f30f46a84c52f2cb1391e3edb66fb88bca4592a70096fd5d90333c32f99b6c0c

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AssetReuploader.exe
Size 6.7MB
Sample260628-cs71daez2m
SHA256 f30f46a84c52f2cb1391e3edb66fb88bca4592a70096fd5d90333c32f99b6c0c
MD5 d4045f28d285e5ed31cdde9f550021ab
SHA1 3d614efe58735ba13a8188c4c172bb09f7c0b5c4
SHA512 191442d810e2024b6a8263a999a7edd2077dd1b99c64ab6f356d69db94246f968b5714ccbf480409388ccc81800ec7bab51cbf33ad4ba8c93b0ea712cec2952e
SSDEEP 49152:qK2l/gxl0aP04d/UP9cb+2oAxaRwrghzyhT+37/Bbk8qAiTL367sAbj/Vhrt7V3Q:qPaf2wKs+37ZnEGT+jEVDE
TLSH
T11F666C57EC9115E5C0EEE23586229253BA75BC895F3123D73B90F3282F72BD0AA79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
139	3452	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
1256	RobloxStudioInstaller.exe
1668	RobloxStudioBeta.exe
2636	RobloxCrashHandler.exe

Loads dropped DLL 24 IoCs

pid	Process
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
2636	RobloxCrashHandler.exe
2636	RobloxCrashHandler.exe
2636	RobloxCrashHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	RobloxStudioBeta.exe
File opened (read-only)	\??\F:	RobloxStudioBeta.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4228	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Navigation\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\textures\ui\VoiceChat\New\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\AbuseReportMenu\MenuConfigs\Players\FreeFormCommentMenuConfig.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\AlignTool.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Packages\Light\Standard\PackageLink_AutoupdateOn.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\StudioContent\textures\TerrainTools\icon_regions_select.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\fonts\NotoSansSinhalaUI-Regular.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Lua\Toggles\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\ProceduralModel.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\AssetManager.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\ColorPicker\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Lua\ImportPreview\Light\Large\RigVisualization.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\GenerativeAI\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\Chrome\ChromeShared\Flags\FFlagRemoveLeaveShortcutFromLeaveConfirm.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\SpinboxControllerUpHover.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\StudioContent\textures\Debugger\Breakpoints\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Packages\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\RibbonAddCollaboratorSmall.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Lua\Toolbox\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\optimism\anyEntryTypes.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\Signals\Signals\rotriever.toml	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\UIFlexItem.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\Tabs\OverflowScrollContainer.story.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\CarouselUserTile\PlayerName.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Lists\VirtualizedList.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\CollisionMatchers2D\CollisionMatchers2D\returnValue.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\FileSync\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\CoreScriptsRhodiumTest\.robloxrc	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\Server\ServerChat\ChatServiceRunner.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\StudioContent\textures\TerrainTools\mt_paint.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\views\RobloxStackView\StackViewCard.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\LineGraphHoverDisplay.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Actions\SetView.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Streaming\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\StudioContent\textures\MaterialGenerator\Materials\DiamondPlate.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\StudioContent\textures\StudioToolbox\AssetPreview\rating_small.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\Connection\FriendStatusConnector.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\cache\core\cache.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\InputHandlers\lock.toml	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\RobloxRequests\RobloxRequests\src\ratelimit.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\AvatarContextMenu\ThemeHandler.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Notifications\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\textures\ui\PlayerList\SelectOn.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Tile\ItemTile\ItemTileStatus.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Light\Standard\RibbonSpinboxControllerUpHoverSmall.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\scripts\CoreScripts\Modules\Settings\Resources\Constants.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\CarouselUserTile\StyleTypes.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\content\textures\ui\Settings\LeaveGame\Button_1080.png	RobloxStudioInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3452	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270869545338863"	chrome.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe\" \"%1\""	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe,0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-71452ee9293e4e08"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-71452ee9293e4e08\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-71452ee9293e4e08"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx	RobloxStudioInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1668	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
1256	RobloxStudioInstaller.exe
1256	RobloxStudioInstaller.exe
3436	chrome.exe
3436	chrome.exe
1256	RobloxStudioInstaller.exe
1256	RobloxStudioInstaller.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
1668	RobloxStudioBeta.exe
4056	chrome.exe
4056	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	RobloxStudioBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3164	msedgewebview2.exe
3164	msedgewebview2.exe
3164	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	RobloxStudioBeta.exe
1476	OpenWith.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2308	2352	AssetReuploader.exe	86
PID 2352 wrote to memory of 1600	2352	AssetReuploader.exe	87
PID 3436 wrote to memory of 4712	3436	chrome.exe	96
PID 3436 wrote to memory of 3452	3436	chrome.exe	98
PID 3436 wrote to memory of 2796	3436	chrome.exe	99
PID 3436 wrote to memory of 2796	3436	chrome.exe	99
PID 3436 wrote to memory of 2184	3436	chrome.exe	100
PID 3436 wrote to memory of 2184	3436	chrome.exe	100
