Analysis
- user interaction
yes - max time kernel
1799s - max time network
1791s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
roblox-studio-1-6-0-7330989.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
roblox-studio-1-6-0-7330989.exe
Resource
win11ltsc2024-20260709-en
General
- Target roblox-studio-1-6-0-7330989.exe
- Size 9.7MB
- Sample260809-t9z5jasbjd
- SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
- MD5 a5f81d2116ef82c09ef6390931e3e516
- SHA1 41bf5bc16a0461378735c770328db29958f219d5
- SHA512 ea06f9a9da51c5f9121a15fe82571cdbf88e49bd142719d3217436191f7d10c6c1c99b197f7a0150b1d0200a529f0db5bb82046d39f3f178a5ab4cea9cabf121
- SSDEEP 196608:Zjj7ZtY620KULyMqDzi1msxtpEdDHTXom5KRZck3T:ZDZKli1msxtGFzXom5p8T
- TLSH T1B3A6BF22B900C032E8D100B2A6BD6FF6993D99341B7954E3A7D45DBD5A305D33B3AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 2 IoCs
pid Process 2128 RobloxStudioBeta.exe 2388 RobloxCrashHandler.exe - Loads dropped DLL 29 IoCs
pid Process 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2388 RobloxCrashHandler.exe 2388 RobloxCrashHandler.exe 2388 RobloxCrashHandler.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA roblox-studio-1-6-0-7330989.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 319 raw.githubusercontent.com 324 raw.githubusercontent.com 375 raw.githubusercontent.com - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: RobloxStudioBeta.exe File opened (read-only) \??\F: RobloxStudioBeta.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe -
pid Process 712 GameBarPresenceWriter.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\ui\Controls\DefaultController\ButtonR1.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Resources\Constants.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Navigation\Dark\Standard\ScrollbarTriangle.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateAccurateBoundingBox.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Light\Standard\RibbonPauseClientSmall.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\ui\Vehicle\SpeedBarBKG.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\CollisionMatchers2D\CollisionMatchers2D\leftOf.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validationFolders\AttachmentOrientationsValid\AttachmentOrientationsValid.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\ImageSet\Validator\validateImage.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Lua\AssetManager\Dark\Large\PackagesFolder.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Lua\TerrainEditor\Light\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\Trail.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\CollisionGroups.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\Markdown\Markdown\Markdown.storybook.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\ServiceContractsProto\ServiceContractsProto\roblox\apppageplatform\shared\v1beta1\marketplace_asset_data.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\ultimate-list\ultimate-list\Renderers\init.luau roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\GenerativeAI\Dark\Large\ThumbsDownOutline.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\GenerativeAI\Light\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\PlayerScripts\StarterPlayerScripts\PlayerModule.module\CameraModule\VehicleCamera\VehicleCameraCore.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\Promise\Promise\init.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\ui\dialog_white.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\PlayerScripts\StarterPlayerScripts\PlayerModule.module\ControlModule\ClickToMoveDisplay.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\StudioContent\textures\AvatarSettings\Light\consistent-lightx1.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Lua\StyleEditor\Light\Standard\StyleSheetEnumerator.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Navigation\Light\Standard\Collapse.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\RibbonUniversalConstraint.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\BuiltInStandalonePlugins\Optimized_Embedded_Signature\DirectionalCurveEditor.rbxm roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\Emote\.robloxrc roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\Flags\FIntVRBottomBarPositionOffsetDepthNumber.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\AvatarEditorPrompts\Thunks\SignalCreateOutfitPermissionDenied.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\Flags\GetFFlagEnableNewInviteSendEndpoint.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\__testUtils__\genFuzzStrings.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\GraphqlTag\LuauPolyfill.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\NetworkingUsers\NetworkingUsers\networkRequests\createSetDisplayName.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\Utils\Utils\getResolversFromSchema.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Cursors\Light\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\FaceControlsEditor\checkbox_checked.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\scripts\CoreScripts\Modules\EmotesMenu\Actions\ShowMenu.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\textures\ui\LuaChat\graphic\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Navigation\Enum\RippleState.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\particles\sparkles_main.dds roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\ui\MenuBar\icon_menu.png roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\Math\Math\clz32.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\textures\ui\Controls\[email protected] roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-31ab8d40-1.1.107\RbxDesignFoundations\tokens\Schema\Validators\validateGlobal.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateMeshPartBodyPart.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validationFolders\SurfaceAppearanceTexturesBounded\SurfaceAppearanceTexturesBounded.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UsageTracker.lua roblox-studio-1-6-0-7330989.exe File created C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\content\studio_svg_textures\Shared\Navigation\Dark\Standard\[email protected] roblox-studio-1-6-0-7330989.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_660193638\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_124098540\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_124098540\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1567192491\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_209568519\crs.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_209568519\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_209568519\kp_pinslist.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_209568519\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_660193638\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_124098540\protocols.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_209568519\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_981377609\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_981377609\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1567192491\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1567192491\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_926631865\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_660193638\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_660193638\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1567192491\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1567192491\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_926631865\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_926631865\manifest.fingerprint msedgewebview2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roblox-studio-1-6-0-7330989.