hxxps://cdn[.]discordapp[.]com/attachments/1274159013239586970/1275287157501726815/Roblox[.]rbxl?ex=66c55738&is=66c405b8&hm=88f6e9a4ada179c8a21179f0001c715ea7e0b33ae310f856229c52d3e4d03a7e&

Analysis

max time kernel
496s
max time network
496s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/08/2024, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1274159013239586970/1275287157501726815/Roblox.rbxl?ex=66c55738&is=66c405b8&hm=88f6e9a4ada179c8a21179f0001c715ea7e0b33ae310f856229c52d3e4d03a7e&

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 32 IoCs

pid	Process
2440	RobloxStudioInstaller.exe
3772	MicrosoftEdgeWebview2Setup.exe
3500	MicrosoftEdgeUpdate.exe
312	MicrosoftEdgeUpdate.exe
3796	MicrosoftEdgeUpdate.exe
2600	MicrosoftEdgeUpdateComRegisterShell64.exe
696	MicrosoftEdgeUpdateComRegisterShell64.exe
4176	MicrosoftEdgeUpdateComRegisterShell64.exe
3364	MicrosoftEdgeUpdate.exe
3484	MicrosoftEdgeUpdate.exe
1044	MicrosoftEdgeUpdate.exe
5072	MicrosoftEdgeUpdate.exe
3060	MicrosoftEdge_X64_127.0.2651.105.exe
2212	setup.exe
4700	setup.exe
3084	MicrosoftEdgeUpdate.exe
1604	RobloxStudioBeta.exe
3460	RobloxCrashHandler.exe
2756	msedgewebview2.exe
3368	msedgewebview2.exe
3868	msedgewebview2.exe
3084	msedgewebview2.exe
2872	msedgewebview2.exe
5172	msedgewebview2.exe
6052	msedgewebview2.exe
5140	msedgewebview2.exe
2700	msedgewebview2.exe
696	msedgewebview2.exe
3220	msedgewebview2.exe
1876	msedgewebview2.exe
5236	RobloxStudioBeta.exe
4532	RobloxCrashHandler.exe

Loads dropped DLL 64 IoCs

pid	Process
3500	MicrosoftEdgeUpdate.exe
312	MicrosoftEdgeUpdate.exe
3796	MicrosoftEdgeUpdate.exe
2600	MicrosoftEdgeUpdateComRegisterShell64.exe
3796	MicrosoftEdgeUpdate.exe
696	MicrosoftEdgeUpdateComRegisterShell64.exe
3796	MicrosoftEdgeUpdate.exe
4176	MicrosoftEdgeUpdateComRegisterShell64.exe
3796	MicrosoftEdgeUpdate.exe
3364	MicrosoftEdgeUpdate.exe
3484	MicrosoftEdgeUpdate.exe
1044	MicrosoftEdgeUpdate.exe
1044	MicrosoftEdgeUpdate.exe
3484	MicrosoftEdgeUpdate.exe
5072	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
3460	RobloxCrashHandler.exe
3460	RobloxCrashHandler.exe
3460	RobloxCrashHandler.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
2756	msedgewebview2.exe
3368	msedgewebview2.exe
2756	msedgewebview2.exe
2756	msedgewebview2.exe
3868	msedgewebview2.exe
3084	msedgewebview2.exe
3868	msedgewebview2.exe
3084	msedgewebview2.exe
2872	msedgewebview2.exe
5172	msedgewebview2.exe
2872	msedgewebview2.exe
3868	msedgewebview2.exe
3868	msedgewebview2.exe
3868	msedgewebview2.exe
3868	msedgewebview2.exe
5172	msedgewebview2.exe
5172	msedgewebview2.exe
6052	msedgewebview2.exe
6052	msedgewebview2.exe
6052	msedgewebview2.exe
5140	msedgewebview2.exe
5140	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
120	camo.githubusercontent.com
122	raw.githubusercontent.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2536	GameBarPresenceWriter.exe
4148	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\Path.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\CameraOptIn\CameraOptIn\default.rbxp	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\Log\LogData.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Navigation\Dark\Standard\ArrowLeft.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\ApolloClientTesting\React.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\JestRunner\Throat.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Locales\kn.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\ui\Controls\DefaultController\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Lua\Tutorials\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\Qml\QtQuick\Controls.2\Material\MenuBarItem.qml	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Reducers\PurchaseErrorReducer.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\BulkPurchaseApp.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfilePlatform\SocialToast.lua	RobloxStudioInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\Trust Protection Lists\Mu\Entities	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Lua\Explorer\Light\Standard\expanded.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Lua\StartPage\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Alerts\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Components\Connection\NumberLocalizer.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Components\ScrollView\ScrollViewContext.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\AnimationEditor\menu_shadow_top.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\StudioToolbox\AssetPreview\pause_button.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\ui\VR\Radial\Icons\Recenter.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoduxSquads\RoduxNetworking.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ToastNotification\t.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\Flags\GetFFlagAlwaysShowVRToggle.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\Flags\GetFFlagEnableInExpMicPermissionsAnalytics.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\Utility\addRawValueMethodToEnum.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\NetworkingUsers-56568bb5-5eb39145\NetworkingUsers\createRequestThunks.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\GenerativeAI\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Debugger\Dark\Standard\ConditionalBreakpoint.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-24x24.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\SafeFlags\SafeFlags\createGetFString.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\InputUi\RoactUtils.lua	RobloxStudioInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\concrt140.dll	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\LinearVelocity.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\NetworkingUsers-31ab8d40-1.2.1\NetworkingUsers\networkRequests\createGetSkinnyUsersFromUserIds.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\Shared\Shared\objectIs.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\CarouselUserTile\Constants.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppHeaderBar\Dev\ReactRoblox.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\Dev\Rhodium.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\avatar\unification\testScripts\CodeBlockTestScriptOneLine.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\isNewInGameMenuEnabled.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-31ab8d40-0.3.4\LuauPolyfill\Symbol\Symbol.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-4f0cd42b-a744f1a5\RbxDesignFoundations\tokens\Console\Dark\Global.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AuthCompliance\Analytics.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SplashScreenManager\SharedFlags.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\Qml\QtQuick\Controls\Styles\Base\images\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\textures\GameSettings\copy.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\content\studio_svg_textures\Lua\TagEditor\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserBlockingRodux\RoduxNetworking.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserProfiles\SocialLuaAnalytics.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Network\Requests\DEPRECATED_ChatStartOneToOneConversation.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\scripts\PlayerScripts\StarterPlayerScripts\PlayerModule.module\CameraModule\ClassicCamera.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\luaUtils\keyMapOrdered.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak\lumberyak\example\page\page.lua	RobloxStudioInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5072	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
3364	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	GamePanel.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685977232991587"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-1b1a91b0565547cc"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1724	die.exe
1604	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
1752	chrome.exe
1752	chrome.exe
2440	RobloxStudioInstaller.exe
2440	RobloxStudioInstaller.exe
3500	MicrosoftEdgeUpdate.exe
3500	MicrosoftEdgeUpdate.exe
3500	MicrosoftEdgeUpdate.exe
3500	MicrosoftEdgeUpdate.exe
3500	MicrosoftEdgeUpdate.exe
3500	MicrosoftEdgeUpdate.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe
1604	RobloxStudioBeta.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1724	die.exe
1604	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
2756	msedgewebview2.exe
2756	msedgewebview2.exe
2756	msedgewebview2.exe
2756	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
1724	die.exe
1724	die.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1724	die.exe
1604	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe
5236	RobloxStudioBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 428	3328	chrome.exe	73
PID 3328 wrote to memory of 428	3328	chrome.exe	73
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 864	3328	chrome.exe	75
PID 3328 wrote to memory of 3496	3328	chrome.exe	76
PID 3328 wrote to memory of 3496	3328	chrome.exe	76
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77
PID 3328 wrote to memory of 644	3328	chrome.exe	77