PID 3436 wrote to memory of 2016	3436	chrome.exe	101
PID 3436 wrote to memory of 4364	3436	chrome.exe	102
PID 3436 wrote to memory of 2016	3436	chrome.exe	101
PID 3436 wrote to memory of 4364	3436	chrome.exe	102
PID 3436 wrote to memory of 2596	3436	chrome.exe	103
PID 3436 wrote to memory of 2596	3436	chrome.exe	103
PID 3436 wrote to memory of 3204	3436	chrome.exe	105
PID 3436 wrote to memory of 3204	3436	chrome.exe	105
PID 3436 wrote to memory of 3484	3436	chrome.exe	107
PID 3436 wrote to memory of 3484	3436	chrome.exe	107
PID 3436 wrote to memory of 4924	3436	chrome.exe	108
PID 3436 wrote to memory of 4924	3436	chrome.exe	108
PID 3436 wrote to memory of 3684	3436	chrome.exe	109
PID 3436 wrote to memory of 2708	3436	chrome.exe	111
PID 3436 wrote to memory of 2708	3436	chrome.exe	111
PID 3436 wrote to memory of 2676	3436	chrome.exe	112
PID 3436 wrote to memory of 2676	3436	chrome.exe	112
PID 3436 wrote to memory of 3164	3436	chrome.exe	113
PID 3436 wrote to memory of 3164	3436	chrome.exe	113
PID 3436 wrote to memory of 5024	3436	chrome.exe	116
PID 3436 wrote to memory of 5024	3436	chrome.exe	116
PID 3436 wrote to memory of 4204	3436	chrome.exe	117
PID 3436 wrote to memory of 4048	3436	chrome.exe	118
PID 3436 wrote to memory of 3668	3436	chrome.exe	119
PID 3436 wrote to memory of 1412	3436	chrome.exe	120
PID 3436 wrote to memory of 1256	3436	chrome.exe	121
PID 1256 wrote to memory of 1668	1256	RobloxStudioInstaller.exe	122
PID 1668 wrote to memory of 2636	1668	RobloxStudioBeta.exe	123
PID 1668 wrote to memory of 3164	1668	RobloxStudioBeta.exe	128
PID 3164 wrote to memory of 2344	3164	msedgewebview2.exe	129
PID 3164 wrote to memory of 5368	3164	msedgewebview2.exe	130
PID 3164 wrote to memory of 5368	3164	msedgewebview2.exe	130
PID 3164 wrote to memory of 5368	3164	msedgewebview2.exe	130
PID 3164 wrote to memory of 5392	3164	msedgewebview2.exe	131
PID 3164 wrote to memory of 5476	3164	msedgewebview2.exe	132
PID 3164 wrote to memory of 5476	3164	msedgewebview2.exe	132
PID 3164 wrote to memory of 5984	3164	msedgewebview2.exe	133
PID 3164 wrote to memory of 5984	3164	msedgewebview2.exe	133
PID 3164 wrote to memory of 5984	3164	msedgewebview2.exe	133
PID 3164 wrote to memory of 5620	3164	msedgewebview2.exe	134
PID 3164 wrote to memory of 5620	3164	msedgewebview2.exe	134
PID 3164 wrote to memory of 5620	3164	msedgewebview2.exe	134
PID 3164 wrote to memory of 5532	3164	msedgewebview2.exe	137
PID 3164 wrote to memory of 5532	3164	msedgewebview2.exe	137
PID 3164 wrote to memory of 5532	3164	msedgewebview2.exe	137
PID 3436 wrote to memory of 4056	3436	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\AssetReuploader.exe
"C:\Users\Admin\AppData\Local\Temp\AssetReuploader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:2308
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:1600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc56e7c728,0x7ffc56e7c734,0x7ffc56e7c740
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,8113694545863597388,7944042022975085120,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6827447997475054697,3499131629038208833,262144 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,13912723336150226321,18394628004226610260,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,15267432707638303664,14087254588851449893,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3468,i,11709467525422550078,13136592070148680871,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,8373065537386652186,665072018734358860,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,11848849906371074063,4132817238335180440,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,13310581487777736181,11925757887840019095,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,9403425259770277719,17079615852322946320,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,15140497793208859908,14476953130759808822,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,15002344025433126238,8833371524630042191,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5952,i,16211080776480579556,13174662132098586941,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,16267200564353621279,12716189812841619783,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3708,i,8324782934174110150,2188578634941439435,2097152 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,16557788923515887247,15119568418382408877,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,8869649647127098614,5711512778727796840,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,15333868768971085535,12741816915450887844,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,8991941256200674235,8788746252621260721,524288 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:1412
- C:\Users\Admin\Downloads\RobloxStudioInstaller.exe
  "C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\RobloxStudioBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\RobloxCrashHandler.exe
      "C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 1668 --attachment=attachment_0.727.0.7271204_20260628T022353Z_Studio_51422_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.727.0.7271204_20260628T022353Z_Studio_51422_last.log --attachment=attachment_log_0.727.0.7271204_20260628T022353Z_Studio_51422_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.727.0.7271204_20260628T022353Z_Studio_51422_csg3.log --attachment=attachment_log_0.727.0.7271204_20260628T022353Z_Studio_51422_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.727.0.7271204_20260628T022353Z_Studio_51422_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.727.0.7271204 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=e88c6f5d9e4f2747a86aaf1b8e965f375b67d830 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.727.0.7271204 --annotation=UniqueId=2741085738512576066 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.727.0.7271204 --annotation=host_arch=x86_64 --initial-client-data=0x440,0x444,0x448,0x41c,0x47c,0x7ff7dedf2ec8,0x7ff7dedf2ee0,0x7ff7dedf2ef8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1668.4716.10931429480910641550
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x178,0x158,0x7ffc4b5db078,0x7ffc4b5db084,0x7ffc4b5db090
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2088,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3708,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3964,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 727, 0, 7271204" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4472,i,14837417199445871950,10651317316600347367,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
        5⤵
        
        PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4448,i,15235209016106809110,6002155270394561962,262144 --field-trial-handle=2084,i,11120812371578483965,6937844851745930582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2824