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS roblox-studio-1-6-0-7330989.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer roblox-studio-1-6-0-7330989.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxCrashHandler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxCrashHandler.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth roblox-studio-1-6-0-7330989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio roblox-studio-1-6-0-7330989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" roblox-studio-1-6-0-7330989.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b2d03e4efaa04174\\RobloxStudioBeta.exe,0" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place\ShellNew roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-b2d03e4efaa04174" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{AAC3F275-38D0-417A-8460-43B0BB5C056E} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b2d03e4efaa04174\\RobloxStudioBeta.exe" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b2d03e4efaa04174\\RobloxStudioBeta.exe\" \"%1\"" roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{F5C57AC6-F647-4956-B089-B7584D7960E3} msedgewebview2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b2d03e4efaa04174\\RobloxStudioBeta.exe\" %1" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{FE91EB6A-7BCC-4B1E-B424-9493FCEFB57F} svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-b2d03e4efaa04174" roblox-studio-1-6-0-7330989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{84028813-FA32-4354-B88B-84D615D27257} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b2d03e4efaa04174\\RobloxStudioBeta.exe" roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew roblox-studio-1-6-0-7330989.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2128 RobloxStudioBeta.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 roblox-studio-1-6-0-7330989.exe 4696 roblox-studio-1-6-0-7330989.exe 4696 roblox-studio-1-6-0-7330989.exe 4696 roblox-studio-1-6-0-7330989.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 4680 msedgewebview2.exe 4680 msedgewebview2.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2128 RobloxStudioBeta.exe 3848 Taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3480 msedgewebview2.exe 3480 msedgewebview2.exe 3480 msedgewebview2.exe 2816 msedgewebview2.exe 2816 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 4316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4316 AUDIODG.EXE Token: SeDebugPrivilege 3848 Taskmgr.exe Token: SeSystemProfilePrivilege 3848 Taskmgr.exe Token: SeCreateGlobalPrivilege 3848 Taskmgr.exe Token: SeIncBasePriorityPrivilege 3848 Taskmgr.exe Token: 33 3848 Taskmgr.exe Token: SeIncBasePriorityPrivilege 3848 Taskmgr.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe Token: SeShutdownPrivilege 5704 explorer.exe Token: SeCreatePagefilePrivilege 5704 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe - Suspicious use of SetWindowsHookEx 35 IoCs
pid Process 2128 RobloxStudioBeta.exe 3728 OpenWith.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 3848 Taskmgr.exe 1964 StartMenuExperienceHost.exe 4104 SearchHost.exe 5704 explorer.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe 2128 RobloxStudioBeta.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2128 4696 roblox-studio-1-6-0-7330989.exe 91 PID 2128 wrote to memory of 2388 2128 RobloxStudioBeta.exe 92 PID 2128 wrote to memory of 3480 2128 RobloxStudioBeta.exe 95 PID 3480 wrote to memory of 5572 3480 msedgewebview2.exe 96 PID 3480 wrote to memory of 5880 3480 msedgewebview2.exe 97 PID 3480 wrote to memory of 5880 3480 msedgewebview2.exe 97 PID 3480 wrote to memory of 5880 3480 msedgewebview2.exe 97 PID 3480 wrote to memory of 5880 3480 msedgewebview2.exe 97 PID 3480 wrote to memory of 6100 3480 msedgewebview2.exe 98 PID 3480 wrote to memory of 5948 3480 msedgewebview2.exe 99 PID 3480 wrote to memory of 5948 3480 msedgewebview2.exe 99 PID 3480 wrote to memory of 5948 3480 msedgewebview2.exe 99 PID 3480 wrote to memory of 4396 3480 msedgewebview2.exe 100 PID 3480 wrote to memory of 4396 3480 msedgewebview2.exe 100 PID 3480 wrote to memory of 4396 3480 msedgewebview2.exe 100 PID 3480 wrote to memory of 4396 3480 msedgewebview2.exe 100 PID 3480 wrote to memory of 4396 3480 msedgewebview2.exe 100 PID 3480 wrote to memory of 5352 3480 msedgewebview2.exe 101 PID 3480 wrote to memory of 5352 3480 msedgewebview2.exe 101 PID 3480 wrote to memory of 5352 3480 msedgewebview2.exe 101 PID 3480 wrote to memory of 5352 3480 msedgewebview2.exe 101 PID 3480 wrote to memory of 5352 3480 msedgewebview2.exe 101 PID 3480 wrote to memory of 4780 3480 msedgewebview2.exe 102 PID 3480 wrote to memory of 4780 3480 msedgewebview2.exe 102 PID 3480 wrote to memory of 4780 3480 msedgewebview2.exe 102 PID 3480 wrote to memory of 4780 3480 msedgewebview2.exe 102 PID 3480 wrote to memory of 4780 3480 msedgewebview2.exe 102 PID 3480 wrote to memory of 108 3480 msedgewebview2.exe 107 PID 3480 wrote to memory of 108 3480 msedgewebview2.exe 107 PID 3480 wrote to memory of 108 3480 msedgewebview2.exe 107 PID 3480 wrote to memory of 4864 3480 msedgewebview2.exe 108 PID 3480 wrote to memory of 4864 3480 msedgewebview2.exe 108 PID 3480 wrote to memory of 4864 3480 msedgewebview2.exe 108 PID 3480 wrote to memory of 4680 3480 msedgewebview2.exe 117 PID 3480 wrote to memory of 2956 3480 msedgewebview2.exe 118 PID 3480 wrote to memory of 2956 3480 msedgewebview2.exe 118 PID 3480 wrote to memory of 2956 3480 msedgewebview2.exe 118 PID 3480 wrote to memory of 3100 3480 msedgewebview2.exe 120 PID 3480 wrote to memory of 3100 3480 msedgewebview2.exe 120 PID 3480 wrote to memory of 3100 3480 msedgewebview2.exe 120 PID 3480 wrote to memory of 2308 3480 msedgewebview2.exe 121 PID 3480 wrote to memory of 3040 3480 msedgewebview2.exe 122 PID 3480 wrote to memory of 3040 3480 msedgewebview2.exe 122 PID 3480 wrote to memory of 3040 3480 msedgewebview2.exe 122 PID 2128 wrote to memory of 2816 2128 RobloxStudioBeta.exe 123 PID 2816 wrote to memory of 5316 2816 msedgewebview2.exe 124 PID 2816 wrote to memory of 4592 2816 msedgewebview2.exe 125 PID 2816 wrote to memory of 4592 2816 msedgewebview2.exe 125 PID 2816 wrote to memory of 4592 2816 msedgewebview2.exe 125 PID 2816 wrote to memory of 4592 2816 msedgewebview2.exe 125 PID 2816 wrote to memory of 3580 2816 msedgewebview2.exe 126 PID 2816 wrote to memory of 4016 2816 msedgewebview2.exe 127 PID 2816 wrote to memory of 4016 2816 msedgewebview2.exe 127 PID 2816 wrote to memory of 4016 2816 msedgewebview2.exe 127 PID 2816 wrote to memory of 1844 2816 msedgewebview2.exe 128 PID 2816 wrote to memory of 1844 2816 msedgewebview2.exe 128 PID 2816 wrote to memory of 1844 2816 msedgewebview2.exe 128 PID 2816 wrote to memory of 1844 2816 msedgewebview2.exe 128 PID 2816 wrote to memory of 1844 2816 msedgewebview2.exe 128 PID 2356 wrote to memory of 3848 2356 launchtm.exe 132 PID 2816 wrote to memory of 3260 2816 msedgewebview2.exe 133 PID 2816 wrote to memory of 3260 2816 msedgewebview2.exe 133 PID 2816 wrote to memory of 3260 2816 msedgewebview2.exe 133 PID 6064 wrote to memory of 5704 6064 sihost.exe 139 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox-studio-1-6-0-7330989.exe"C:\Users\Admin\AppData\Local\Temp\roblox-studio-1-6-0-7330989.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 2128 --attachment=attachment_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260809T164830Z_Studio_B6B1C_last.log --attachment=attachment_log_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_csg3.log --attachment=attachment_log_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.733.0.7330989 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=6468eec5ddfa1510f06a43d039a72a6d9307e028 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.733.0.7330989 --annotation=UniqueId=6093277206441222486 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.733.0.7330989 --annotation=host_arch=x86_64 --initial-client-data=0x47c,0x480,0x484,0x458,0x490,0x7ff7cd704ed8,0x7ff7cd704ef0,0x7ff7cd704f083⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:2388