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1274159013239586970/1275287157501726815/Roblox.rbxl?ex=66c55738&is=66c405b8&hm=88f6e9a4ada179c8a21179f0001c715ea7e0b33ae310f856229c52d3e4d03a7e&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc82a39758,0x7ffc82a39768,0x7ffc82a39778
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:2
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5000 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5560 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3148 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5568 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1500 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5700 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3000 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2912 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5640 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5764 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3128 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2432 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2956 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=776 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=1936 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=692 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4612 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3156 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3864 --field-trial-handle=1828,i,7406111223760516071,5925185071428606159,131072 /prefetch:8
  2⤵
  PID:1876
- C:\Users\Admin\Downloads\RobloxStudioInstaller.exe
  "C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- - C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3772
  - - C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3500
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:312
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3796
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2600
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:696
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDYxQ0UxRTAtNDc2NS00MTUyLTg4OTMtQUMzM0JDRjFGODMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MjNEOEI2RC02OUMxLTRDQTktOEIyOS1DMDY2N0VGRTc1RDJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDYwMjMzODI2IiBpbnN0YWxsX3RpbWVfbXM9IjY1MCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3364
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{D61CE1E0-4765-4152-8893-AC33BCF1F830}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3484
- - C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxStudioBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxCrashHandler.exe
      "C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.638.1.6380615_20240820T032752Z_Studio_C8DD7_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.638.1.6380615_20240820T032752Z_Studio_C8DD7_last.log --attachment=attachment_log_0.638.1.6380615_20240820T032752Z_Studio_C8DD7_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.638.1.6380615_20240820T032752Z_Studio_C8DD7_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.638.1.6380615 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=f64a8cb0a32ca3bf18861a7cc513c6806f856ccb --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.638.1.6380615 --annotation=UniqueId=7808294478957328570 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.638.1.6380615 --annotation=host_arch=x86_64 --initial-client-data=0x518,0x51c,0x520,0x464,0x52c,0x7ff77d9e4c30,0x7ff77d9e4c48,0x7ff77d9e4c60
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1604.348.3872768263303099440
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      System policy modification
      PID:2756
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.105 --initial-client-data=0x120,0x124,0x128,0xfc,0xd0,0x7ffc6b9ad198,0x7ffc6b9ad1a4,0x7ffc6b9ad1b0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1228,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3084
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1988,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2872
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3228,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=2116,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3320,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4656,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4868,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:696
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4864,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3220
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.105\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 638, 1, 6380615" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5208,i,9075282562396620499,7016425977923274567,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1876

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

C:\Users\Admin\Downloads\die_win64_portable_3.10_x64\die.exe
"C:\Users\Admin\Downloads\die_win64_portable_3.10_x64\die.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1044
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDYxQ0UxRTAtNDc2NS00MTUyLTg4OTMtQUMzM0JDRjFGODMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFQTUzNDczNy0wODg3LTQ4QkQtODE4Ny1BNjI3N0ExRDA1MzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ2MzQ3Mzc4MyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\MicrosoftEdge_X64_127.0.2651.105.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3060
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\EDGEMITMP_B78C4.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\EDGEMITMP_B78C4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\MicrosoftEdge_X64_127.0.2651.105.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2212
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\EDGEMITMP_B78C4.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\EDGEMITMP_B78C4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.120 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC9597B6-B1D3-4663-BE87-C499476B3FA5}\EDGEMITMP_B78C4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.105 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff65f09b7d0,0x7ff65f09b7dc,0x7ff65f09b7e8
      4⤵
      Executes dropped EXE
      PID:4700
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDYxQ0UxRTAtNDc2NS00MTUyLTg4OTMtQUMzM0JDRjFGODMwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszMzQ0NzU2RS0wQjE1LTQ4MTQtQkNBQS1FMUZFNjMyMkEyNDF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNy4wLjI2NTEuMTA1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTAxNTEzODgwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzUwMTU5Mzg5NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2OTQwMTc5NDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzhiMGIzMjMzLWRhYWYtNDhiOS1hYTA0LWIzNGJhOWU0Mjk4MD9QMT0xNzI0NzI5MjEwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVN1Y1ZzVTc0YUlPQjRiSzNlUXpGYm14OEdrdnJPaDJQaHQ3b3gyTjFRSm9UOElnZW9EdnVZMUslMmZVZWFUeXdZQ0QxZGtiSGp6aU45NUtNZmIlMmYlMmJYSGpRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjEyNjY0IiB0b3RhbD0iMTcyNjEyNjY0IiBkb3dubG9hZF90aW1lX21zPSIxNTE4MyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2OTQxMTgxMzYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzA3OTU3OTIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTEyMjMxMDU0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzkzIiBkb3dubG9hZF90aW1lX21zPSIxOTI0OSIgZG93bmxvYWRlZD0iMTcyNjEyNjY0IiB0b3RhbD0iMTcyNjEyNjY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0MDQyNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:3084

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2536

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000090340 /startuptips
1⤵
- Checks SCSI registry key(s)
PID:972

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
PID:2264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x208
1⤵
PID:5784

C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxStudioBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxStudioBeta.exe" "C:\Users\Admin\Downloads\Roblox.rbxl"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5236
- C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxCrashHandler.exe
  "C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.638.1.6380615_20240820T032935Z_Studio_83745_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.638.1.6380615_20240820T032935Z_Studio_83745_last.log --attachment=attachment_log_0.638.1.6380615_20240820T032935Z_Studio_83745_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.638.1.6380615_20240820T032935Z_Studio_83745_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.638.1.6380615 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=f64a8cb0a32ca3bf18861a7cc513c6806f856ccb --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.638.1.6380615 --annotation=UniqueId=8489316661656566970 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.638.1.6380615 --annotation=host_arch=x86_64 --initial-client-data=0x51c,0x520,0x524,0x46c,0x52c,0x7ff77d9e4c30,0x7ff77d9e4c48,0x7ff77d9e4c60
  2⤵
  - Executes dropped EXE
  PID:4532

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4148

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000030300 /startuptips
1⤵
- Checks SCSI registry key(s)
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.105\Installer\setup.exe