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4f4
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

qgif.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Plugins\Qt5\imageformats\qgif.dll
Size 42KB
SHA256 50d4baa1db453301c19c091995fc7010206d7c97e59b21431baa5ef46a980219
MD5 9600a70636894f6a934f2a7f14d6ae0a
SHA1 d0a4e0dc7e4c61bebbd91579bf15d260c1fc7230
SHA512 6a80ca6c6b8ba3fcb1be5de6ea39bf6a75a6206266112bf23a81a249684b567e50babf257d011d0272d28d3d345c501d0f3e576f397a22abdea8b94abb3412bf
SSDEEP 768:dVRwrbBk3Xj+7yFZxK7+WHUgnNx1+MhYWeEJPxUo:d3wrbej+G3U7+lgnNx4MhYWLPxr
TLSH
T1E9136B56AB7844D2E513C678D9AA4D2BE935FA305B6297CF432181780F323D23E3C66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Plugins\Qt5\imageformats\qjpeg.dll
Size 447KB
SHA256 582054e0a0d49c5e5eb60e09200dc236ae69459fab9894f39a7521786c2be2be
MD5 81b6df8cd8de9db1eeca252958ea9d1a
SHA1 e1ec20f7e3575d9595d38ca2ad8b5c521c7eccb4
SHA512 8cf35cc5b7a11aa7e7cdbc9dc626c5429b8f59079590092343b9b207839d34c46c1b9a2a7bbd4c5e136fae71396a698474c432428edcdc809825f003b6919231
SSDEEP 12288:/WbtMZ30x6oT93baQIYnMEMI3dZfsskUn5BLvUMCk//RFEciccjxRPCA4cTJF/eN:/WbtMZ3y1B
TLSH
T133A4A243F2605C87C7E54474EE6AC1A6E794B81CC7FB46F779C1ABD97A226F0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Plugins\Qt5\platforms\qwindows.dll
Size 1.4MB
SHA256 117c9b304c2c8f6bc2fb466f9a8323591b9213d388252f142081a3e84d3b638e
MD5 e81f163cbeb67ec8414c2ab3b4119647
SHA1 065921e56683b78097e125da120420136258ec55
SHA512 6700efcdae09a40e1907f56ee4fe2308422ce53ef76a13c434d1cd57a77d934e0bd583c8d96ced0fd250fd0ba727be6d7258692a6bbe19053b88fb48d188b13d
SSDEEP 24576:BgRZTqnadX9G01nyfcdGxOsFciSKi3kmbe7WAiYdZs9UIrIqrtQQ:oTqnadXw0xyfcdN8JQbOWAE/
TLSH
T11F658D57A3A48298C26BC23DC65B8B17D7B1700503619BCF11A88E597F63BE3277EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Plugins\Qt5\styles\qwindowsvistastyle.dll
Size 144KB
SHA256 792ddc958db80cfdb7132acf698c02367c02e27cb69ed04b7f4f542b0478c157
MD5 04a9a47fa806c912a22af17577566709
SHA1 2caca306233ef324d63ef3fd04937793ff2af912
SHA512 47c39a2e91f0444bec87055aa1592bea6b0fe5fa1996b4c1f3d38a1928381d8a536522e5f86cea3fb7c655920ccee66c468a1d02af152750a41fbe46c9aad032
SSDEEP 3072:AYfJgCoOdX7MNwr80krOTmUMVa/MFWxmqd0SQV8lWTxf:RBBXwL2Sa/MFWxmqd0SQVwWV
TLSH
T12BE34C13326602C6C463D2B8C55F0916F7B3B05853228BEF0667CEA92F533E27E79A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Qt5Core.dll
Size 5.8MB
SHA256 096b9818d0c825487069deba7709b718e78a53053e22124b8e4c537deb72ace3
MD5 f6c86aacc6126b0d2f442c6a88e57efe
SHA1 df1b891829c3005d045e3ba048292789d5e28fef
SHA512 8cb4d26c069074e2c5dd734e5d1cd085afd0742795024460d80b9b0b333dc01b5df7c5691c03ece34be20956daa63184eb8f028c5e1c27814124937ecb7c8ed5
SSDEEP 98304:kFO2h8E4EwNrZJsv6tWKFdu9CsViJQ8xqfSgw2:kFO2h8E4lNdJsv6tWKFdu9CsVOQ8xqfZ
TLSH
T10C569D8776AB0250D0B7C23CCAA7811BE672B8018B219BCF125CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Qt5Gui.dll
Size 6.5MB
SHA256 946a04ae8bcb2c33fcb8c98ce7280dd4599974e85ffb86d9101e595c678ad6d2
MD5 3bce6b45e07a747167349865b4bf4ac3
SHA1 d24d4b87ed035f897009cf0b5b711e6485533d89
SHA512 d7584ddd3c6cfc9bda1ddddd02b883aa974309770a478f138202f7540ae92b38cdc658149e4e8b4e76eb0280ab066e096558bd942367c20c018f0f716c09d1e4
SSDEEP 49152:jWM6LDUqcvRiHZHjTpTFpFEOPVQJqguaf5Q/J+5mkU7vo3qsJAGUD4topffcLnZN:wLDFv/+RmFaqBpfkCgnAiYCHecbp
TLSH
T18F662886725A6262C977E17D8B4F052EE1F3785283428BC748199B480F737EA1B7FE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Qt5Network.dll
Size 1.0MB
SHA256 bed1870edbf831cd654f1e609cb2f785b5904f743a3a14c70a1d624f9a8e0172
MD5 bb5ede48a003b21b63bb134435c4f5ff
SHA1 55d6cd8128d80c81a5fea49b9de4daa21d4a5ccc
SHA512 e5e62f3fbf1a9c82c13d0c192c1033d2c55d08ad3830ebbbe3b9252d0721651225ac39ab92d863ecd11bba62ac1c51f86422ffab9fcef6f5f20fdcf847a33afc
SSDEEP 24576:XKF0Nu0gZmVnhqMpH6Q7pX9U2BgrExZ8Wv:bNu04mVnf6cgrQf