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2128.4496.4214148834737288925 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff862bc5fd8,0x7ff862bc5fe4,0x7ff862bc5ff04⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:5880
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:6100
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:5948
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3472 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4000 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3588 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:108
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4904 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4680
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4920 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4916 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4888 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵
- Modifies registry class
PID:2308
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4940 --field-trial-handle=1804,i,17160251986204988589,453616145633216327,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:3040
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2128.4496.13671859374086717859 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1a4,0x7ff862bc5fd8,0x7ff862bc5fe4,0x7ff862bc5ff04⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1860 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3580 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4872 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4832 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:14⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4500 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 733, 0, 7330989" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5024 --field-trial-handle=1864,i,16270640588366888364,14147755457611890482,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf4⤵PID:6736
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:5732
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:712
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:5624
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
PID:848
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5704
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1964
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3624
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\AppSettings.xml
- Size 144B
- SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
- MD5 431a6eb20932ec1c56682a1f60d231d3
- SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
- SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
- TLSH T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Plugins\Qt5\imageformats\qgif.dll
- Size 42KB
- SHA256 50d4baa1db453301c19c091995fc7010206d7c97e59b21431baa5ef46a980219
- MD5 9600a70636894f6a934f2a7f14d6ae0a
- SHA1 d0a4e0dc7e4c61bebbd91579bf15d260c1fc7230
- SHA512 6a80ca6c6b8ba3fcb1be5de6ea39bf6a75a6206266112bf23a81a249684b567e50babf257d011d0272d28d3d345c501d0f3e576f397a22abdea8b94abb3412bf
- SSDEEP 768:dVRwrbBk3Xj+7yFZxK7+WHUgnNx1+MhYWeEJPxUo:d3wrbej+G3U7+lgnNx4MhYWLPxr
- TLSH T1E9136B56AB7844D2E513C678D9AA4D2BE935FA305B6297CF432181780F323D23E3C66D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Plugins\Qt5\imageformats\qjpeg.dll
- Size 447KB
- SHA256 582054e0a0d49c5e5eb60e09200dc236ae69459fab9894f39a7521786c2be2be
- MD5 81b6df8cd8de9db1eeca252958ea9d1a
- SHA1 e1ec20f7e3575d9595d38ca2ad8b5c521c7eccb4
- SHA512 8cf35cc5b7a11aa7e7cdbc9dc626c5429b8f59079590092343b9b207839d34c46c1b9a2a7bbd4c5e136fae71396a698474c432428edcdc809825f003b6919231
- SSDEEP 12288:/WbtMZ30x6oT93baQIYnMEMI3dZfsskUn5BLvUMCk//RFEciccjxRPCA4cTJF/eN:/WbtMZ3y1B
- TLSH T133A4A243F2605C87C7E54474EE6AC1A6E794B81CC7FB46F779C1ABD97A226F0B829100
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Plugins\Qt5\platforms\qwindows.dll
- Size 1.4MB
- SHA256 117c9b304c2c8f6bc2fb466f9a8323591b9213d388252f142081a3e84d3b638e
- MD5 e81f163cbeb67ec8414c2ab3b4119647
- SHA1 065921e56683b78097e125da120420136258ec55
- SHA512 6700efcdae09a40e1907f56ee4fe2308422ce53ef76a13c434d1cd57a77d934e0bd583c8d96ced0fd250fd0ba727be6d7258692a6bbe19053b88fb48d188b13d
- SSDEEP 24576:BgRZTqnadX9G01nyfcdGxOsFciSKi3kmbe7WAiYdZs9UIrIqrtQQ:oTqnadXw0xyfcdN8JQbOWAE/
- TLSH T11F658D57A3A48298C26BC23DC65B8B17D7B1700503619BCF11A88E597F63BE3277EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Plugins\Qt5\styles\qwindowsvistastyle.dll
- Size 144KB
- SHA256 792ddc958db80cfdb7132acf698c02367c02e27cb69ed04b7f4f542b0478c157
- MD5 04a9a47fa806c912a22af17577566709
- SHA1 2caca306233ef324d63ef3fd04937793ff2af912
- SHA512 47c39a2e91f0444bec87055aa1592bea6b0fe5fa1996b4c1f3d38a1928381d8a536522e5f86cea3fb7c655920ccee66c468a1d02af152750a41fbe46c9aad032
- SSDEEP 3072:AYfJgCoOdX7MNwr80krOTmUMVa/MFWxmqd0SQV8lWTxf:RBBXwL2Sa/MFWxmqd0SQVwWV
- TLSH T12BE34C13326602C6C463D2B8C55F0916F7B3B05853228BEF0667CEA92F533E27E79A55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Qt5Core.dll
- Size 5.8MB
- SHA256 096b9818d0c825487069deba7709b718e78a53053e22124b8e4c537deb72ace3
- MD5 f6c86aacc6126b0d2f442c6a88e57efe
- SHA1 df1b891829c3005d045e3ba048292789d5e28fef
- SHA512 8cb4d26c069074e2c5dd734e5d1cd085afd0742795024460d80b9b0b333dc01b5df7c5691c03ece34be20956daa63184eb8f028c5e1c27814124937ecb7c8ed5
- SSDEEP 98304:kFO2h8E4EwNrZJsv6tWKFdu9CsViJQ8xqfSgw2:kFO2h8E4lNdJsv6tWKFdu9CsVOQ8xqfZ
- TLSH T10C569D8776AB0250D0B7C23CCAA7811BE672B8018B219BCF125CA7495EB77F1693F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Qt5Gui.dll
- Size 6.5MB
- SHA256 946a04ae8bcb2c33fcb8c98ce7280dd4599974e85ffb86d9101e595c678ad6d2
- MD5 3bce6b45e07a747167349865b4bf4ac3
- SHA1 d24d4b87ed035f897009cf0b5b711e6485533d89
- SHA512 d7584ddd3c6cfc9bda1ddddd02b883aa974309770a478f138202f7540ae92b38cdc658149e4e8b4e76eb0280ab066e096558bd942367c20c018f0f716c09d1e4
- SSDEEP 49152:jWM6LDUqcvRiHZHjTpTFpFEOPVQJqguaf5Q/J+5mkU7vo3qsJAGUD4topffcLnZN:wLDFv/+RmFaqBpfkCgnAiYCHecbp
- TLSH T18F662886725A6262C977E17D8B4F052EE1F3785283428BC748199B480F737EA1B7FE05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Qt5Network.dll
- Size 1.0MB
- SHA256 bed1870edbf831cd654f1e609cb2f785b5904f743a3a14c70a1d624f9a8e0172
- MD5 bb5ede48a003b21b63bb134435c4f5ff
- SHA1 55d6cd8128d80c81a5fea49b9de4daa21d4a5ccc
- SHA512 e5e62f3fbf1a9c82c13d0c192c1033d2c55d08ad3830ebbbe3b9252d0721651225ac39ab92d863ecd11bba62ac1c51f86422ffab9fcef6f5f20fdcf847a33afc
- SSDEEP 24576:XKF0Nu0gZmVnhqMpH6Q7pX9U2BgrExZ8Wv:bNu04mVnf6cgrQf