Filesize
6.6MB

MD5
96937bb70ddb5b3a89651ad8391ce5a1

SHA1
3d5ee58c00667b4dc63da7205c20b1c335c3efce

SHA256
60ae19e62277efd9bbdc93ccc5fa8b4bc1f8f6537115d4a7e8e8df3c2014315b

SHA512
d3b1c07157817bfbcaee4bf196a3743dc177470f82880d5bfdd5fce573434a652f7da5f1dbc40a086e0cc6bb9ae4bdb4f8ce86985c8dc01923418724caab6c0e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB09F.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-1b1a91b0565547cc\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
489b77fc7ad7b3cbac45281795686adb

SHA1
c1e902a581389e6a08319e522c6ca8db453a3485

SHA256
60126dffe4613a7d10b56b808c5263465ab5a79dd14a36b8aefb5ee2c4f4a8db

SHA512
6b2b58d57a84bbe2d7199e0d1336cff64f5be327ba9bf98d9a5120b32cb17ce5a7b4cae50165378c5435cd8f6d903ad8706f7daab0a2fadb99514265893a9abd

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2756_1022549519\manifest.fingerprint

Filesize
66B

MD5
7ce55ac0d7683657fd051e573ad06e30

SHA1
3bc51fbc6155c4e9d1439587e1c739995054cc52

SHA256
138e2b36e4c8bec8b00180558843355037d7de99c389f46e6183c4fc5a34c790

SHA512
f269c5c2ee53ed836bfd1b928b40e1ddb2aaea00e5585c85fecfcb1add71130d4ecfe91d2f2527934ac472c8b432d3475ca02b8f808e7e6014cd49155529d9a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2756_1022549519\manifest.json

Filesize
43B

MD5
55cf847309615667a4165f3796268958

SHA1
097d7d123cb0658c6de187e42c653ad7d5bbf527

SHA256
54f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877

SHA512
53c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
16KB

MD5
8a250d096b57d70cfc31f6977c3bad47

SHA1
9c0e56a7bde1f9c28a6f87871131088cf928496f

SHA256
5453f504abc310759fb209a64e811945e956889d25f3482095d4f70f78321f1d

SHA512
036601e71791273cb94a882c2c3e4f891bd39ade29abd8de0bf2c719344a54e0be8d6d8c2e57ec7ef356e6c8a0441c1fdf0d8a38ea47392a0a8c6469baacf73e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8516930b804a87d33bc2be0dc43a0469

SHA1
322cd50da51d7a57a5f16d32d3505d2b06b20efa

SHA256
2d7db13a40652e707705a1295efe13f19d7b70a154b1e2e9dbae21283895e0ca

SHA512
a9a4da3df06de9e08eaf08d1cdb55f584f093e8c6efb45e21186741f3f85692d40c7e34d5bf964c45393ee3a274a9e2289946b521f271d06ad2bb4c3cbc4ab81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b8a11a62e0f7f09e58191a4f97abd5ff

SHA1
49b0636e493d79c90547d68f88edfa989988a6b4

SHA256
4925ee701787a6b8133b2b1d9145686e39c3b551cb20dd7511e008e677bab437

SHA512
61a2064913b29f9b0a303b730ca047e03d282a69abaeebccf6ffcc9bfcb4244f15b5fb2bf5037f68caacf3c0c375d0bea7d8582ac88863c51a68c8d62b824e3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
03edd6ec6edfbdf57114f7904145e93f

SHA1
52d2efe4ab1bbb2f98564cfe02f1464fbb2de2c8

SHA256
b11a28d06a637b10a0354bf82848f4cc58db70272f3707676072c47cab2f2ba9

SHA512
a9bbe90497b47042d7abb3a1765ef2383a49e721fe52f3a9e9b9501dea5a1ec55d5d88256a47a5309462ccd6ce5618ecaa92802d7b3356c13ba34dd0fdf95410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
47fc6476f006e9db92f288316b85821b

SHA1
f038970306f7d1e596537fb82786c404f03ad142

SHA256
cf5d7a0af66dbe64abdc70f05df703a92c721d7998224f84768d21fa28f8ba85

SHA512
2730f09603a0b8ac8c5c5ca3485bd29b4ca1ea8edb3eaef0070a1b459b57404af9a7e7d8b5130518ac33f1417741b7bdb9106d6af0c0597a9429fd8ef6c6d155

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
62320164c42fa41ba22c8727349de5b2

SHA1
7871c8b65a74a052a58878e87bc12c3c9c3eef3d

SHA256
9e91972b2d55c82147c34999027e88ef3bb039c1715ae91b5b5d51a2a8a77584

SHA512
944c9369bdcc48c4815c0fd473afd86fa2e7eda67bdcfe25269c3acfed5e69121d830db377bb239e62eee92289ed9d6f0bdf338cd00eb0f8746c32a1b8272590

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
e70a63fdd6db3edd2a96b614de0c4755

SHA1
9c362d87d0fa3ea129a865b81d456666c988d945

SHA256
48f32f7c9870620c7389878ebad4a15737877634615a6fa551ba50c45e7f2e7f

SHA512
843fa95efaa4a35ccaeba4a32d992f772f01fff098df663950f05962913b0b1ca1bfcb0309a916a1f453be8294cc8c72ed496cac99b490fa4771e3f64630059f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8235ecba5f801326fc0520f39cdfe0c5

SHA1
9613df07726d25c5ff0ac8aba502dfb757aa4c20

SHA256
a2b9d0803c98a12134ae726ce492379432200f4d51316ba58c9b0016cb6140f6

SHA512
a43acc3900ad02ad16e3b217e26a2c8612536504c9509937475564f07ead278e20487f3a6080d5fcae25a6e29650fdaeda2c0d9e794c40d30fd856be4336effb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5b179c6bec8f060ad2f779ee9477a46d

SHA1
7b48f20f244f8321b741b7a35a5189b34f51345e

SHA256
ee682b11eadd00934cdf6655b0e2f3c69c2646f367f33afcaf8fc56ee33bd488

SHA512
ce6dc22a103f2573532851b1f44475b5d9ac253316cb15f7ee1a8d143de835f13489d4953bc0abe79e77d86bccbe59bb364b1608011120aca50c476aa3245ebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
8fd2d338007bc6971319ab818deb0e0f

SHA1
23f87a0346e509048b076ff4972a76e0930f4721

SHA256
a03efefbb64863a7714347cea1fa432a3567c04f2c064186f25645e319180ca0

SHA512
c707e3663dfcbf8625bcda214c32b390de834679a7018bd59b4868f4e30eb65d9fa94115918a1d093a4c131e09e8c49272cdc522b134dc5c16eaa36463940559

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
fc228567987c96f65b24cf07aa40d7de

SHA1
6baa5f092d5af0fa57d1b825943f20f49c9c636d

SHA256
39d35d747bb8e4cc6417ccabe067532de9104ebbd9c2ed54e02e052a89281a43

SHA512
e4158cbf334d98bd3fd2b392ac95ad1b1c3041b59df556a01f53569dfeff313308ffd3c1e8aa427cd6e2a1472662c22297facf9b348759a19b55a4059eb1d777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
592f4ca1d5eb6726a9263fcba10b72d2