TLSH
T10A355B67B36103A5D46AC1B8CA8B8502F67270018B669BDF5639DF693F737E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Qt5Widgets.dll
Size 5.3MB
SHA256 24b14e67f6ae8a8b0191d68a3576300bd0ecc240ec9417e94f0f04dcc15a12f2
MD5 5309de309fb00a4be24bb465f0053455
SHA1 a14ef29356dac72d882f663a426f16ab29bc3529
SHA512 0cebf0e1560f2ef8b140bfd4fba2b3d7a562923f1b45c84eff41dd02b5ce04a9402c937cb4708d4623ab02a8991bbe6a31acc3cbd17fe2079130313f33daa1e7
SSDEEP 49152:T8LcMQHZ/gD0bTG5/Zh4w0I6Lr86R21sQGxTkaeduxK6PBZrGBqfjoWjmqYjYhIb:qPQg6CHliIYKsonnYhIv7uP3S6x9W
TLSH
T122466B57B3A54184C16BD238CF8B8613D6B2700487628BDF256A8E592F737E22E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\Qt5Xml.dll
Size 215KB
SHA256 7315e183382b81e65be9e3efb2ae151f6c95fad914a0dbfbf0400dfab868af48
MD5 a24011ba1cba9e517da2d89d530329cd
SHA1 867f44a65128db05ec1c2842a52b2752ba22346e
SHA512 76d7115d7b5f57a609cae61e768b28cc873f30a4aea46a2b385e9c8be1e5bba7c73ce84731708fe12f28d691b06ec6dbb8579f5eb9eca92ecf83d94e97b98620
SSDEEP 3072:4rZx2zOZ+kzW8MWXJBPlGyGv+RQxm7uFkgs7pkV9p7RM7jJWTx/:4FxyOZtLMWXJBPlBbaxp6kV9p7CVWl
TLSH
T18C245B4777258596E427C238CE5B881BE673B85017628BEF81548B792F33BD2B87E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\QtitanBase.dll
Size 1.1MB
SHA256 a942a4e48326f75182b01fa124b8a70ffcd7fd3ba699d25e68ffc866f599831f
MD5 90d98d189675cb1de1f4c48ac014ea17
SHA1 fce6acd5cb1dd23fd86d2cc50f76d453f51f6d0a
SHA512 a72b8fdb6dbf926c3455279e528d42c2a5370a04d92f5c0ee375baea09fc2e4d6912b2a6b9df66130abbefd8155bdd1659ceb000173d4c2e3fd9f672be0f09eb
SSDEEP 24576:s3nRLlUv+otWr8wY6S8dtuTbwQOtovsM2:sXXUvNdwVu/UqvsM2
TLSH
T18445AF4B33964352D16BC278C69F8114F07734119B4286EF9A2BFE291E333E5387B6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\QtitanDocking.dll
Size 617KB
SHA256 8cd4b42f9dd1a62fa2388545b0bdf4ff57dbcfbcb17df3686a29cba352e4baa1
MD5 2fe94993b771824f08666ec317781530
SHA1 a4d6eabcb21da7582149ddbda9597f2c99cbdc51
SHA512 d679dbbb502a78b10de517dbf57733233da027dbf0337d4566dfd44e017ab0c20fc09f57394ed38d3c9dedeb8d4516edf6b389788075f33e1c04608198a01902
SSDEEP 6144:7OxoA1awXD+sLxt7MGeOjPgs2ChTcGwoBK1uSATaBnf64WIAux8+9sBWBVhglMS3:7SoESsLrMJObz2A41upWWsHs+e
TLSH
T1F1D45B4B72A80291D067D138CA6BC52AE4B37841435286EF7716DA2D6F33FE13A3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanRibbon.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\QtitanRibbon.dll
Size 3.1MB
SHA256 0c3bd840fa3fa483fba5289d8679dc1577894fa08fc38978bfa3de8061194522
MD5 2449f928b2ca35a38ab1e738113a2d44
SHA1 4b6387178d1438fc9d7b2a380893e2e907c62092
SHA512 8359560e40e50a64025535d7995519cd910f173e9ac9006ce28ba8e6655c23b650aa6e754bb4a515b5f8ff505be35fdaf2cc4d113f22630e4151cb930e74e830
SSDEEP 49152:3rTyqWLVyjq4LbhndL1ZsY0LUGGNVGvYEnCWzLn+XYtOcc/RotRNC7C7C7C7C7CS:3GLUjbLnL1ZsY0LUGTjCWzL+Ii
TLSH
T1F4E5CF8B77AA0298D2AEC13FD28B4155F5F7749A835396EB4926CD1A0F333E06C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\RobloxCrashHandler.exe
Size 11.7MB
SHA256 76e632db7a370154daf2f96ac7c3696783ea314b2fc1d413a4795e12e2afdf2a
MD5 70d930596ca35c5a5b0a9458b5bd3920
SHA1 79ce06f1726b684d12ec7d988e9ec52fb2b2c2a6
SHA512 036d158dc8ff38b9afd18978175bc011d66d579a95c28acf97389d26b40f4ab3baa92ecab111917416ca900d0c9b9772037a359d493e236316bc3ca6b4cee8ea
SSDEEP 196608:zyHHpCuVfH1AAb3eCq+h+n0gFQjghUBr6J:TuVtLOCmn0QQjnBY
TLSH
T15CC68D6AB2B800E8D4BBD17CC6469617E772741603709BDF1AA446FA1F63BE41E7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\libfbxsdk.dll
Size 9.7MB
SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
MD5 51d82c0e8ad65126413ed39246b5cf46
SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
TLSH
T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-71452ee9293e4e08\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3fe45df67d6156f5c573e2d5b5081617a05c16e4135ac86ff9af700b9eefa2ca