- TLSH T10A355B67B36103A5D46AC1B8CA8B8502F67270018B669BDF5639DF693F737E1263E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Qt5Widgets.dll
- Size 5.3MB
- SHA256 24b14e67f6ae8a8b0191d68a3576300bd0ecc240ec9417e94f0f04dcc15a12f2
- MD5 5309de309fb00a4be24bb465f0053455
- SHA1 a14ef29356dac72d882f663a426f16ab29bc3529
- SHA512 0cebf0e1560f2ef8b140bfd4fba2b3d7a562923f1b45c84eff41dd02b5ce04a9402c937cb4708d4623ab02a8991bbe6a31acc3cbd17fe2079130313f33daa1e7
- SSDEEP 49152:T8LcMQHZ/gD0bTG5/Zh4w0I6Lr86R21sQGxTkaeduxK6PBZrGBqfjoWjmqYjYhIb:qPQg6CHliIYKsonnYhIv7uP3S6x9W
- TLSH T122466B57B3A54184C16BD238CF8B8613D6B2700487628BDF256A8E592F737E22E7F705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\Qt5Xml.dll
- Size 215KB
- SHA256 7315e183382b81e65be9e3efb2ae151f6c95fad914a0dbfbf0400dfab868af48
- MD5 a24011ba1cba9e517da2d89d530329cd
- SHA1 867f44a65128db05ec1c2842a52b2752ba22346e
- SHA512 76d7115d7b5f57a609cae61e768b28cc873f30a4aea46a2b385e9c8be1e5bba7c73ce84731708fe12f28d691b06ec6dbb8579f5eb9eca92ecf83d94e97b98620
- SSDEEP 3072:4rZx2zOZ+kzW8MWXJBPlGyGv+RQxm7uFkgs7pkV9p7RM7jJWTx/:4FxyOZtLMWXJBPlBbaxp6kV9p7CVWl
- TLSH T18C245B4777258596E427C238CE5B881BE673B85017628BEF81548B792F33BD2B87E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\QtitanBase.dll
- Size 1.1MB
- SHA256 6d4446068285a95a51395eb594c67c8df28b979684f54bba9c7c8c0912ecd662
- MD5 3e5a63bb0cb4e57bf197d3e47bf1ce27
- SHA1 777aab7aaece20fa6432461a5f1b704b49301e7b
- SHA512 5931cc6483485de6ea4e22dda8520a15b8e153079950792db2d023672b5975a19aac673089ff4793ec08dbcdb1cd6745a7dfccda2c2690cc5cdbf11704a2c7ad
- SSDEEP 24576:93nRLlUv+otWr8wY6S8dtuTbwQHtlvsMn:9XXUvNdwVu/VzvsMn
- TLSH T1AE45AE4B73964352D16BC278C69F8114F07734119B4286EF9A2BFE291E333E5383B6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\QtitanDocking.dll
- Size 621KB
- SHA256 f1014458a598e679f17f3a328daef9d4b7efcea203422ac744744692134c884c
- MD5 4ceac351567805f5d467efdb2547171c
- SHA1 cfa884741daf18fcdba79a45b39889948b73d384
- SHA512 1f0b96909eafd305912b241813550491dc51fe332df4637decc2fa64e09da6330ec9a275ca644066b10b993d06140443035fdd3dcc267750defe1f6305472fb0
- SSDEEP 6144:eqpZco/36jOCZ0NesIZSNfFBg8UYS164o4TNQre4NMqINZIyavAj4/qkOh4BVhgv:es/CIkZ8fzvU564N4EWqkInNg
- TLSH T1AED46C1B72780391E067D138C65BC626F4B37842476295EF6216EA2D6F33BE13A3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\QtitanRibbon.dll
- Size 3.1MB
- SHA256 001218df55b7c412a38086f0b90edef8f232ed1ca75ff0a4a1563b5f59b32fbb
- MD5 391e42f9de3e8fae6b2ac13575b1f7ce
- SHA1 311d994c2c0a63f27e8f61b867aa0c94f6ee7a75
- SHA512 6da9b4acf64d9b89f9e3e97e1f8d0f1ab7a0c4d23e927ba5d65a22ca93ade40a24768f2c6c91679e696a3e1bfaca60f87b3b396fd06788b4b539353497e17560
- SSDEEP 49152:6rTyq/LVyjq4LbhndL1ZsY0LUGGvVGvYEnCW/Ln+XY6Qcc/RotRNC7C7C7C7C7CU:6vLUjbLnL1ZsY0LUGNjCW/L+I
- TLSH T19EE5DF8B77AA4298D26EC17FD28B4155F5F7749A835386EB4826CD1A0F333E06C36B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\RobloxCrashHandler.exe
- Size 11.7MB
- SHA256 0d26dbf578ecf5af61e8796109c27f8861a0296491767b3244ffbbb5bdf58dbd
- MD5 1eede71ac5035030973deeb34d245d70
- SHA1 173bbb31f8061c5885b1323e46679ebaf28b74d7
- SHA512 4547c69391cac1ee463119b00661a1a605bf303b34e48114c4dadb0bc107d0e0b496e346de937e1bf3676f8b030e0035392cb5e4555008ebf51b24a0fd758091
- SSDEEP 196608:8M5QgVTSEL7LHd+bAYcXeJahHBeYX5W3rI:TVjP00deJafeYY38
- TLSH T152C68D6AB2B800E8D4BBD17CC7469617E772741613709BDF16A086BA1F63EE41E7E340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\WebView2Loader.dll
- Size 162KB
- SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
- MD5 e2f9d2ef3446e70b50de50f577c6939e
- SHA1 48e7721704249cebd1267280459b7b36ce99e177
- SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
- SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
- TLSH T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\dd-win-prof.dll
- Size 3.8MB
- SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
- MD5 a0e645c21b4e8e8499f6e4af644dfe2b
- SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
- SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
- SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
- TLSH T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\libfbxsdk.dll
- Size 9.7MB
- SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
- MD5 51d82c0e8ad65126413ed39246b5cf46
- SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
- SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
- SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
- TLSH T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\msvcp140_1.dll
- Size 34KB
- SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
- MD5 d433b3e8aec25afb1c65cccd97ddc7b1
- SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
- SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
- SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
- TLSH T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-b2d03e4efaa04174\vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\0\settings.json
- Size 39B
- SHA256 5666e3314c816e6df322b6ebdc5e47234d1c698538985f7db279183fdf09a7af
- MD5 a773044ef32b20f96586aca3a5f80b20
- SHA1 8f836a9f918b23e5563374d576a5a6a89561116e
- SHA512 16c11e0ca1812ddf5e80a716d3472346ef8b162ab67cf5b8d3f0c296d86c1f02c9f2a98f7f00b735854da6f38f582cbc6937556cfa6be99cdc4a9877c64d548a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\0\settings.json
- Size 67B
- SHA256 d883376273fccb2d7c6ce0329c1c319557cdd50c87e49e81b7dd81d9bd424c8b
- MD5 7947da9ddada092fc17e5ad99ee2f24c
- SHA1 9cf2aa6c2bee5a79fb58ec6dd68e5460dff35577
- SHA512 49fde1d99cc5734d4fd50019d6990435df310b894947616f85c2a3813347cd000970154bc6fc04ef0cc71cb05a72f96cdb0fe9f118a1f3b669c41f92857558ba
- TLSH T123A002452531267F411A2936A355E9A541A500DBA0A2628DB74C745F18A7C784201D7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\0\settings.json
- Size 2KB
- SHA256 a21e124cc6b1979ad7aa461d9c1112cbcbc52ba7cd6cf09a47fba1190eccb133
- MD5 e7c86e75252f964601e0437d464ffb6e
- SHA1 ec9597cb441cd1b65869adcbe878cedef409b516
- SHA512 f194e7cd358f9ffa9443e500c807f6db229c3d1209d0e2443648bfe912a9ab3068f1ba98e036bf76949f02652f03a08a4c28873385c1476d9b1c8080e10e0f3d
- TLSH T1D451696C79F41D7F620DFB5458E70B8A187840FA9548B84C95AD081CF4FF04937AEA89
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\0\settings.json
- Size 3KB
- SHA256 c2e172ca4e6cd5b17838a694fbfa21a12883bb8b443c0ca846e800b7138853c5
- MD5 085ff3eea107dd6b7954a8381a355503
- SHA1 3c1b2d7620f87fcb01ec47f72cada711236200ea
- SHA512 de7978471edbc9f7cbd507fbb953ae1be8f4c68ac6150be2dcda760c0642b1157eee33bc69e84089765129b2b0618a566234014bdfec48e0fd4f0636c451eb8f
- TLSH T10751896C6DF40DBF624DFB5414E70B8A187441FA9448B88C91EC091CE5FF05937AFA8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\0\settings.json
- Size 3KB
- SHA256 9df7b4a0aff21aa7364d61e917f46a85b52fd370ae8b8b42a8fc3dc97b2c446d
- MD5 7e11e249dc45a02b90b6c7a5481e1a69
- SHA1 13881aa81b08cc7e0e2772c85867f965ea5ef9fd
- SHA512 edfaf62155719de77452b7c3804305b22428abaf51f43c5301c5928ec7b9611d59162bb6360a8339a282b5777afcf6be5af199d2aad43a6d439382b6bdc4e1d4
- TLSH T1F371BB6D29F40DBF624DFB5454EB0B8E147441BA5448B88C519D041CF9FF04A37BE6CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\1274343708\settings.json
- Size 99B
- SHA256 7bbc04677ae5efb122b15f3d363ea948848635da72b980448ffe53a57863a1ba
- MD5 de10b39321df8eefbfd4fc00fe08e867
- SHA1 2c85fb4f84f00d035699d4605df67f8cf1486687
- SHA512 2766f7d3cb5cc83661c8c1662f5c702cee2485aac33c3877ff7ce047d3689a95959ff995ceb73369a4767d1c433471a9e4f76249480ade40ad19cd177674f0b6