SHA1
852bb33db8ecee2741dcdcf418eea39b9d1cd4b1

SHA256
82b9f4acfaca3f128a35ed473618690c09920608d0e56f1e7da2ce2b083469eb

SHA512
b88db32d07dc1f45c5d8cba1e28354e38b1e0f72afbd6b6b905e2955a2ada578edd58fd6aefd210b7db1d469bfe1e5349b3558e30567af59f9740a01512cda59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
99818bf87c666f89ab55791433472372

SHA1
3b2fc218dd908d1d42cd3dbdc7002b44f32e6829

SHA256
9df1265bad54775cbabcf069f5aac789ad510efe18631e8e11338f17745a1846

SHA512
6c335900815e674b81068e84c68c8bcbde66156f40a35964553d64090f8d1c314822c058716699f07b6d8163cc57248fae63166589b70ae0e94a4c7f4d63f301

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
08b77184eafd0b20e953741464289d85

SHA1
3ce3ddc4d9f4de1e67e22c6c37ab5bba84cda23a

SHA256
61ab583c78a05f0d4a26207192b19867a7dec7f89d1ae13d08a21f1c40431448

SHA512
db868507324eea8a45148cc481cc997e5851c45f42f6daea5fbb0e50c6d1cc5838e22e14c57da644ce961d22d5e4a0688dafababb6c97f58a038bb09fa0dca6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
911612df6e73b0f63a44ac89843a9625

SHA1
be2a41840b34b3796707ceb334ddea2369753f70

SHA256
da5526f107abd7fedeb63f892c22bac24f9cab6ae452a8a82d41732b03bf3e39

SHA512
92871638bde2438559c2b334fe94b8776209097f7af47abf3c6d772afeb491eed1292e527a691fda3cbd5f34121fcb5d7fc3f3ee722385bd5c4e1a564750a187

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
ae14ded0066285f2f05e1299ca9c6178

SHA1
a06c05f20084efb478de8dd1db0739d96b5ea4ab

SHA256
fbebad3ba63f6a0d13e2bd5435a0a8f257031205df4137bb041d37681e7bf177

SHA512
76a5b55fb5164afbc91b3b11d55031f7254447b73f26072278685b39ab322da000c111839254cc31202a2e215fcbce5e7c4f66c82943c10f89803c93ce55612e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
d46ed980c365ded582e94ffb75e55d67

SHA1
42ea64287afe9a4f14e99c2c7399e5f281b7ff6a

SHA256
9ec8a9ae1d5bed5717084548cc1bbcb4afca783ef73a325c67fd376f135d067e

SHA512
e9c21f888ba9b27239234392cd874664bd55cc94d5872e4c7466434c81cd815605cfd959d5daa272235e7c9ed1ac45031a89240e2d8cca2bdb2d46ed493eb08c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
719f53a9801843a8a18e1b4eca698c7f

SHA1
1568a0895b9de2c82f83b17ea78b8192a588a967

SHA256
eb159a7e54119c81c3f7d05057908dabef8354b00139eb7662201dcf9cd33a7d

SHA512
e352603e3642100e35dbd7622acb23e8e22db54f6f030974b1204a6099ad2bf9307ec4783b6ce5f29af4f8edb07651bcba66c720eeec003c33cf9099b705d050

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a31874032a7d8dd843410919f5261e2c

SHA1
a3d86a9cb77e4a8fcda2e19ef8905e8ea955f8eb

SHA256
219e393a01ef00a2ac50a9a18132ce0b701828abf8b5745f02491a9ced1cdb43

SHA512
eb778957f2232451f96f20f25ff9a02df512353a3d7872778457912dad2289eecc6bda9ab5952a334b42919491dfc524fdd7a39bca0dcaf3fc34c8aa2ef4b18a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
53a09f5d51673c04ee4c8fe207e01403

SHA1
b6961dbf06e02854ccbc565e6de8c73dd4d9bbd6

SHA256
fe06fc1464ec5e8bfe5558f98179517440120e38ec6b326263f4458ab166948a

SHA512
fb7ba24c4beb8a4dde7d9d7aab4bcb3fdba6d02983e5f4d5bd3c4d7d4d9e710ff9c388c110841b1f9ce00b0a83cf616b80a594af57ae2cc07ac1916940eb7599

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f0100c616556e1a0e300a520a9bf9178

SHA1
21d49756b0d5bb065f5bcaf6f6a41f8cbe03ebd7

SHA256
4d5a7ca21587d4e0aa8896f8d503889174270814c94795433352116beabb2f11

SHA512
61f3acbaf4774031f3582b9fc3aa64e8667a8e860b00e0b3c41bb70545839020b503907cf799f988cdb218fee038099e4f4a1aed2756533547dee2c7075ea9e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9d3fbd103b79ceec0cc7951c1a5bb588

SHA1
f37b40e1db3321c58d13b7df005b40a15ec543b4

SHA256
f6b7289269c5338a3ee8ccf04a146b91d346cf1c79173cc2ccf780f99199be95

SHA512
80e9c53d24db00d921e32aca2b081973506609a318dd06f14bcb3717597ba186061212aca36d15c6e5a1dacde1d53dfcecb7f766d37cea1da6f857adf1644baa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b03b55a5d8f07b1b1428eb3f6022e13f

SHA1
a756adf8ec157ea90cbe42f44c4a428f531c2eca

SHA256
616a984f9efec8f2c30f8d088cf7c8cbdfec9689a787ee510471ac9f9cd51969

SHA512
1849326092da972414463fc6359a31ecc6c6505f6dc0ecfa9fbb9309268f5f4e65e8f32b8452900c04ec8549ae1597cd2cbe3e5b687c4095f732c38e4fcdc701

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
28acf8ba23269d6696ab29c903a8c14a

SHA1
2236a9ded6c10f5817273919492af96c6a310900

SHA256
04fd26f009241a7ae0b4606e9204c76ccf807ad3a25702dc10aea819fd6b8bea

SHA512
b993e9c854cd9e95c93a4e2ef13d7fec51aa5b91ddf5c9893abfabda541f6718074a18f4926cdbc240bdd69a512b34e3ed268a49af8af968792977892f64b357

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
11440cca0b43542e4b0d466a1df7abc5

SHA1
279d263932030fda719f2a6204702e93b4434c3d

SHA256
73b217b60220b418064aca97de5fd5235125b69efdab47732b7c3168ef17bcb9

SHA512
339d7bf9cb12a0ae3b4940945c606e78e8742ff8cab6861cd527692061bb9426d5ea3f807ba2e12aa1c365b0b8105a2c676d13cb0edcb2d0db5b490d370a0230

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
897fe3a587471dcd54e10cdbb7476913

SHA1
5104d36795d1ddfb98926b704c521d9e3eaa2189

SHA256
5d7e2404acf8371f68b8e8ec0886dbb1bd4962e26e65f303318555f93f218497

SHA512
fdfd25e715ed4e36bb9fbec9e472db26aab5be0581dbed7924a27ec08abb71e63d9fd7d83d806a9022f2cc14318c1d1bf0e7bda67c3a63ad2125a53b8f220bbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
139KB