MD5 b8697b77f40e9df33ba53d0164b9a5de
SHA1 0e65e1f22536ce9c06c24173aec4bab3e86af125
SHA512 431cc456fa03015efec885056aab9178d7d888edfe30d79c85fc092544d1c140c56155701c78b61a70cfde54fb3d8e1f6975e8dded7f2ca52c2df90664601213
TLSH
T1B5E02B6ACC25AC2708FE471865584685EB51135F2B91954F363D5208CFB0B2A42CBCAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8367e7621ccc1f03ad2cdc2337f680973e94e1b4d4f8c2e9ac5776ad0a177dd4
MD5 771be06701e3780096690295fe90fd22
SHA1 c5af64ebe45daf4db7d26ba9a78cd64948b924bd
SHA512 427fae4576941ca923b4351554aab6715b2da03e91d1e337da0dd2a67979dda42aeaa76d0b873225c45aa661614b4513de594f10cd0245165c35e2576fb3f190
TLSH
T14B414273D9DD2801DFA8DD75BF863E49E7A1D4B83573C3271E42914BA963AE204434A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 41877a5220bd4575c70aa5016d72f379f7e4bd3b980cd2611844e8dc7c649d61
MD5 2e757cecc91ccb22c02370cfd6139a45
SHA1 f9904b13bd9d8ee601ff90ba228abdf3467845d6
SHA512 e96815c0e74f83bda87a1531965ecc3ec0460d06a62451317685c4684d76107ce290d89b75f7de3489ecf1fc01fae7de6f77eb560f3d79ffbb1d9b6330d2c7a8
SSDEEP 192:D39Y8iaay7wCx6/aqXDNP+aPifPuRvSNHB1juTzHYH3K:D39Y8iaay7wCx6/aqXDNGa6fWRqNHXj+
TLSH
T143E18AF7C3E4852D890156F8AB156F1FCE2D1A24431C3866C9E4BF1BA3E2871E21169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d5177dae2c8d3a1efc5e5a1ae485d6936b55a4ac24f0fa1c6e6fb8406f70208d
MD5 ac9da1685af6822622a3b244884cf270
SHA1 07d7304e2384b60e1f5bbfe752959cb02e13a017
SHA512 ad01c9a6d9a4160997977a175eb275f1a00ebb2a59b119f84877cb84568077705f9788277ef21aaaa55c4f44f01db6ca7cb391afd0ffe6ba9cf7d3eb0d91d435
SSDEEP 192:fRJcBzdH/vhtiNT8pvokv7spAPRp22mdav9wHsb+WNzP8b4zg2fg2qeYsVyIsnA4:fRJmzdfvyVAYUX//Kw472Y2AI8
TLSH
T1A252D72EB924693B5CDBC229FD62BB17D7F5102122C42E84F6FC892C56DB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63f2e25649d74f2a76be7467b3badb96ea8e9aa8353e7bf6adf2acd683961f87
MD5 8dfe2d4e4f17e07df7601b90fb139afd
SHA1 39da921a5a5802ed7fcf426f8993a22ae53eb519
SHA512 473883456c185d58ccb98bb0fdc4ba9cb5650ab12522f5748e869a7e8067e6195bb9b9aad4522d5de012161f22ef29d5e50f0441994799749ebab8dc6abe9aa2
SSDEEP 192:fRJcBzRH/vhtiNT8pvokv7spAPRp22mdav9wHsb+WNzP8buO9+zg27Vg2qeYNVyr:fRJmzRfvyVAYUX//Kw49B27u2Abe
TLSH
T14952C72EB924693B5CDBC229F966BB17D7F5102122C42E84F6FC8D1C56EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b7b35d2a2f0cea323a0257cf8ad55c64bfe124fc0b55613a527b7ec756d9279a
MD5 23c956bc035cb638dcfb844b93f46ecb
SHA1 51849bd8f0a1898298058cef3f87d7587cdc4f77
SHA512 4bff6aa285901ee1ca68619bb8a2a58437f6b1915d115be39332730df4da3d6a004d752597e7f01f423afe3705fc2c3d2ac6bc80e8dc3bfd69216c41305c632b
SSDEEP 192:fRwcBzRH/vhtiNT8pvo0v7spAPRp22mdav9wHsb+WNzP8buO9+zg27Vg2qeYNVyr:fRwmzRfvyVwYUX//Kw49B27u2Abe
TLSH
T17652C72EB924693B5CDBC229F966BB17D3F5102122C42E84F6FC8D1C56EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 19409ea54067cd3e37a4b04e08bef370cdfc8da8a093cb22aa115c418c011ec1
MD5 d9cd7ac19e456926689fec7de44053be
SHA1 d90063894a27fc3e306865b28b3cea207f547497
SHA512 db52e44dc4693365a44356cf4cbe277eb95f57a73ccf7b0b5a9a1a5843cd165ec91091f21c328736dc1a62fba6f2f8ed9aa852c531bd12e34f484022fa748903
TLSH
T19CB01220C4435781C48202B0164A2CC8B1245F11B70A170153E06932C8251A1C124061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cdab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cdab.TMP
Size 96B
SHA256 9c7e87fec2639c4d84444e4f5ff11a45a03cab755bb17baeaaf17394cc66daac
MD5 b7f051cf150e84213338e41a7d23aee7
SHA1 3896f3e6fc471616189939b4c9d04ca07de8084f
SHA512 7be3f9b8b3fc8cc161939c50ad2043b0d083b165d79f7ac4877cade23762b674f5c33c28bf30cb4c4ea84862d3c26227f1063106276b7cb6b8e1e4bedd9fcd63
TLSH
T1C1B00255D1837212C08303B035ED9AD8B9A4DFB5D703221297E51AEFDC25AB58665260
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 306KB
SHA256 b0b43e13fcd2b94559e55ba438828a8f3c39750a69797e92dde527f019643653
MD5 73b2192507084ecfe81ccc79a45918c5