- TLSH T1E6B012A2E3048DB8D358DA0705583F572A6481F12CC9704F058C4120347463A3410003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\13916111004\settings.json
- Size 548B
- SHA256 d2db3d88ec129b0cf611fbd78548ce08bcfebb18dc9bab259c27981c4de533dc
- MD5 745b4e490c407b57b50452805d3be02c
- SHA1 fee901e8d761b40f36733f6373d863c1ce88aa4b
- SHA512 6bd1d2359fbff50b38b0ae1ed34d2d1994e65d9e89afe2118ae3b549a52993823114ebe12e21454a2e5d176f3dd23faad18d3c3ae3f94c099b4e3140ee550da6
- TLSH T1C7F0B4829435197A66D0D36295312A07CBA66CFBEA40A409C6EC00ED35EF15B1B1F647
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\2234103132\InstalledPlugins\84725827043434\settings.json
- Size 431B
- SHA256 4ca0ab541b222c2892d93ca3460dc8c991cb2211b56530cdecf78b310ac27a49
- MD5 f83807db4fc2d320b6be7faa9c2ed191
- SHA1 39cbab0662f48aff43c34bb7f9022d725f07c794
- SHA512 4514c8f85c73d15b3d1168fd8a7fe3ece45f6aae8200196f4dfd3ab3c1282ce9ac8d659b08350711c53f3f164a3b6fcecdb65c8c5d2f166be0de281369ad4b37
- TLSH T179E0EC00BA0C467757F84A78A7297B468DD970E254ED644EC1CC5C3325BF10E5391752
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\OTAPlugins\Downloaded\OTAData.json
- Size 29B
- SHA256 72de5cd3124d642aafeb64a4562c31204bb506a5c4fe37de302849aef41f0d40
- MD5 7a39cae24c1d13e38fd10bcef98c80ce
- SHA1 58d8a40b4d16215399749b563ba610c5cd3e4159
- SHA512 8f51f5fe9890099039ef275e5148299a87bcbbc1a9aab5c279105b96efd795ef445803b4422060964b3b010c180c9b4526c82f84433669e4e365812f9642c80e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 279c0208eab7652a95677b197826c04b8f0909fcd86156b7c0f3f728c2f9c816
- MD5 f44e4a623ff2e25558d6e4218e73a592
- SHA1 67075ac81ebb60b3b414069eef5923a1df1aaded
- SHA512 15887c4a34eb8f0dbcb217dbd7bc23a9bde9ba64acb8980bb252ab5ed07f84935baa0abacfe817d89b5b512530ee58ead0f9c3e453920cc1b2cf58070d90e506
- TLSH T1FDD02B63222D0671C314313749C1E14D5200C63F000680405E3AFD1C1A404E90EC1D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 e89fb8e800d9ac6f9e586c4813410f788254e00fddc842e8cb99089f727dc30e
- MD5 4e21faae649b169a8333fa9f5443829f
- SHA1 d49ef886a764639544b5f7164cebd19314b8cd49
- SHA512 57c34dd36629e095f3ff05ca7ede828d971c7963ce6d5045f719597cd4a820575fc7e8fb5db512efd7b97453237fc7987679868983039edf60693cd5bb018a8e
- TLSH T1B9D0222261190930C31432360DD2E19E2200DB2F0006C1805A3AFA1C864149A0EC1D82
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 f269eb98e429912f9ec90be85fe2b6fd737de861b9b753ae2bf4c7d6254ac851
- MD5 650a46913446dc368ce5e1d397ed33ea
- SHA1 c64c8a29c208ca501d39d81a599b40df3717ba01
- SHA512 0f6eff8bd08514cc6fc5201d535b596b402d1bf0e3fba9f66f1bee676b0480508c207513a75686dbd6f8d3ecb1ce19f1581390aea9d8f0d832adf5ef97e778f5
- TLSH T155D0222261190530C31432360DD1E19E2300DA2E0006C2805A3AEA2C8A4249A0EC1D82
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 fc818f95921f7e72def1f2b4c08be7d41c5c3b0d632011a345be3d0fada29f90
- MD5 84043162fe99d072a9166ce9be56317f
- SHA1 b7ca19e541d5ca96f9a8882cb03680dff9e2f174
- SHA512 53d6285daa80944307f0c740886300bdc88ec66791abd084f7bf97d01ee93fb49ddf2edfdda934dcb8ad070f1828be3f49d17447c49a883cb85f42ae23851404
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 2a4cb1210d2497e1f4a68f111bf9fba0780ede202d3881ae60fcbb3447e1d59f
- MD5 58685f835a7af1662c97e04ab932568f
- SHA1 5de37583ddb2bc90843566317010dbb34fd98a87
- SHA512 45ed2086ff28f12922bb4acabc1a07e6978eb05a624b84c665dfe40c48f2c88b813c346890dfd47e5e93f2205003490307b1e51e0a10bda3e55ea57855be7762
- TLSH T1A7D0121372150274C11034330942E10E0600C62B40058040942D891D2A0445C0F02842
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\14bf288e-e34e-45e4-b0a1-00080eba2f30.tmp
- Size 6KB
- SHA256 1c0007df43155ce0acb432770d5c0465dca87c9a55c7b8a0330e186dfc27f096
- MD5 85e9cb5891695720709ede1f898eb558
- SHA1 cda77cbcde6d71793ce2f35525d9567e56a42af6
- SHA512 193dfe824da13434f18acc2cd3e15b86990dedc6c23ca3aeb2b8d1d3bed9fa09a79f01aefeeb5b4c93c9981df653ac465baa3f64b5a06d6c7a83dc14241830e0
- SSDEEP 96:stx/dxxCFG4/b9tkq9no5h16ZmEs788/x+6MhmuecRg3OFje5K+g6VQd28XM1C7K:stlXmDbodEs7F+Ftg3ijTaQG6K
- TLSH T12DE1C6025E246D7B5CCBE11DFA25BA13E2F5202275D01E98E7FC692C04DB6DC630B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Cache\Cache_Data\data_0
- Size 44KB
- SHA256 d11baa444a1e69e38c050d827f6e7d1e6f3a2fb9dd4e270d16b10ecb69f62a0f
- MD5 3bc38bb5eea29f073db8101a15950db4
- SHA1 6309f8201ea5d809911d851d8ae0459cc276f756
- SHA512 e2de67596151b4f694b9ecfc08744fb9f90b09096dc64ab93c923a9d56215eb5d11186ca7508145b8d6c10df7d72d0044080cd369b433a7de75d2efbc7808145
- SSDEEP 192:gSAk2Qo/KLQQWBZGi1Vy56VwIrLqu0IDRG5:gt/KO0i1k5GBnqIG5
- TLSH T10E1362BCA9B40D59DAEB687D98A3173553B0DD47EDD0C817B8B5302998A13CD0D1D42F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 5dde844d7f7f42dadd2e50420c185b3dc5607911974d4107f7c2ccd1a1ce2fcf
- MD5 df5ba03f5e6242edb373907a33b95cde
- SHA1 8a823ed63520d9a7c84a7d047037429d970c07c0
- SHA512 738a555fa0056f05a5e4ef83f162585140cb8f605329a8d36ea49510c7e527848d6e4abfc3cb5b028d58d62593fb3eded01113cf31b05f368a0ed654a0cfa5bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 0039da9b0f433e4322fe3e4f4bcfdff2d7fdf9db52c18763192ca21af4e22714
- MD5 d67983abf1f2cef6168cf7ed70ef2c0c
- SHA1 eed76941d69a914288076aa4f7edc8241e6b2f42
- SHA512 0706fd0de99190ec4c5b7a99a92c15d8fa90642bbc6d1231f1da1438477b66aad98cffdfa70fc5d4485b9f9fa53cfc9950c57d81126914d0e1a868aeed8ccdca
- TLSH T16641D80A99E39DC0DF15417B02AD4C49EE15E8173E876B1FAA316F229047ECDA9F3285
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 06f2afc02ed3ce24c28ef5b806cd523b13dbc63d341bc44a854571b3749f25b9
- MD5 11eb7a63b62d12e18f1b55a699e4abe4
- SHA1 b473f924460d8ac2e5ec986a05fa8af9ca868ba6
- SHA512 ccb239e85b9bc5da6130452a6f7404f5f9b0aaec999f0d783dcb288873322c4c03b54e1817dbce1014a8de9f64406bafa2e8cc4343b1bbad5ee0ab0b0963aaea
- TLSH T11041C70999E38D80CF14517B02ED4C59AE15E8173E8B5B1FA6316F325007EDDA5F3259
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\History
- Size 164KB
- SHA256 a6c82607b7cef8b6f108d73c1c3567fe60e2b41a91f58ef2d064194f641893b0
- MD5 d009c3531d271a3e2a88c892b865db5f
- SHA1 cd8b168401afb237453c6df4eb78b79fa0ea46e2
- SHA512 bacf3e30572b399acfb00344106c220d3384ff092bd545145c1f250d113571add2794086ac014ce841560eb3fceb20a145a97dd955fa836429d895154ccd5533
- SSDEEP 192:xtkq1GlHqL/tH+bF+UI3iWGVDWNVVV63Fqz:L7GVqL/tIkUI3ijVDWNAq
- TLSH T187F3711E5F643601EDAD5237A9EB44B3597DF03F4B137AC56CA154B2CEE2212B01C4AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 9e09f84639b92916a7cac2d123c42eb60242932919ac64df5c4d4bd5d60ed925
- MD5 adebf49096d6907634c1c85056d594cf
- SHA1 318006b89a5127b5f80e15526ec78cc9b4074835
- SHA512 fd749628f5d93fa2331abf21065a304d3916822ab636a6382f2469a253378a1e82273bcc7774cdcbcafaf1d8341530bc275437716c193106367826d6368520a6
- TLSH T12551CEF343B0896DAA0652F46A19AD1BCF5C0530071C65B6C5D0BFA793B35A1F311B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8b77f1003b95b00e21af5ef9c310f820b8fbe04f5df017e6d7066545c64d57f4
- MD5 580547ffa23c96f49ae361aba5b63d21
- SHA1 89d8720d9a9d05002a0d38700819126bbb99ac8b
- SHA512 2e389d97f2a022ea05ab591947dadc2bdc136082219e3b6780cd8d056f9ff6e8e23a5b096dead337d84f14e214237109b7569bcb468f32abb4d58ed474b7f0c0
- TLSH T16551DEF343B0896CAA0642F46A19AD1BCF4C0530071C65B6C5D0BFA393B35A1F311B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 0593d278e95b14ec7609ce2b1aae59811f7424350847474d6f4a7702b6427bec
- MD5 cb876d2270b2199a2245fd9aaca33383
- SHA1 d60885c94dd75818d087cd3e4ecaf12172636e42
- SHA512 23b57347ef51c37af2bf82cb8c5ee21a4230b716e5dab36ceeec02bf86a50a9315d808117c622154a63fdb0a6c9a9ef43efac0c7d14e019b19db14c263926501