MD5
9dba9b36bd212e34a200174067d9fa91

SHA1
57d09c442ad694ae81dfd7a103793ac0efafeab0

SHA256
1aaa15b1f8d6b48af6b42d12a78b43693adac5ffb5ee818bdcd424f768310362

SHA512
4ab894773a62a0907298180311a8bce1c8a793d81940c331be5087e24bf24814a3927a75f980552171dd889497b445d57465b213decf268a22389b06e09c54fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
a7f5f171729c3c0fad0fa687a04c14f3

SHA1
80d61f923f23cc5598118a6974893a816e01af04

SHA256
fadcecec48dbecab549da691c9c4b700c08b57806d43ec694de1d4500a868008

SHA512
b3a17c8ef0b44b0c367780065f5b7f3011ff8d2500d3042795ed25e693d6472db75f9e339fcec1dfbba0855e128b6e0122ca0b3e2849d6af4b2dbccb9c5c26a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
c7f3d27cec12cf9729e74bc8e15afdde

SHA1
cebb8c7b2f5917e46200a0d1e36118169716a021

SHA256
ad25b3696a3c7b9c7fde0d2009edc60736713a58d645b8b752ea5474bfeb8fc4

SHA512
c50f14001a226af9037d298a920adabbd18ccc1dc889d299adae213d9582f8deb71b234145f13e90316bbe05f535e608f3a13495fe4af73300d80e5e34c2c4dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
300683307a013ed9ddc83cc150c1771b

SHA1
bf562b60096cc4069359831b60557c4f40e0af8b

SHA256
93a8f3338b06ca5aa7f2c531ecb65712cddca97ebf2f96f92d3a61f0cab4478a

SHA512
e4237cc59beca1813adbddb3fbe51493d98b80cf552d7c34ae398af8cd4dd01fda76aaf4ce00432c9699d3a6b6ef0dbed67a88bfee3d69316dd8b91a9beccbea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
d8c24ecf6348cebda9e74aebf0bbb2cc

SHA1
1e21d4bd77881e126efc034e567801217619089d

SHA256
b0450c563bc72b99d281759d8c8a694f85408b7e600b09104b078ba94d541a08

SHA512
261f0de5bf3ba577e384894d08889be42b659c4883281c6a339c2416d8130169184e61578e38c6821eb0b8d31f38fd7b7f5b10ecc9c89b62c1901aef2ec54a70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
fe244bee59dee7dff4f276d2380df70a

SHA1
e74c28d54b75a01c0e75750ccc2b385756a7e417

SHA256
77ad81016aeeaad6ea8c30ff98a7b42d62507d0afac34caf00c12fe0a22307e8

SHA512
4bedb14ff1d3a0ad3e7d185eeeb81247e25e9c7efac3da8360577921ee8ae8a57f331081fdc66a270913eb4ffe6247a94927a6cda8f1080439f689029eaf1b35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
5aec7b728e79627a14251e059d1862fb

SHA1
aed46e6004b9de4d7d0647dc377c62036ba8ad82

SHA256
9faeacd81ac1b5d8388cfbdedac7b2b150f37c3f3579fa1f098e88d98be06050

SHA512
8b778d8ffbe5a9cefff5dfd9f96576bba796501c321b5801953eddf030236decfa63a9080d58ce710a8626b646393316a5043f4f93811a64c0d6187a879eb626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
3a2d7a4b14cf919c6234acf4fd2986f3

SHA1
2a9aebc5f4275044e0b6b11e484589cca61c852d

SHA256
a7b2d9cf79e00ac98a95d331a08073cd88e0795d1bd4e52771cb83a3e09d1a6e

SHA512
bc9ecd07d2e7e4a157ad20bafc59b68e1b173497b6e50fcae103caae5f98acc57b27e3db263300426016be8c80df1b3f0e05d3e4ec6578bbcd2aa70a5cc365f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
157KB

MD5
d4c6f62c1f423fd67f29217f60d87813

SHA1
d3e1d97fba7cd59c053b4e2a9d02a9efe0ae01d7

SHA256
6cda61a0b00f10a9b5d160dc0d3487e58f22a30040635d77ab536d73f668d482

SHA512
42c85a1d33c36d18704fdfd94797c106ee8001aabf1b448f537b5cee63775714f00407013eac4c50626c2df828091b27fb9124fd2abc802f817a5c7b8fa1c6e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
430b51b123a3a32a17852ec33f09fcb7

SHA1
10660d6cb35e1ea73c1b6edbeaf2802d59251748

SHA256
5be544fe8179227ce104122c2ee70aa7566c13d4f3ecdc83f957a9f6f02eb339

SHA512
34e16648e9a14f28becf86a3aa61a4fca4e7a6d6d8a80a53ec682332b90990947d2689786bc3650859520f0bf69fb8611801ccc00f4e060210b52de7e9d75653

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
a04c325acc8b3f5e7d8a7575f1dc4657

SHA1
3ae1e389a71144a85d16c5434cd47abbf991bc81

SHA256
4b44fc5901afd4bc065ae42d1b68312c59f4436cac73de9f3b94e0633e57fb58

SHA512
66e0e2b15d079368967c0f6ecff388dba2ac989322855122c947cd8a44c8712da099f25507170c49a8d66899fa0839562df4c13c1e2ced70ad81aebbdbc76fb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a36e0.TMP

Filesize
105KB

MD5
2a16701b336493b3f141184380f62616

SHA1
999358b86f5e786d53ab23b8a445a04a22001c6e

SHA256
3eb5ac40111e955c8a965c04b70ec7d9780e178457346ccea4413c90baf65671

SHA512
d4b58641dad96bc3c6f72690a773a0d3e17ae33c1871beafd5ac1bdf12fc7d8f65df3008bd9981637a0fd0494b191126d84f10c577b49d9cd5ac7a895f1ba350

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Roblox\7225406994\InstalledPlugins\0\settings.json

Filesize
662B

MD5
30c7b2bdc35c650d2b65150241646816

SHA1
94d466a5f5159784155b6adcc9555bfdae4710c6

SHA256
0784d39379f0a4f971777844ba07550aff31a3d5e32ce1d1eff6f4c7d49b90b1

SHA512
8d51ef924b6c8f46a7ced69f188f2ea583ef3feb7fd84f51a8af8810c51e5099052e2c1513f15ac6fb83fecbef8c984fb4e124ff524c2b20a437943dc127465d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
a65f6a49d9d5e787769ba60fee1eedf3

SHA1
ca0faa4e867c66272743856bf343650ce45ee36f

SHA256
ec8d752c6bdebc933300a9b3e2c9a2e2b2a38a1e3394617b5afe44a82d0525eb

SHA512
ae29c136f7095558a3120e1db9d0e4000cbb8e89c6a5019d45139c9112def3f160e7e26df87d4f24168428e8194c529421708c2d6a3533b46f27ce7b3fff822d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
0bc4b6da059622dd968c2df0759bf372

SHA1
8cb711e6de394c8d1267bfaa538dd332465da8a6

SHA256
97f861c3d8c8f0b169229f493c2f4926e92eec753aaa0e7e115efbd84bc9945d

SHA512
812e73ec903fb4e5a1c64c9b9d1ad44f45714c455fdcf2ba8e3336a35f99c9ebd5e63eed8ff265e5db2384ed5a14471dc76d209fbba38a6cb8f5ebd1e38e1862