SHA1 61efb73b8a3b66650a18a6eea481f3e883b54b5a
SHA512 d71d6ce93e95a477ff2fac37a895e75f5895da5c085612e4a3aaeb230c2aeb670bfb4a5a73d02445e751d0415d2a2f088aa1dd4531ce0c12a60467bf23b94467
SSDEEP 6144:fWbckpK/Y2WL7LAd0ZqyPvvm7Rkm1tYpBeh2BAo1:fWbH2WU0C9oBGcAo1
TLSH
T1DA641327AD69647E04BAFF1E70492A1F0EF14721CD58DACAFAE03F84B2DB5891D45930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e41cb8581455aa18a44ed10b328eade4aedb26ec29c8a799deb2a901531ce982
MD5 a258f7f070168e852df54ff4085531dc
SHA1 8fa10cf4cbbfc5829fa4f9690a1cc07e284bbe7b
SHA512 829a9e2eb8f9a26a481b96a70d7a63ea1b687f756df3957c5d68b1f87bd4fbd9a4a8560356fdac7aff8bc184c89cb9eb3807b8cb0f52ce400a8fd5ffccc50e43
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:zm7Rkm1tYpBeh2BAoK
TLSH
T15FC3123B5D65E8779979A70EB08E0B1F1EF149A2D920DE92C8D86A0477FA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 e55388b81820d78ce3c8dc4b3ff380781e47a9bdfb1d4c584bec78224023b48d
MD5 1f4a8d0c3d2a28098996de43e5b2aecf
SHA1 5145e6ca2e9b451ebd65e28009b835dfa923f02e
SHA512 a2120a8b2ff9f9e35e6369fe2ffe0c15c9fa6cd430407ce7dd249370076fdad92e7004281b4dc887ffba50ba64c4a160a539db5949295583e4de7ecd200a6b3d
SSDEEP 6144:2Y2WL7LAd0ZqyPvvm7Rkm1tYpBeh2BAo1:p2WU0C9oBGcAo1
TLSH
T1393413239DA5A43A003BDF1A748E0A5F0DF24D51CD6CDFE6D9D02F4472EE6882E45A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 125e1ebed62e11d48b01c5ecebe7cdc1b50fe4ea3ffc4d3deb23da2decb0d703
MD5 e7b4d3a07d491ffb3cac3bf37db5b2e8
SHA1 9af6506a3b7baecbbeca9f1f44ab9e7ab5d7a6c1
SHA512 ec75f0ea4cf6b63fe39cc245a9df23890b9d1e0a02c93c1ba3b8e661bb197c488b22e023a79395f1fd17899b17f4d9f0b0fa753b0dd5b37c9c54ca6437db1211
SSDEEP 6144:/EY2WL7LAd0ZqyPvvm7Rkm1tYpBeh2BAo1:/2WU0C9oBGcAo1
TLSH
T10A3412339DA5683A047BEF1E704E161E0DF14A52CE6CDEDAE9D43F4472DE5882D45930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7f918f4bdeb2e2877592993da32ac976399dda15b52324e61d46d6c7ef066729
MD5 c28de3e068a86ce7b852354920a2e73c
SHA1 dfed932a914abd3a2d138be58d9fe852ad7d7ba8
SHA512 3950673a06dda16ba717d73c994a4389564f5ca665b001927d9c9d30f28d0ff5a007cceb8a7293b7fe794138095e99bce27bdbec03a301a3465ec69341eaa40b
SSDEEP 6144:pY2WL7LAd0ZqyPvvm7Rkm1tYpBeh2BAo1:y2WU0C9oBGcAo1
TLSH
T1833423239DA5A43A003BEF1A748E0A4E0DF24D51CD6CDFE6D9D02F4472EE6882E45A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 504ff246c99f57be708b5d3042ec83241dda7e67a313fa44558712cb64c71a54
MD5 78146c92e3a875f74cdfb4e8c2228385
SHA1 b52a6980df49d09d2c60a0cae832bdb1c90c0f8c
SHA512 0a01403d5145ee66289f842c36318d7106a50ca0d9198879ee7a53a5a20e92346ebfa6ba59f4e4b65490f451bba7b35c432b1ebc38265f1d6be83e9017bfa1ee
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 20eae7bb57070e7bc9831d52e0d8c0517b69e34bab7a83463b0df1c541075226
MD5 40ee404c650f2fbcdb88af6fed6778be
SHA1 39e1aceb52c5b33d3135211bd37c055a90552de0
SHA512 2d70d6915d9e15b4e66e2b2f2c4ee66d6ee6667e0d71f3348634a0fad6ccc168eafa7a3efff15de5267f1fd1c879515eccc6adc0fc05822c1c6b4ac8caebb1df
TLSH
T158D0121232014578C0102A730012E14C0801D11F41054000743CA6BE2F040D00E03446
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d94de5e5ace6aa45a4d8b69616a3cd3a043f671732a688143081fa2c4ae50c35
MD5 9f91c30d9d9b28790eb3d01d0c6b6fe2
SHA1 5375905fc1f6fdb338040028f15210938753db7f
SHA512 23f11ab81a537633d35da50248e5ce98585ba76cbd08ab54a56fff39187e58cf395b1e458343f452fe38d39f8c2998c439444d68c3efcd2a5585942343086ef7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3d86a5a2ccb8b0d000b47143099fece0b5ce55b3d5e46ebd04883efae8a32d93
MD5 b70ddfb707d135c99b8fa67e3420f089
SHA1 f3d770b56ff3c2b9856724f899b2e0b2626b5e57
SHA512 e10c0dd66353677a5ddb3ea2d58d67ab82a0a81e5830cf6589dff40003775be928f7a4632c00bd4a3ab62efa625e4d5476c63f24f29289cd9ecabb8bd28cf8d3
TLSH
T10E41F81689C5B031DF168C7AC9657C00A7E0E9410103EB97CD48A721D2573FE5CEE5B4
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