- TLSH T1E6419DF353B0CA7DAA1652F42A19AD1BCF9C0430071C6976C5D0BFA793B35A1E211B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 151ebc33c20dd4d600ce527cd8c681774258f28cc26fe6bffb5719015aa580c3
- MD5 85d4b2a863a7139f6401154d16cf9341
- SHA1 73cd676d4c42f40a403a95f24e4b5c4e2290e47a
- SHA512 9947fe97ca4d5f348a70031f28ccbd454bcbb411164595fe34e36cd01fcbca9b3d54901c12602323e015b71a14393f3114c31c917f4e4a481d62c78ca971a7cb
- TLSH T1F7517DF31370896DAA1692F46A199D1BCF9C0530071C65B6C5D0BFA393B35A1F311BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5badff.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 2KB
- SHA256 a2bfe09251ce308d825008fe9528a2697fda8aba469de7f785288b1011721a55
- MD5 9263330c7da82c1634b03fb529a8d0f8
- SHA1 b629d564deb2511cb97b70eb6fc9cf337d76ddab
- SHA512 f7a1f4607818bfa0ad6e94303fc7f28ee949635deb7d27a5a8a7bf9c6c77a5d4af4ed51f5ac9975e28a674564aa4f184498203a4eb6e074619aa67feea9ecaef
- TLSH T174517A67D2BE746B106C19BB1E44FC0959B6BC314192BCF8DB92806DB0D65F6072606E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 9760136d71ebf80dfe128c2a1c9512adf628d7720edf4fe576452b45150e0d06
- MD5 71d8e511c0e58193554dcbdbd2091015
- SHA1 a4835d3dbf523ae7007ede44939cee1e9921edb4
- SHA512 111e620828f84feea08a2139bf41a8a2bab34d4ddfb3ef3bb4550ac4afe3321a253e3354b440bbf42a2d28d460c2de3c7b3ea2a1656580e19babd1160ff7263e
- TLSH T18541CEAB86BFB42F542C193B2D44FC0955BABC3491426CFCCFA380ACB0D65F21722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 56674336e1b772360314577386565dbbcd33c192949ba25afe1d2353cee289c8
- MD5 00deccc937b0c0030cb7af6784d81e13
- SHA1 589962231fdf8109e25b742a8326178f6f6fff5a
- SHA512 8b7ec8f5c0b6b43043fe2b2c77d298410af96244b235ca9f3b8c8b7a3a1dadda89e67491c6e88f9bbfd25c4b8ba2c89e8f496af19f6323f3668f0054353f4309
- TLSH T1F741A0AB86BFB42F542C157B1D44FC09557ABC3551426CFCDF6380ACB0D65F21722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 2KB
- SHA256 949826d84fc867ebffbc1e3a687498bc0ef81bf2dae0ae4fff336c1f19cfd737
- MD5 958229c7bd292d65fb946b619afcc429
- SHA1 0b3b7fa789185645123afd08271b5062b70d5fd9
- SHA512 2e90cef1f072b8b5bde6f5420827b76a47d000f0a31ee37e7961ed1cc5abe1c200e1d061e0ab0ed1cbc2e898c8e1aabc03ad8c16e9bd4127e4d5660241d6d058
- TLSH T144515667C3AF742B106C197B1E45FC0956B7BC35518278F8CFA3816DB0D69F60B66025
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 80e8b5ae7d56e6a7de5ce24db802e0287307df2872c42d6f442f19ae3e17a329
- MD5 7fbe068a50c8a8ae56b35f6182b55006
- SHA1 6ad0ccef90df562df87d50518feb2eeacf6ccdb9
- SHA512 be752424e6c0455a19b612f95529904f22fc4c4316a20ab931358ab996fbf502251c69d6b748b08e50a122f8fd6f2ddae7857b80978cc2323e5417493f705d8d
- TLSH T1D9418DA782BFB52F543C157B1D44FC0A55BABC3451426CFCDFA281ACB0D69F21722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 e16a813c09190337bc6dda49ccdc9b0d0a02cdf311c6c9451ed193d0fdfd2d7f
- MD5 ba3e16e5602341b77bffce2ebe2745e9
- SHA1 d59efe8a5f5f522d43e5e9c26c6c5a0712cfeb92
- SHA512 b7d7d5cae305d9766fd59fc039c31856537606ad86f4ad3cbbd18bbd5082a0e255c3a9ba11fed3b6ab6c03ab624e84bbe4e110e011fa93af81c32c3a35a023c6
- TLSH T16A419DA782BFB42F543C157B1D44FC0A55BABC3451426CFCCFA2806CB0D69F21722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 2KB
- SHA256 17962ba404b566ba61d598b7fe8c3f00a4153f06d6ea8690166c5a1394efec0b
- MD5 7fb02986015eaa0116e2470adf70df58
- SHA1 01904d3d466173c44997ba5c495e760cc37bcf27
- SHA512 1940c3bb33d85a6ffa573d37d25e1b78bfa7679642c75654ba1f6f743f3b80f4711588018c4948e6472f5264d92fe20d27b99742c4c12d3d7ad7c1fe22f559f5
- TLSH T17651566BC7AE742B202C19BB1E45FC0956B7BC354182B8F8CFA3816DB0D55F61767025
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 795bb4081e0b02e0b422f0c4d759fd16d47a4dd805308348fb8e9af8c5508e01
- MD5 8100b2e0e377996a8e1e97f6ee57c65a
- SHA1 5eb764a5eb3521c50c0d054b6216f2402bd24860
- SHA512 4710f3da9920aa2da3e0146717890e15529b84d03d1f9c39ac9d12e1fc51c3cc634ecc95fd183f40def91395caeeab3c6c331513da0f6f71019bc15319307cce
- TLSH T158418BA786BFB52F543C197B1D44FC0A55BABC3491826CFCCFA281ACB0D65F21722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5af0f9.TMP
- Size 1KB
- SHA256 ff8af13e5da5b4c51ce5d92aeb722c60412a94911267b5ffac8b30c56ef6f94b
- MD5 8090829d5fdbb2eb26a4253682a691b9
- SHA1 ae4e1f3d355d9fdd6da3ac26cfb4b84440560999
- SHA512 4a1ab9c0e69796874f9dd3ae209d027b5b812d123ccbe8632a8050f24008f3f4a657bfa192cdaefc95d6e82c52e660303add5eabbddd57d036a01a932e38a5c6
- TLSH T1ED417EA786BFB52F582C157B2D44FC0955BABC3451826CFCCFA280BCB0D65F61722466
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 9d7e82111e317379adaf070a1f1af45921496b5d729d708e82faca4a6020d89c
- MD5 8a545edadd3d1b00c81a1b3a497ef237
- SHA1 f25d7338c861c7b617d3da34c41e1e89083b9723
- SHA512 ada162e13229406a2ecb7b2a86f48abc12bdf62d4353afc39530bde24bf48dd6c92d1045f6e8464f5c7cc1afff0db8797fde9eec506fa7d331e9f9a905d7a0d5
- SSDEEP 96:stx/dxxCFG1b9tkgno5h16ZmEs7/x+6MhmuecRZnj0je5K+gzpd28XM1C7K:stlXHpodEsV+FtZn4jT1G6K
- TLSH T116D195025E28697B8CC6F119FA39BB57E2F5603274D11E58E7F8692C04EB6DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 742ee380ecae6858ec408e4d6dc49217894cd6c7a60d87c3d2afcd3f401e128d
- MD5 726f285c4304350ea639168a8a2f6356
- SHA1 94a082963dfe8900e705d2810417ca8f45d92af2
- SHA512 f9ecf1cb770b7ce894b98d973144756f82792dd787a7e090d5e10f540a23db6d1c0d5a48a7ffbbb82f2527ac9e1ebe51cc89481add75779bae795a5447066787
- SSDEEP 96:stx/dxxCe1b9tkgno5h16ZmEs7/x+6MhmuecR0i1eje5K+gT+28XM1C7K:stlXhpodEsV+Ft0iQjTQG6K
- TLSH T19AD195025E28797B4CC6F109FA29BA57E2F9603274D51E58EBF8652C04DB5DC630B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 f96067890f6f7113777a0a141619e270f14be7459b9b41c491d168f171d6ed55
- MD5 59098bb59c205eef023c88be8f5ad977
- SHA1 beab11b1beaf3d15492948f2aee9b4ac2c552101
- SHA512 dbbdc6be249d4b41637085f34740af5c79bfb323ac9a77ec5a8a323fd44e4550550db31530378300f8b2cd74f42d3c47dc71c58847e057f73d5a5edb90ac082f
- SSDEEP 96:stx/dxxCFG1b9tkq9no5h16ZmEs788/x+6MhmuecRg3OFje5K+g6VQdI8XM1C7K:stlXHbodEs7F+Ftg3ijTaog6K
- TLSH T1C5E1B6025E24697B5CCAE11DFA35BB13E2F5602276911E98E7FC692C04DB6DC630B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 b16aea0813eb47bed23d8f4f3062ead8e24493c363934006815373d1e0d6aad9
- MD5 a608c440f37f5ce948d6b78792ac751a
- SHA1 a51fe53e9fd524765c9c186b800f6a0c628bc877
- SHA512 4c50f218b441561e33b9fe6117fcf2e276f57c014a3a4d7c65612417a3d79ae4c17134c4837025ca6fc839a0f197a71a7e146f291039abadaab6ec707157ff16
- SSDEEP 96:stx/dxxCFG1b9tksno5h16ZmEs788/x+6MhmuecRTmBMHnje5K+gbcpd28XM1C7K:stlXHZodEs7F+FtCBqjTiG6K
- TLSH T102E195025E24697B4CC6F119FA39BB53E2F5602274D11E98E7FC692C04EB6DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe5aea23.TMP
- Size 6KB
- SHA256 c456d8119c2ec25ddc7cbcef9bd1b4ecc71c4b82a90466d207801f4b095fd927
- MD5 8728c4b52dc238858c8cdca0a26b9287
- SHA1 38925f7a81714bd6f327f7090528354094830e49
- SHA512 fad3d84fc2a60c397829f9cc8803e0d79073cff1a9345ad382a6b17f371613f03612f940e505134bddc6b61accd1e3b4e7b2f453207283e2cd3514816f6ffa6e
- SSDEEP 96:rx/dxxCe1b9tkgzdo5h16ZmEs7/x+6MhmuecR0i1eje5K+gT+28XM1C7K:rlXhvodEsV+Ft0iQjTQG6K
- TLSH T1E2D1A5025E287C7B4CC6F119FA39BA57D2FA602274D51E58EBF8652C04DB5CC630B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences
- Size 6KB
- SHA256 ce8ece28f82394e0a5603e345e4fc4eeae11387bc6eb12dace0bff28d3524b32
- MD5 f5e4d3e2fca2a214ee32d378661c95e8
- SHA1 3beeee564660379c9947991921564edb042a9d8c
- SHA512 1f8e6c9abbdae1f9528fb7523a395e19f34e4938feeb124965ad5f6274fd1362ba3de62e6f28353f002fa2e15eef7c07f25de8d8a9dc8942d034c6fd29aff226
- SSDEEP 96:vfipPlf/ROo1pkF5d1Mil7VaTEv9V5h5pg5+e0iPRLndhafLEV:SxvAT9lCFj/
- TLSH T1CFC1B6A7452CC574BF444AEBD83C7ECF98BA00DF98D94C1696D2C44806C2EFD21EE499