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
43377f03e2b9160f7edbb532c0babc48

SHA1
59fe3b5fc1506975ac9e61e7015902431bd93ed1

SHA256
14b7d170b422cca057d853a39563cc8255a8144d738dc20f37c8d7c12b40e4f9

SHA512
cc71481f565a81e6905f65912ab62261f82b5806735d99f88e597a8d74ec675c3a1e94e6c691c78af25ce6780d6829798343549bb81d1f4ac2baf68eb801874d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
add592e0982746342a232b6f37de8b0b

SHA1
46aeff5a5cc388842727dd45189679fc5446637f

SHA256
7f5290e2a288654b17fafed48a352ba5e668b1e929b7f025e1a5e681531df425

SHA512
44afc3237b6d46dea600ea7aa1d214e259be9232ce6e9153250fc27abf2867e1a90331552a9501300a53c31ef840d476a834f0dfa4c0fd95287c19e5877800db

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f9d545811e1325f153b0e4c6466fb368

SHA1
b939dbf6e0c696e172b986f27e113913fda39c6c

SHA256
3a3576714fc7822c8c5844cddda02b1b40d3333a07ab50b34a3ee070d3e600e2

SHA512
8f9b751b4e135a06f139b1f753feca16931e7293fe63db2dfbefce25919d3e60c6142963271bc3630c0e242e4ff7abb72323f7f31d52bdea07e0c9e46049adc3

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\ExtensionActivityComp

Filesize
4KB

MD5
b4658f0ac4d1a96ff23e9edd0de90b1e

SHA1
752b065125d6fd91e8eba3fcbcb32ae2d1d1c1f9

SHA256
8f6bc4d06d8f3f8424d8856fbcd03034a61cb4170f409973dabfefec21d5ae7f

SHA512
4a35569e6334f50d8c879f4985fdcb43f9e4e0927bb6f133360ae541de1e41cc9024d551b33d2114f97a53a07837e62dca24e2a45b9d7b47b1642a384d6e5bd1

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
1KB

MD5
20b18efbdce2014d4e3bfd9831636b2e

SHA1
790af8d6ef64b7e484291b5fb4b9fbf00b2d7a22

SHA256
1e684234514e6a721ca42342534ee8fb730aa77326419a913368034f213d6291

SHA512
bee94f1ff3395777a3c09868fc085fa66d132d1e9720b4bb5a0838bccc33c5af0de415c89e5059443033b1d26d552590b77061eb63013acf72df138bfbce183a

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
1KB

MD5
07a1f8c2afc1204fe94c19764497fa48

SHA1
7b45712205615d1f4a78abed98c8149cc645be6c

SHA256
90c50a8d26bf49751abd5441f078c60128bc5db9fd283ffb1ce402b8b818a6e7

SHA512
9f4de94c54e97aaafebaf555329a0c55482314dc4b70a09e6319cad56a7c067e61e8cecf08efad317f09b939a0c75dbf6a90bb4b8337492d0c1f9e76e127bf7c

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity

Filesize
1KB

MD5
d86a8269529cb456948d80f2df350fae

SHA1
308d52e8f0332218f95b3f8f61a052a1604e72cd

SHA256
5b0ee0dead4eef38cd849cec5fd6cf9d5ffc203cdd5eee60c55eca2d240a1b6f

SHA512
32760724ea68a5f0b88c6fe7734216bb1f991b3d578b87c05102239520c03041f0121d00ae24dad4bd15c70253f07f58e0908c5819478f8165fc8f814d53676d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity

Filesize
1KB

MD5
8c466a6f3cd876e7555e4c430be0c2be

SHA1
54861ea338aee1471ec79d7e707bedcbe715460a

SHA256
d809310cf502446fca08bc788bd16da118ab4468b4526c67874dadf461717bcc

SHA512
559ec7c3b564d39d0bd4e9c2781cc54f07e19b47ce2c72cfa01ca31a3bc80484761707f18c3e999195d73eb6f2b3cec6e7c8718d0f1caf7d97ee5bcfafecf6e2

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity

Filesize
1KB

MD5
c20dd96c89d29942bdbce75d61b3cf52

SHA1
e146dd5178a9c64d39c39d360ac39dc40797aa33

SHA256
7c10352548b2d3663d0b8a14a682dc5458ebc0cb296fc7b3e46dbc4b226f22a5

SHA512
8ec2d545c4c8ca051bea3e5809472f2b8b71adc398e43544eb0d3f1eca2559e78f6b17fa1b96f63b13425c8cc22004858913b3049d8b8163d16ed0fca99ed7c1

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity

Filesize
1KB

MD5
b1fa5bc83d0f63a973bf689e6808565b

SHA1
5211c9f909f3442f4f77b3a6f510502e0244d4af

SHA256
1148ab6387bc69086c80de2b85020fa90f49130952a2d36805500dfcbb3bc5cd

SHA512
467801635b6c7bce23205754d6c9abee7bbcb90679813d4957b7251ab6e8fe5dd70df03f4b007832cc225094249405864bf2ce82b060361b9dba34a683ffaa04

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity

Filesize
1KB

MD5
ecef6d292170eb4766cc20cf65d3771b

SHA1
0368debacc15e8bed86d79c897c423e13cca89e2

SHA256
e6687aa7a16001ce059623a8ca3354cc66f927258f73e503368798b286bbc717

SHA512
1c47c8e54272468643aae5bceca32d8a229511ed57b1ce35d24477dee5b644237b8476168bc24b8266786407055de252f40484dc4a2dec23e2c67ca026780a13

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5d2127.TMP

Filesize
1KB

MD5
f5565fd0d168e72e22b9cccdff211f5e

SHA1
58b2cb657c8f7857d9ff0e61446a7c55c3d56521

SHA256
a6a6076109fb222eddd6c097dd589a73b2da25a1586cd5ded96f5e716acccc23

SHA512
98f1b0a7f3699daf6d35c19484abda80ca5054b0fc92ec36238db7b966574ab061fb8c84534b6a626c163ddfafe7b00d740d1eb083d8f7407861a69a292acf6e

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\e5e4a465-d4cc-4333-be57-b0b0d4a99346.tmp

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences

Filesize
6KB

MD5
c0b128d577bf38ba53472c7d060a0404

SHA1
3b4ee7ab6751d2f52e22813b088f3a7bb1166e56

SHA256
941a94f5a3e7401808246c19cfa46c0e58be05ebaab769d28e7f4c45e01c4e73

SHA512
f38e7896cef288d8f38195209961c23df39e580cec12f7ab663496cf3a03768e70b027d0a65523593d169a87093e1a2df6626c7b90bb4635e1aa486f8176091d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences

