc5c6f7b3c859fd9618b6cf22761dfa4fd38957c575298bf46d1d3a3606ff38e1a49a87c5ee19a09b932

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
    Filesize

    400B

    MD5

    68b1cc18414c40415798102de61a9937

    SHA1

    9a62b7006e672a294b06ff1eca05421d63e1b101

    SHA256

    210986f53ff0b8f289945b231568b4670a06854bd8b94f206199db05ceb0080f

    SHA512

    fbefe0dce1a8360d97622cee3bd74e777008f6689ffbecb873f612a0fa7feac2f27dd78a8d81497ad1405b9d0f8c0820a17190f92ae3749fdc0a3a82c50d3fe6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
    Filesize

    458B

    MD5

    057d7b2bc6c5a28c8f2a1039176dc550

    SHA1

    b5a6691c5b96eae8e3b3e7a97ebcb81b9681abb5

    SHA256

    c6e89150e016dd69ed39b856e896225b1b760e0245fb6f6585a1ebceb7bee155

    SHA512

    ef35a77b0468c482d371d7aa24be0a3830888d3a6045b55007ea3501739fd7e5031c87f217515c43572a38afff53c69cf11d8e30b87720f8b1e4e342166f6bbc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
    Filesize

    432B

    MD5

    68a1b84e99e75df7f7598ed4cf8ab7d6

    SHA1

    c2c40ca78ded2ac9965eca13d994118bd6d0c5e3

    SHA256

    9b282874d6d9f6d1e27cd6a23e21e0da498b84e00e15b982cf47d0efd2e22c17

    SHA512

    769aef1661f321db26bd745e7fd657592d8312dbfa68ceb90206b678e217c2e89b28abbdad399ead98d73d795e93104170911038c81e85c120a5d88a78e4c398

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    cc4cc1b97fe911c61d669832ee43e616

    SHA1

    91c9030d317b29043fc04d6de2a644df1e7a318d

    SHA256

    dde699c1b194ad75b94ae72c3dbeb9a10a0d9882b7cee6594c04121b9a7fda17

    SHA512

    041cabeec5a514b9d88e9f46e3e716ec4760bff0aa9d8ecd9e229fd8c284ba95cc360acb2fa90b8fd395dbaa80d1c2555d8b5d0676eae7e657a676343e1dea70

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\BatchIncrement[1].json
    Filesize

    163B

    MD5

    bedbf7d7d69748886e9b48f45c75fbbe

    SHA1

    aa0789d89bfbd44ca1bffe83851af95b6afb012c

    SHA256

    b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

    SHA512

    7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\version-c5a2369e0d774f91-rbxBootstrapperPkgManifest[1].txt
    Filesize

    86B

    MD5

    14c12bfaccc790563910539df8bc1814

    SHA1

    7d8a4e91f58c07bbe8e2f106ac7070c4f68e0608

    SHA256

    9ec710fa18b6762bb466a2f4392958bf551b40a413ef1fa40acd51e1a35727b0

    SHA512

    34015840baf053a1c532a3ab4074336d357136fe18a313c0838038a7c137e30090bb0d3bea1a3cba28745ae7f77b90b53d584c7a6a258e740d9fc3c932706bbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ADCJI8Z\version-c5a2369e0d774f91-rbxPkgManifest[1].txt
    Filesize

    2KB

    MD5

    94ed4e234faea753c14ecdeda479263c

    SHA1

    134a22bfdfc129c1a14f870f2f68f0f4e85add99

    SHA256

    09b5270c11886f549c26085803705642cb5d45083e8877e2578cc3d731edea12

    SHA512

    89eea0569ec64853cf5a43cfbb351fe7887cb772eb41889d84e3b7231c1c2df5a335c73d94cdc903f675c71c2b364f821f8f6659fe154d95c176017300db7a5d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\PCStudioBootstrapper[1].json
    Filesize

    6KB

    MD5

    2d09044ec45d59b37273f637cf902da6

    SHA1

    9f9c93f5eaa9143dcb5a11053cf6695847c8c52f

    SHA256

    a03e1f0e02e53d9ebc0060c815421704921eba6f73d2892e02f953d41db34f28

    SHA512

    c98aebec3545bd5fef5bbdbe49f20a3f1126a4c29522396d451a7ba48198a9964791fd824ed0a1e0284513401f20d7bf742343e0dc7b8cb4bea8f60abf189ae7

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\version-c5a2369e0d774f91-rbxInstallerPkgManifest[1].txt
    Filesize

    83B

    MD5

    09c7f9ee270382551bb3c39bb16649c2

    SHA1

    c3db94c9f0dd8cc40b2eda8ed0a9525d7060cf13

    SHA256

    cb33a0411d5ace09869d807b66d7c2050d3e67e748961eb1c37eaf14c65692a4

    SHA512

    1652b4e0ecaef9fa7116d70cd8c1ea36945ee43cf9fade1e34dde66e73dac2b47a39126812f492e8fd149f41b7e7cd8d016db6112b45b0b0c91205ca8c0c3106

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\WindowsStudio64[1].json
    Filesize

    119B

    MD5

    d29dcf047d505fe5c84f07da21798440

    SHA1

    f6621ea0b2b01c14f46d6be181e5836c54b59236

    SHA256

    369981d550f87b939c5021b7081502b18f0bb314511676f693ffb57563fbbd87

    SHA512

    8edd53dbb5e3852b2494043722cb2d26dfa058566a1327ac57b6572811b4f35cb7663062e5f6f26f2e030ab35cac9fb9c803a10d8525fd3228ae1b3a53368559

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar351B.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
    Filesize

    40B

    MD5

    6ff0a2b99fba0ca77ff546470fe3236e

    SHA1

    e7ee1bf45e426da78b19d14aafd88fffcaaf077e

    SHA256

    a58a3a08222f6b42559f903ff00ebd9c09989b321dffa03d0da9d68ddc178fc5

    SHA512

    41791bf30cde533441a2c2da470c0be12276c03202ff7b7db9cb1fbdef6b79ffd25ded39d590bdb74d1e1515433df93e6d24c9b2d16511c7a7ca692e5a678fa8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\RBX-4606747C.tmp
    Filesize

    4.6MB

    MD5

    fa23f3a48c2e4ab7502588d590ee04e8

    SHA1

    486b0015d4f75af3f09f9c676b5f62a97a22bd62

    SHA256

    b21083b9c2ca0572bba7368ad178935d0e7e6ea017deb90e94936bf58152f4ef

    SHA512

    68d1e99931823f45aa7491a509cb4d08abe49664b349d612aee12089e9f5660c4fc15ec398065910a8443264a9855056caa8c70d8efe8d63d8aadf457a46cf9f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\RBX-6034D15C\RobloxStudioLauncherBeta.exe
    Filesize

    5.7MB

    MD5

    ed425a6350f3aa88c827a1b18900e896

    SHA1

    56c83310e81eac4cae5b55c378139e19a999dff3

    SHA256

    8aa742851be5f895d82316375efec41a7155328b35b7af6bb6bf307000f88938

    SHA512

    6b74dca519c71fbcb5b59806765f04498524d2964c8ef961813b6ff4ea828c198ab89d8ce6585097b9a6fff0b099399b2a579554b3ac0781d51f17cb0c51ab3d

    Download Submit