12e5008f-0773-4af1-8c5b-2f856f75850e.tmp

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\12e5008f-0773-4af1-8c5b-2f856f75850e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6d6bf780c47062a254dbffe831daa8b69e6c63382d6914f47f270dcff0effb63
MD5 e0552fc8124621e200be2f64d1caf369
SHA1 9890a2324eff2342ee191b27e3cd376ce6b3f417
SHA512 126cd155ec7f8e324ffb9012a94d5a955ced03420b14b9adddaccdd60fffc5b4d480947d8ccc63214b89e21c5d547ca2a39afba2a460a8423b1d78789218437c
TLSH
T1E4419C9BB2BFF25B20285D7B5E817C0AA5B6A4330751A8F4DE93D02DB0474FB0726062
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 eb24268285e022334bf064965034dc3fe97765b328bcd9b11a3cfc061dea2c86
MD5 4399178356394de2fc435c5e73e022d5
SHA1 ab6c870509043aa4eb32901875870ba21a8d57b1
SHA512 db7207d1e59c0482aa24189a41c3639ff2ee680f3b819a150b32586ca2b09c0556ce40be7cee1c21a3c665ae2ef0850981eace6a86ab6af981250a5ee0fb90da
TLSH
T19F41809BF2BFF25B20285D7B5E857C0AA5B5A4330751A8F5DE93C02DB0474FB4726062
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a22fa.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a22fa.TMP
Size 1KB
SHA256 e7a25f4481a1a4c16ee73b7a4ed732f7446542180b4f48364487176c7260a611
MD5 4ea4bccd49e8956fe17b7ba9a61c61ff
SHA1 b11583fb9cc16aa8b2492f280f0a807fb5123f8b
SHA512 a67f197414ef50c093dad28cafaa3d5e777e3056d28cc95d02ba59e4c327a9b159539817f908aa0fe0b2c1bdf780bc0c0b59cf824ea852a4dd4f08810239456c
TLSH
T1DC418EA7B1BFF25B20285D7B9E857C0995B6E4330751A8F5DE93D02DB04B4FB0726062
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 96f7658251bf25866ce4af6e6e5d83e61f6cf353c7c67f8f2115f97f8f095cd8
MD5 c8a644ed10f9f896d7dc3df90890d4a1
SHA1 733808472aaa8155383def0f817a0d40e8fd46c6
SHA512 616d87b521d53f1575802825989bc13bdac16e9e8844c0c8d2fc38d12d6be44b5a71b4ffef384f3ae6b82354f95ba09bb18fbd70d614adec8a0679814512c7c8
SSDEEP 192:stgQTP5fwZ8pa2Z/S+WiTB/wVo488ftMC:stLt3//VpwfyC
TLSH
T134D186035E789A774CC7E2197E35BB12D2FA202266D00E98EBFD861C09D66DD6307C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f562.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe59f562.TMP
Size 5KB
SHA256 3b459f7eac658d1d382627b65d47813b9a6fbfb9c9a7ef83ed39e1a748a51159
MD5 903fc4f2dd0b05ae7953534f4127fe2a
SHA1 2930b4694c1ee2db8ee740d51a6f5718d9074b43
SHA512 6721030311c282cad89d31c1971042eaa2c3f980434958511b1c88cb7a7d6faa71166b175c40d15707710d88655fe2eee354a80a91e79743dfe1449e653efeb4
SSDEEP 96:st952sPf+b9NV0/dZ8i0oEdklm/7qx+WVHMSm+uecadQjJ+gHRZKEB:st9pUQZ8pFb/S+Wi8d0xRZK8
TLSH
T192C1A6035E28697B4CC7E25DBE36BF02D2FA102266D45E58FAFD861C09DA5CD520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 5ec4a8e6e379e12056b9286157a771a5f457f0ec966f8d479618966775cb29da
MD5 8be7e9eb082452ed719b869c31919120
SHA1 ab6022a82af225fc340654acac2156b39222b2c2
SHA512 398c6ad32beb7b7a82654d6db1642bd7a93639fa1ac57968ca8df3f032df755726f78bd117bf42e7bd11346a175e42d076735701e8cd70d1da320e82c5c55ff8
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 1KB
SHA256 cfbee25a7d9e04bb04b236a58446dbc7f9010b92f1c8a71f51c7f05270a90da8
MD5 8cfe77e6e971b5007ea70830a870f9d3
SHA1 164b2057849264bb108fcd2e0fa79d3bfcfb6702
SHA512 6ad6ef35dca5105d3862ceb96465006fb4425f5e0dbbc532ec2a5310a4068fe5aae6b27220a1f7e629d54851f2fa558074e53a7edb944816e6933250dd136152
TLSH
T1E73140B3E4901F726C529685B3577A03AD61507AC2118F48E5DE4F0D03E7ADED636D32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 2KB
SHA256 67977300f6dc144982fb098794b0c19ea08340d22928351da5374f3cbc736218
MD5 7b80d4a9e9ac68b22e9484d44299e05e
SHA1 fb664ad24489a9529ec408df446656e66b0ec437
SHA512 d3808155f2f3f3ba8a3fa6de8f6ca43b17d29de9cb2dc7c9fc49710090a0b1c3d759d5fd5d7a784ce86aa2ed6ee8afccfd0849171f68ce1b3554f1485f2184d0
TLSH
T143517373B8049B7789A3CA84BA5B3F12ED755066DA512F54D9DE0F0C02DBADE1312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 a882c005c09a198e43eed30897ca023d5c27ca73e528ebdf45a33bae6f9b9611
MD5 0840b3f4a1490a5ad27abd56a10221a9
SHA1 969727a4306113d1e62875208d4db449cceec233
SHA512 a2c06b40b96c522203581503a8e4cc794c1acf422f1794d1a74b1fa1223a47d251e1f80bee123d3965bbb2bb2b74a4b8624ddcd0139496495402a3147cb2352b
TLSH
T1BE71A423B864AB774DA3C980B9863B02BAA15037D6813F98D9ED0F0D02DB7DD1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 16KB
SHA256 53ecd11385551008138806ac8cc112885aee164ad6a023a39af3e820827b2026
MD5 94ed3907a64bd841cf0f10005b13a802
SHA1 f1cbfb8f67b31792ccf1727c87ea211458b664c1
SHA512 28045bda1bfe83ccbffba7b6cc0d47b67521630767bfa1fddc8cd890244749f8fac4ce8b9c9142fd75293ae6f99d234b9a052f48ae981a01f02e97cf2901a169
SSDEEP 192:z7BsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNbyA66oiDUS:zFsrv+89zHqlDNP9oid6NbfRYyjjAVN+
TLSH
T1A0729E33A12C97775CF2D444B58B6A077FB450A696C10BA4D99A0F8E43DF5DE2312D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59c9fd.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe59c9fd.TMP
Size 1KB
SHA256 985eae153eb0db5caf0005e9e07c82a10a78537b5477f10ba4a16b9cb4654779
MD5 6fa749e39de940e72cd80a6209ac5910
SHA1 eb71a5cb26b586824ead44d0f4faa60315f966b8
SHA512 4fcbe7a457b58b4a9426316fd70890b484cbd05da64f91153062eb4051626879d0db3dbccbf6d90b3d730250ea9f0e38d5dbe85655fbd7709e38ab0f0d515dc2
TLSH
T19F214073E4845BB259528884B353BB067DA0507AC2108F08E5DE4B0D03EB6DEC732C73
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxStudioInstaller_EB438.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_EB438.log
Size 7KB
SHA256 6fa4183932fe1826216088801c71e041e0e554a4b8e3c3efa02d9966d18faff6
MD5 f2ae322df1f83e3ac7c5cd5fd1f5988a
SHA1 465cecb02a58b1cac211e9b77aaad11fc567fa88
SHA512 73d1f678d1c774392a2949f89d5a9e40fa4032f6633e1ce839dfcc0faf8f1c8b94ffb61e555adf916a3c9e301ea3f0436437e6e5ad6782be2955d6da25879ad5
SSDEEP 96:K/LWwGykSB215Y8J+EzEH8zuUSwOhI12RSjr6/zl/Zr+CthgMpr02:mLWwGVY8JxQy22ahgMprH
TLSH
T134E1E11DC6B10134324E114F97AA9FBEDF077D1061A6E3F0B5DF628EB3852D46AC5A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 45ba0d6e6b74cbaa905b19d9d915d799cda42b06c5d29ba7e23526b7aa081ddb
MD5 fb52df0606e0102df0d6b4df166109a1
SHA1 b5b7d03aedbfaf231bd75f2710ca8e0e126832ec
SHA512 05113e853e56227c52c5e4f0c546582f5da5153817b01e40a58e468de6de0ecd51a46b87fcd7689dcba828f6d4a6742dcb1a60173f1934d85a22729e90b8959a
TLSH
T15EA002C58C9C0C17C76B177876D04AE411D185B6548DD0A7C47E6280B9628EAADAC0D5
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxStudioInstaller.exe