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Last Version
- Size 14B
- SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
- MD5 3b746b6e8b8e101ee7cd41df1bb565d0
- SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
- SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 2KB
- SHA256 14672ff20c0e703f1f1d7768cefa8ea5263849fc15f526fe39385a36b1e55e16
- MD5 1722ef117b51750eddfd535a0a3231b7
- SHA1 67b1bf386ac72fedba968ccbb454452600b0a63a
- SHA512 04f0656c2eca76fdacf5b18244210cf0d55b9525b0b8f898a5d7df97990e06bdedbc89e28669d115bcccc45fe147bc4459bb19cb6b97d6a4d009330081c3e817
- TLSH T13C51943369246B3799F65704B98A7F33DE76A061DA611F20EADD2B1C01E766C2345C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 3KB
- SHA256 3e068fb6ed41b109fc874204ba4bbb021a4cd8b2861d98cd106f4d5108d0710b
- MD5 e5accc1b76534ceffdc616dc584910d1
- SHA1 9771efb81328542589bf5d378dad5468534b834d
- SHA512 b0d07bc0211d7c36dc5b8ea15995bee10702b78384ab97b05a00ed93fa8f71fe8db7b9056bbcd3b9e1cd78479862cbe1bf92aaa57ef0c7c634331fa0f0c6ef78
- TLSH T1AC6163376974A9278DF69A00B9863F17AAB59023E5913F65D6EC1F0C01D73981341C23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 3KB
- SHA256 7367bc681485dbcdecbecd4a3d071d59ee9e064c5f62d3a090f1eb3fb7ba8483
- MD5 f4e84bdea51eebeff754c3306736d3ad
- SHA1 d6820ce495679e1292b2b9b92d637984909a10e4
- SHA512 8fc99d7d79ead9b334fa456dd9ca6e02270837db596e2d7e8f0995b21b0ff8f1c721434bc73ef9b20e955735dcef43302eeca8e793fd6c7adbf1a602f3d2764a
- TLSH T1BC8195236974A9275DF2D605B9867F17AAB5A023D9943FA8DAEC1F0C01D739C1341C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 15KB
- SHA256 d5e52b9171c66f800504493374d675004d0e7786636a53f6dd0b755520ca32be
- MD5 d146474d4eda1212a72769bc39e3d659
- SHA1 66fd0e32e0bbbad496ef10250ee18e00efca988b
- SHA512 48d2e3d88248ae07d60db9c7749a9212d865cf301226fcb2716fb8f9f165105265535f79286927b7f805354ff91e2861d59483245d29ecd94860dd3985ee9161
- SSDEEP 384:v+aQikB+z/xvxjg/qhEb3NBSUhCZnWAwAVdpa9zH:+/UxvxjgC+bAWAwUaFH
- TLSH T1BD72AF2759383E23A5F3EA05B94D5F5BCAB9D4B294C16EB48EFD6F0906C72A81341C12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 17KB
- SHA256 d9e3e314717ab2b9ac4bc77c1a161e2039de1ef4982f0a18679f2cb3dac6e2d4
- MD5 87831efd1ce272327230fa1ea1ce8679
- SHA1 aa25290187f8cfec6af2fb34b1de7cb2499606a2
- SHA512 18a9db7ea6cfbd68bea4844959180a19f09baa1faef065569657f25f79f8f14c9b4f77307276d0ba8244a6dc27045fb84b6a63954a32405fb835bc916f9a04c5
- SSDEEP 384:m+aQikB+z/xvxjg/qhEi3NlUhuVnIdZIAwAVdpa9zH:x/UxvxjgC+ijEZIAwUaFH
- TLSH T19F829F36D864BE23A8F7E7017A49AB9BDBF4946295C01EE48DEC6F0C06C72DC1346C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 17KB
- SHA256 6bd5004cbe073b1ff0fd13b3d506f4471e758eb755af118137673e926999160c
- MD5 a9ec4a53f492fbcf0030fc66ecc41064
- SHA1 1a4802d96f66e2d1e63202a9d6e39e42e1cd4279
- SHA512 8d62459bcfad1d160fc3d24e933e87f3f176cea575b07aa0ab248eab3c577192f21662b79435f87647fa9c4484960ff0e6dfd5e0ad16df35c651954e39fed381
- SSDEEP 384:x+aQikB+z/xvxjg/qhEa3NlUhuanIMZI9AVdpa9zH:8/UxvxjgC+akdZI9UaFH
- TLSH T1C5829F36D864BE27A8F7E7017A49ABDBCBF4946291C01DE489EC6F0C06C72DC1306C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 17KB
- SHA256 7b89c68b877a097dd093071f7d8e135e72b2319e0d375b29739a366493a6468b
- MD5 da8c8dd4d5157c935af9c1dfbfa08f40
- SHA1 a00d982e955f9c7cb53e31a36b79528a927bbfba
- SHA512 9b148b7b684065a9dfec81065a3661dd60891231efb1ba534305f7f75bce5f844e379cac1c7d0e8a96383ca2c381d18d44233a157b6c15b29a60d3d54c4259a7
- SSDEEP 384:z+aQikB+z/xvxjg/qhEi3NlUhrVnIdZbAwAVdpa9zH:S/UxvxjgC+iuEZbAwUaFH
- TLSH T10A829F36D864BE23A8F7E7017A4AAB9BDBF4946295C15DE489EC6F0C06C72DC1306C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5a981b.TMP
- Size 1KB
- SHA256 e969bce4b8432c377279a89df4224be7ac63d34855154a3b0a42392ec8cd514c
- MD5 7eee4cbac577ac2685b4541c8c944511
- SHA1 448e4a1ba9e2d706ecb16c9b769ced2ac4ab7b6b
- SHA512 87f0f045df0ec2a4c389285b3d936f14153f77402b06fc6bd2f46612151e6eef8d9324551855c7d9d6201f14ea6d29dfaf8f775bddd86ddc2880eab95fa5a925
- TLSH T177215773E5741B33ACE557417156BF2B9E719067C3204E00B6DE5B1803E325C565DC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\data_1
- Size 264KB
- SHA256 29211b8d6b03ff9cb74c3681a33e40cf2a387ac6911646d9edcbb1844f78bb4d
- MD5 dfe8347e33a6725ed076b7ccf89bf65e
- SHA1 cfa76a254bdc3f1aec0cdc6e5ccb1fe5c4676f22
- SHA512 7690dbe63ffa28192c2043d23ced0938421e339d162a38c1f777b7507123e7286966d2b79666e374e53d789e88a48b3873ad6e3fccf0bb93ae9de3c9980f4652
- SSDEEP 3:MsEllllkEthXllkl2zELieKl//:/M/xT02z1eKt/
- TLSH T18D4402046B910609C5005034401283A64364D86009126787295199335C865400D40200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\index
- Size 256KB
- SHA256 477deec15a9219231f1b8d4d3435b416cc0d672ba7eb8b0561e0342a998545c6
- MD5 a00f63e7216b8edf7708535e0b381258
- SHA1 5a0c7e46318e2ae73f39b6f1f5af2ff33830a0bf
- SHA512 4670279c7ab745210050bc608d19cc27ab8e479396db58a9996036a5edc6abf77b2e66e972b57ef9ef0455417c1ce30d023bca23e4fec77c536b8da693424453
- SSDEEP 3:LsOllllklkXlYue+X:LsUlPDee
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Variations
- Size 86B
- SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
- MD5 961e3604f228b0d10541ebf921500c86
- SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
- SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
- TLSH T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\2f4223a4-cefa-4e37-9375-64b44efda0af.tmp
- Size 5KB
- SHA256 845c948389e01a7b1506c3559ba50bd97e20fb936cb4f9903f95bc7d91b7e68f
- MD5 5c01fec93eedd803b5c199ea4d288b26
- SHA1 8fc4b97fa70629ed286f7929fead98d3d30a1ba2
- SHA512 9702b4172ea251465286dffa83d223fdd061540a42a8ef9968a9a104f80557462514753b5fc7fedce5bfa74281d4b23caedbe68c4dc0b4e629dbbf0270d6b3cc
- SSDEEP 96:rwJodb9/kbdv616ZmWis7/x+6Mhmuec+DWoT41ejeaK+gWXX28XM1C7K:r/uvsbsV+FunT4Qj60XG6K
- TLSH T12FC195025F28A97F0CC7F109BA297A13E6F5A03275D22D58E7F8562C04DB6DC631B80B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Code Cache\js\index-dir\temp-index
- Size 408B
- SHA256 1401fe5d1941f5d0e26b6a403f641edbc860254dda142a1e81d5633cad093e84
- MD5 e2c8c482a96bd62c0ecc48379f7a6a8a
- SHA1 acba2fd99fb753809a1406b0ddcceec1bc7dadd8
- SHA512 adfcbe14af9d19d14ea1dda30aa3952077a7c5966a89e28f7d9abd2862529ff217670865ecc0ce3b246b17bc8c0eebfd2115c8a7e61be1b1131a11ed8659b1c2
- TLSH T16EE07D6F9A6E105EEF818631D9410DD1666C24824ED4170AB0F8DF7280E72F572C1420
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 d257e4179e7b05a317ec90d185d93f198d2358a0c0d4118e9fd8cf28547cdf27
- MD5 a24116eab2b235eccc924a20c9f118b5
- SHA1 39f961c91d77688df0d696e019e89ffc67511a68
- SHA512 b1ca2a676e11c79df13d8622509acd0d14f469565ef6e44db4bad82e1109a74c839871e28f99a58acbe56e062632792957e2567cc2833c556a9701575f7782f0
- TLSH T131E0A72FC0EE11AEEF058675C9A11D52A58C58C70D8D930BB1B8EF45C59B1F6B2C2515
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Code Cache\js\index-dir\the-real-index
- Size 576B
- SHA256 e3086852a9617a74ae6c3b2363828fe80bf64a6cb12877239ee4f7185491b50f
- MD5 f67fcca2a38a436903c3ff5d27219add
- SHA1 a8449e70fd6cbbd420b19dfb27cc0231a8771cb2
- SHA512 46d939f43e10456842f9c5410ffd1127b6caeb5251e3e8e560ff4ea84898a626c06d97a8f19f9779bc2b16d96009d95d4e628ee7a8bc475b13dc58215d3da7cc
- TLSH T1C8F05C9B5ADB045CCF514936CD030D56555D1C874FDB130772748F7180E39E526CD410
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Code Cache\js\index-dir\the-real-index~RFe5ddf47.TMP
- Size 48B
- SHA256 7c669cf9419c2a618d5cd055a5f392a96b1d020ffb91c2a6b05ecd4408eb0b06
- MD5 ea7ab03ad7964a0fa4198d83153d4d1b
- SHA1 2c8c93ef5209d1441feaf6a38769b808d735a8d9