Filesize
6KB

MD5
e40065137952a2b49455638c0e828e47

SHA1
2ceecfa249dbb398fc455329b4d17bac7ac49f20

SHA256
bf8e879a5cac9f4f382d73c170015c1522f49f23b3b69eb41ba81cbdd3a9bf87

SHA512
2896b865162f5a508b3bd81bccd7e08adfb4d6801268d41424c0c6495c566593bbfe42354042e38ca015d9e79685df4d35263b3ba6529210de6228ea0caa17ad

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences

Filesize
5KB

MD5
ebb1fb2e88e113b7440379795f860eac

SHA1
866b86e535cd44e1368bd41f827c577b124ced98

SHA256
0894f56db495aaf75e927394c4974723130c1ff2b00c3075d3d96d16e3291d23

SHA512
1424b2a4dc240cf3a0bafa0b113ef4d1e52e07d302653371a4ae14995e72b141d3bb889e486b8b7c2bb37a8733a2d8b734b734c4e08f5cdc1d66c29a3f581bea

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences

Filesize
6KB

MD5
68cfa6829cc9ebb583994f6fd56e949b

SHA1
5c0d88ced631ffc9a5b5eecc6ae9c022e1942bfc

SHA256
fea80d929816a506e24f0b11241cd9fee4b6e076493f3237dead5b44e6cb012f

SHA512
06a9252d5224533cd806ed4abc49c7d657853c6736c3d371e7dfb3f8ceb3b761a51b0310299993d1c7abb289d87f7e327663f7c2dcd46051c096cddbbd6d7ca4

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe5cf5a2.TMP

Filesize
5KB

MD5
d8b41f6aa8fb3296924cd6ef4cb01b16

SHA1
e5c5970817a81aec0e6c4eaaf5ed1f6724e831d4

SHA256
2fd0453fcd5e2eedbfbc9f53cc67dcad50db9273f7ae71962b7f5b4223d0f2ae

SHA512
1b3771af568534c955ec9d92ca332778149365034ee18a48916b102b460c2cd0f9b4df2f646920f6cfbd01409f60299775937ea9ad976c82311f82883055c24c

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies

Filesize
20KB

MD5
04d4c386aaf03e6dca3ac87334f03d3f

SHA1
74627631ce3bd2ba43a12aac39f232da662a32c5

SHA256
c130cf082fdce58c9055dba5775490ad8e41055ead5edb0b1e411330144c971d

SHA512
01bce1bbdf00825e19c23559ec41a0236b059cec2e891cf4729288b6275aaff62f442b4556c869bfbe17a91475f22dc98522381b2e4f3bef6d1611f7f9f9bc1a

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences

Filesize
6KB

MD5
d5d180bb65d3006f0e2d83be6e4320b5

SHA1
22eba1b700b9db38f9ba00269ecb581cd493ef6e

SHA256
49f597ce5facb9108c8bf8ed05e6333aa1fa71c04e28a00a922c568da96b6393

SHA512
d00aeaec586e6c446270ab0c4ba58517a4c5e01e87c8c67d6e5234c9ac87a2379a94792c9e319a1d5b8c7c5f1aaeef36556e2543113d8bebf3e71b347fdcf1f5

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences~RFe5cf5a2.TMP

Filesize
6KB

MD5
bf1fd1c77d38695fac74a57006808821

SHA1
42dfde64c4fa0efaaf9ccc5ccba7fb2fdbc774c6

SHA256
c071ba48683fd0020f0de855f9ec8ee005fff2b61fb29c795e9b3dff72ed2286

SHA512
fa8edefd343408a1acfc53c29744ae6be83fde7c16203bfe2faacba0093312b51034bfc8f051f7f4cc11ebbb3f91d8b704f80d0eddc439b3b2d4764d322b4e4d

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
1KB

MD5
f103ad2aacbcd2baa16b13ffb4e0161c

SHA1
08db1ea8477835075807a7a0226c7ee5c0dba632

SHA256
6a59a8c5c2adc06f55907eafef48811841b794c41b25e116f143700151dbb334

SHA512
d92af94c9c2951e0b1338601087d74a79dfc8ed6f22b08047a6e8ef30905c3e4a0177ffe0c3860923836ac8810175d0721c35f689932d0051ce0f617765f8dc5

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
3KB

MD5
d13768ab809cbbac328433a1cc960f77

SHA1
e9c264803912ec56d3c9d3e93c5e11f77e7289fd

SHA256
02abf9c518006347847441f7c954d7c73da7ec93188f8c49e51008be4dfcac96

SHA512
7fbe2aa4562343bf51dca1541ec9fdffd58c803c6af1ad22f94785961e617358f3128a222a4c93da6cec422e2a328d888adf238e38a0706e54b665ccac55b013

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
4KB

MD5
61d1d637a81647ad7054fc274df079f9

SHA1
ae1b5ddba0da4da58f78595ecd2d6a5f4d82124e

SHA256
c501df9c4b77423d3b83277264b0e7436d9916e4013640149ee4823b4b64f05c

SHA512
8cb4b06fc5897722e96f6f0ce496371e9140a06ac038245f81844d08675381196d156c0807c45c5cde4766723aeebd369d4a97175f057a38f441937b25150428

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
16KB

MD5
99f5866cbfa59112b6c7b5592834d24b

SHA1
76c36d63df2a3c5e7749ff259760cf98cedaa164

SHA256
c52bdb2b1512671cbbf80b33a23e38f1769049a3edb45ea948a9ee63cecd7bb7

SHA512
def39df7c1c2cb9011faf2345446fb19e54dd0d967efb3a37ac0b941042d0c861244892cf673d7c2e421d9c6cbfa677904c116fcd0b22578e3a34a80b0e467a3

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
18KB

MD5
8bc47763dc406fc69e294b88478b3913

SHA1
5486c4eff858f12a195a2ddf18c1a5f5ee0d7b1c

SHA256
6fbd5bfb55fde2208a176b038eef93672a1c75778cbda864c1fa7a9cb15c3973

SHA512
bf653e3538df7535d4738b48323dd4f812438982fcb655b8e4af135bc48cef7574e1b62e1822b98faad2435ee2f2053adb551fc5a68cb49164b77d39e614983b

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State

Filesize
42KB

MD5
2c4c095654e84993eea2168c106f65d6

SHA1
1afed07fab379dc9385cb01380c38cf60e1cde83

SHA256
c471e794661d5925a489407ed8e9418fe9de25512364350c99d8251b815e1137

SHA512
50bde50d6b6646c91c1eb215b2d2f6415fdf516679c516253d28858650999a39a42cd93a501afc43396a1fd9077a8da2bf91551b6b6da0f8bb3b1cf56324ad3e

Download Submit
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5ccd69.TMP

Filesize
1KB

MD5
a3aaeba6b03d9fc8ccde41fe92551848

SHA1
34391afc78c5b8028d33a06e4d87fde365dfd644

SHA256
180110124c9318008359af653e28f28895662ba16b7c4982a048f9886ccdb18b

SHA512
ad26c36794a497b834d3e57978077c21a44357a4c986eed8a58ac1ca248ca806775d42d8f8ac2b03b0abc9108ceab2961d824bdce48e2d7b52ca65e1e959b339