Path C:\Users\Admin\Downloads\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 076142b2572c2ad93c530b4af725a91166cad4b0869491b31520a541e743cc30
MD5 d6dcb0a39aacf225422e1de4935eb706
SHA1 2f024fd7f8c4fdebb2c2ac7595c16426e8866807
SHA512 1c7879a5e4e6fa41c311bcf07d4e1837c82e93def4b21df439c123594d8194bbb32d140eb27580048d9de428ee44be32a9f36a532a9a122375fa04e12d47f087
SSDEEP 196608:630Fynya3KC2LSVugnumsxEyalMFyUzV9sBGbi:653KEumsxfayFyaV9Ze
TLSH
T1B9A6BF22B900C032E8D200B296BD9FBB997D5A344B3994E3A7D41DBD59305D33B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-563-0x00007FF7D2720000-0x00007FF7D3720000-memory.dmp

Download

memory/1668-1207-0x0000028A5FEE0000-0x0000028A600AE000-memory.dmp

Download

memory/1668-562-0x00007FFC4DAD0000-0x00007FFC4E01C000-memory.dmp

Download

memory/1668-674-0x0000028A76A90000-0x0000028A76E90000-memory.dmp

Download

memory/5368-1314-0x000002128DA00000-0x000002128DB15000-memory.dmp

Download

memory/5368-700-0x00007FFC73C10000-0x00007FFC73C11000-memory.dmp

Download

memory/5476-761-0x00007FFC72DE0000-0x00007FFC72DE1000-memory.dmp

Download

memory/5476-766-0x00007FFC72860000-0x00007FFC72861000-memory.dmp

Download

memory/5984-807-0x00007FFC73C10000-0x00007FFC73C11000-memory.dmp

Download