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
15KB

MD5
099f78cb802822162ccf31511377b9f5

SHA1
eea79c4fa8311b42f0a74325b2e1fec83e15639c

SHA256
26e394bf68d4b3be3d591902688f19fb5a27a65f527c4e96a4ec14ac5bd805f5

SHA512
a0101bc3ec8689c5af9519fd4e2e6658b660092a69d9914b54e95819cab1f32ff0ebb45c902e06f8c013e75bd935a7e1d0d884d0b1bfc7627fad81e5d5c25164

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
9KB

MD5
ec37a1fcea66f06d257398e82e145725

SHA1
75510d9ad7afaf398f73064fc81dc842f57681bc

SHA256
adbbfa2e86ab50a8b9023158bf6633419e7a63dd7b4bb349aaf48f08b959f6ce

SHA512
2e7c4fb987951279554022d1465fe859048de43e2eea5531dc5f6d5aef4ff040d2f8fa23070cde89d0d799b83430a6e73c639e2f0d5e3ddafada76b76fc58243

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
12KB

MD5
58a2dac8934bf166347f65c449da094f

SHA1
e5625934df5fd214d8539565582877e0bddc9bfe

SHA256
65cdc9a413dbde3bb4d76cff169ff61e0f75537d9fe4db3a3f01e0851a2d2999

SHA512
1715c8b9918b3c5d67fb2954f68b68bb2f03ba6619403ae200f80e2e757efd160858905d9cdf97d7c1dca421750bb76a62ec987fb4b764b9871b2041d0600044

Download Submit
C:\Users\Admin\Downloads\Roblox.rbxl

Filesize
2B

MD5
8df6fbcc43d31d99e5112eb009ed8a2d

SHA1
ab90d23f7402359d51e25399fe46dac3401a3352

SHA256
abfbd10daf8965c8860b3582af942d7a7cac972b31d1c50f382b67d9b6c07365

SHA512
349beb7de0f285a3aba778f646344b5e0e1f978ce9c3d35bcadfd3c85434323e3affcd168f08f7848464d5d4ed7331428de4e89f92ded1a0f15b95768b4430e3

Download Submit
C:\Users\Admin\Downloads\Roblox.rbxl.lock

Filesize
69B

MD5
aee7e54dabf7417a7000efe9e1ae071c

SHA1
6ebe7ea193d05eeca6187f9b555a496c1d69975f

SHA256
7a88b910447e863c54afd03998587a78bc80ce37fe5d8453ab715850f142cc23

SHA512
97e83c1f975833975e0ddc01087c8e0e9902ce6887b07c49cca63ebd3daa8a50872fc1cd727034786c5f2e87e3de18e0c0130ebb1ad232e3cfbd5b297fcb2401

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 61578.crdownload

Filesize
5.5MB

MD5
658a6b0f3866e63545503fdff59d000c

SHA1
e5df1309e574ee77ca1727bf64a269f376d5ebd9

SHA256
61b302dcf209bd7a3288a6a9e478c6ad0a5d6b195f5328f827c938d5122f679c

SHA512
bc02baab236cf4427f26dba22fd3ab977abd8df1eb7d30b20d7b36f410f70877872a85f6d7bfdccc8b53c5e2ff5a70cdd056ac133d0bb7ec5a7596fbb7144e8a

Download Submit
C:\Users\Admin\Downloads\die_win64_portable_3.10_x64.zip.crdownload

Filesize
20.1MB

MD5
913e398a24f4bc9cea4a8d5f72c64cb7

SHA1
3ed7708f95359941effdfb31ef8cf43bc15d8312

SHA256
8eb0604244f029718f2bd6ab8a9fcf5f8eaf9f2e7ab4041fd02d2cce9bdaf7e8

SHA512
cea3b305854df19f08747079c3c53f53b58318886ca9eaba7a3e84b8ad5c606bc2a46c3aecdff1bf08be5ff4aad8b5ab742cd24bb695766e35e8df40fd0b0440

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/1604-2424-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2435-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-1238-0x00007FFC6E330000-0x00007FFC6E732000-memory.dmp

Filesize
4.0MB

Download
memory/1604-2434-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-1237-0x00007FFC6F3B0000-0x00007FFC6F8FC000-memory.dmp

Filesize
5.3MB

Download
memory/1604-2411-0x000002455B620000-0x000002455BA60000-memory.dmp

Filesize
4.2MB

Download
memory/1604-2413-0x0000024559FA0000-0x000002455A1A0000-memory.dmp

Filesize
2.0MB

Download
memory/1604-2416-0x0000024547C60000-0x0000024547C61000-memory.dmp

Filesize
4KB

Download
memory/1604-2415-0x0000024547C60000-0x0000024547C61000-memory.dmp

Filesize
4KB

Download
memory/1604-2418-0x0000024547C70000-0x0000024547C71000-memory.dmp

Filesize
4KB

Download
memory/1604-2419-0x0000024547C60000-0x0000024547C61000-memory.dmp

Filesize
4KB

Download
memory/1604-2420-0x0000024547C70000-0x0000024547C71000-memory.dmp

Filesize
4KB

Download
memory/1604-2422-0x0000024547C70000-0x0000024547C71000-memory.dmp

Filesize
4KB

Download
memory/1604-2421-0x0000024547C70000-0x0000024547C71000-memory.dmp

Filesize
4KB

Download
memory/1604-1239-0x00007FF774C40000-0x00007FF775C40000-memory.dmp

Filesize
16.0MB

Download
memory/1604-2425-0x0000024547C70000-0x0000024547C71000-memory.dmp

Filesize
4KB

Download
memory/1604-2431-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2430-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2432-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2429-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2428-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2427-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2426-0x000002455A230000-0x000002455A231000-memory.dmp

Filesize
4KB

Download
memory/1604-2436-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2453-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2452-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2451-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2450-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2449-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2448-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2447-0x000002455A250000-0x000002455A251000-memory.dmp

Filesize
4KB

Download
memory/1604-2445-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2444-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2443-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2442-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2441-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2440-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2439-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2438-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1604-2437-0x000002455A240000-0x000002455A241000-memory.dmp

Filesize
4KB

Download
memory/1724-751-0x00007FF72AA00000-0x00007FF72B652000-memory.dmp

Filesize
12.3MB

Download
memory/1724-750-0x00007FFC6F870000-0x00007FFC6FDB1000-memory.dmp

Filesize
5.3MB

Download
memory/2872-1419-0x00007FFC8DCB0000-0x00007FFC8DCB1000-memory.dmp

Filesize
4KB

Download
memory/2872-1418-0x00007FFC8ECA0000-0x00007FFC8ECA1000-memory.dmp

Filesize
4KB

Download
memory/3500-1138-0x0000000000B50000-0x0000000000B85000-memory.dmp

Filesize
212KB

Download
memory/3500-1230-0x0000000000B50000-0x0000000000B85000-memory.dmp

Filesize
212KB

Download
memory/3868-1325-0x00007FFC8E0F0000-0x00007FFC8E0F1000-memory.dmp

Filesize
4KB

Download
memory/5172-1398-0x00007FFC8E0F0000-0x00007FFC8E0F1000-memory.dmp

Filesize
4KB

Download