- SHA512 62ddcc96dabc2bff34c2c9b4455e8865d7c01b1b2cca74625cc4338e3aadc3cd0da505d53ac1a89c2b96cca7e63fc7842dc8c19058544fbe7200c800014eff4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Code Cache\wasm\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\ExtensionActivityComp
- Size 4KB
- SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
- MD5 9088df5de5b8306c52e744141a100532
- SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
- SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
- TLSH T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\2bea27db-b5f4-49b4-9f06-e55f2e691c8f.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\Network Persistent State
- Size 1KB
- SHA256 62ebb511c4f0f95f5dcdfd8140ba51a03ad35820c841180a8ebd44961c41ce82
- MD5 f87c83a79bc4af57422fa8a906527ec2
- SHA1 ef70ccf9a97460104026595cb6f6f2335ee28f6e
- SHA512 031a962ed7ff41ca867218cce155324154cad17b218fecda7af33dab8baf6831d0c0612c6633c8e43b1163aa508eb2585f7c5f6a446435922453d5ff68bd4bc6
- TLSH T1EB1157F783F1856D9A1603F02A256D17CE5D05200B1C69BAC5E0BF6B93E2161E211A9F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\Network Persistent State
- Size 1KB
- SHA256 65bb72db7f535d73d0aab5ae173539717fc49f20a29c7c4681df1e5564b4945a
- MD5 9f4983127ce7b8de396a527eb9d5c270
- SHA1 8151cc2b362513a59ec54c3e02dde911a19312ed
- SHA512 956fa1690cc53f8aa65642aab6388a6a1e9955aa4790aecaf663bd2a26bba6f11c171419f1e9686b1d58608fa9d4c6671065123b9da5776ac80e212c46423ee6
- TLSH T12F3199F743B0896DAB1643F42E25AC17CE5D0530071CA9B6C5E0BF6793A25A1E311B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\Network Persistent State
- Size 961B
- SHA256 7695440ba0ce2822dfcab0c472e248372aeb5059b11bba5800a39389b03df95e
- MD5 4895c63b92ddd5d9b740b2b5cb6df0d3
- SHA1 15e8022fb88a6d1232c1168f00e95e2077ec3c53
- SHA512 201fabe9fd93f26b914e316825375de1c66f1ff34d8a21d5328d97ca99df64b21662b092731ef76b903d98ab510e001576f2e35b44cb6539521ac5db3e47267e
- TLSH T1B81157F783F1857D9A1603F02E256D17CE5D05200B1C697AC5E0BF9B93E2161E210A9F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 847B
- SHA256 29c514216b58ed327815fc085d28285957bbd9a38146b70279045529286cde74
- MD5 8b72b73a54eb154fc188f7cd4ebaf170
- SHA1 63ed1502629e9f253f2b4bc99544a150f36d01eb
- SHA512 7cce740eefd4968ac22ca498061fb31e81c6df4b99d0af5e8d3d833d54da893e745d6791e881fa75fefceb6a230452e52d5e05995bd445a7032280b9a851c874
- TLSH T10301AF5387BEF572202C057F0F45FC091979B43552C298F8DB9A812CE0909F7072245F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1017B
- SHA256 73f699441c94fa87860cea822d650fd09f8a676e849d44c07cad51c09315f5e0
- MD5 3efbf66c773ae54144ffe104924f9044
- SHA1 36e2ddce5764548a22bce7e576efd9b3e9973d47
- SHA512 41e7bf47316dc7ff6920bb9b5f0c8ad4b478ba98cae3370e3d28eed48bc1b67ff9e840f99e29505a5d72b70a22ce372d6869e4248fb58a9b0d7449b39284aec6
- TLSH T18B117F5796BEB537203C057F1F45BC091AB5B83141C2A8FCDB96812CE0909F7072245B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1019B
- SHA256 2fad73e29f23c34b73f01dd9eee5548d2aa044abe18e527549a1890897e3138f
- MD5 b98f127167c53aa98abacb2138979cdd
- SHA1 e0cac0ef65bf93a64ff54b3172a38ec4acbd7bcf
- SHA512 99cefe834ac019ade0feec98737081a1ab290bd19b1503cfa1554ecf7a8873ca6a8e96a7d550022717991219e3a9891e4ae3980aba799dc248add4e29bb2dc97
- TLSH T13B117F5386BFE537206C057E1F49BC095A7AF83141C2A8F8DFA7803CA0949F7172245B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 847B
- SHA256 4908f354911649f4ba641eb5de860b1933b6a5e15274fdaf0e1142d3892e59ac
- MD5 433eecd9117590a3c3f9c5ebb4bfe2bd
- SHA1 d955cf1c0ff38afa426c41e4c73223a74a016f1f
- SHA512 7b35e2659a9148f70a27dd583dfe15d34f81bc0a2c7cfb23d1c5e68f69c63d9e607c29e1d1108964243c77e943ceb3fbae9a7a2c68393f8115f306f6e6b08386
- TLSH T1CE016F5346FEE037103C067E1F44BD191DBAB47512C298F9DB96812CA0906F7562345B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1KB
- SHA256 b938e1f2cf4d271a62069e0cfe17d5f8822c85f48b8cb76652bc40b086d02d14
- MD5 4af6450e3de8d9a5dbc2883da05f1f86
- SHA1 2ffc5e76e7a7bf21f800165d5c7df8e2dbe3c8ed
- SHA512 652c4cc961c1d85a4fc2179e7cd5c1c1edf4c17a3f76d8ec25349576c5b9b7b5ace6bfd03d65c336985f94fc70408c0332035bd45a08d38326097c738e3a361f
- TLSH T1CE315F6746FF743B103C456A1E44FC055ABBF8354141A4F8DF93407DA0995F7472A46A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1KB
- SHA256 8879e25c51ea145f26b6acceb37b7ba4f47a1c6e7b4b38f2b38e3d20f0156c8f
- MD5 0fef6347ac55b9b420f2447c0e0a80e6
- SHA1 23beca896e08e1b8efca5b6bc5de2ad3a5cf1932
- SHA512 948249a80bd298649d99bcbd77740be34f8c35d1a8ef749782bb2ea55a771bc43e9d099c82734cf1fb4eb880f75a3535ff6a8647e61424999c03f895f93c08cf
- TLSH T15F31792791FFB43B107C4A6E1E44F8055ABAF8354181A9F8CF93417CA0A64F7571286A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1KB
- SHA256 e8e662f102ae0d6aa4f23461df841e9940ae179a84b683fb81e27f2114d5daa7
- MD5 7c6c1034dd8f9179426ebbfa76b6f613
- SHA1 5b2e970d483306b4e97548d143180a6c0b5ec7d9
- SHA512 06f15318d8fcc5d991ad1a05c9136e905f09ae80cd90a8023375f59e54967b72dba83a95b163d5666a8e422e2f270f899a9eca299cccdd9303940ad967c5a020
- TLSH T15031AC6742FFB43B103C89AE1E48F8055ABBF8754141A8F8DF93407DA0A95F7472A46B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity
- Size 1KB
- SHA256 9db85f90e6b2aca21b37c731f3597b39e0d3b9c0f6b4617f1cb788a3557bc2ce
- MD5 7ae3aa02248476e8450c35049d35abce
- SHA1 532771147dc0bc4050b6ed24cf528b464f93782f
- SHA512 4fbe978e474fb4f418ec4204c50f98023776c282411eab8d7710c209200ea784d28415141859052d074910432990957ca18b9c7d70e21c38f2984377ec17aa19
- TLSH T1C131CA6742FFB53B103C45AA0E44FC045ABFF8314181A8F8DFA3407DA0995FB062A4AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\TransportSecurity~RFe5de523.TMP
- Size 681B
- SHA256 ebc6b9c8b4d337fb519f5f2441dcd2c937ea622f5d3781720e7d281a35480765
- MD5 bbeccc9ea7537daa5a946972e7dac575
- SHA1 4bbe6730307d8bff18ce8f1fc7339827694f3279
- SHA512 dc148859ba5d298ad461c1c7c641a7a13a56b5f768b541fa92d2439adb4ac32f75a350b5d69ff6400a4f2212d98fb6a849bbe6bb270a7068cc3a0650ecb2c3fc
- TLSH T19701766346BEE032103C0A7E5F48BD161E7AB53142C294F8DBD9816CE0A0AEB562306B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Network\daea7760-6b16-4861-8934-f3511e155226.tmp
- Size 1KB
- SHA256 d7bf6e9c8392a37f0b4847f98d1fc3e37aed81447c9dc789d345e1262982cf34
- MD5 f1afd0d83927963c0e41b4a8ef5e7da8
- SHA1 26cef19986a4b7dca1cb8fc26ad8834aaa0e2f29
- SHA512 a95569ec7f0f2b8ac9ab9e5032efd58e04646f9eebc32c2df38e8a752e10bf2e35e14f14413b9ca755d2fa00367990c7e3b0ea6e786f7cb52f99f56b24137aff
- TLSH T116317AF743B0856DAB1643F42A29AC1BCE5C0530071C65B6C5E07F6793A25A1E211B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Preferences
- Size 6KB
- SHA256 5082a46c859aea12f6adc0848670ae2ff1d59517754142d8d79d60ad3229e4f2
- MD5 c1b2a00765f0e94787ac0498116b0e3c
- SHA1 25354db08e1251cf3b24e99dd68b6c802bba3310
- SHA512 95d7137d23828f613e29798be4f594e591c05faa5ecc2c4b35a696ad8b0483d00153a4b0b36732709c644976d814526602edcf89593d8b261cf679f0fc596e97
- SSDEEP 96:stwJ+db9/kqzv5h16Zm9s7/x+6Mhmuec+DisMkkjeaK+gpGXT28XM1C7K:stdZvd9sV+Fuiswj6j4TG6K
- TLSH T1A2D1C7026E64A97F0CC7F519FA25BA13E2F5603275D11D58EBF8562C04DB6DC631780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Preferences
- Size 5KB
- SHA256 4233d14d132f1d89ca6ebb2f30cfa278a5b53e750eb7ed7c2b7bb829b5bd5888
- MD5 f4329140df3f311cb214372c704c2956
- SHA1 7a6dd6e43550c1c192ea227457578a8f64ea3a93
- SHA512 29da65fb4dcebcf4f94b43d9866c3215e37de73ef8be1740b9cc24391a9e33f5e725a11ba58eb14d3fa48caf280b4fa554c1c1578df39bbf091e3e05d4d6bb56
- SSDEEP 96:stwJodb9/kfv5h16ZmWis7/x+6Mhmuec+DWoT41ejeaK+gWLGL28XM1C7K:st/GvdbsV+FunT4Qj6cOG6K
- TLSH T163C196025E28A97B4CC7F219FA29BA13E6F5703275D11D98EBF8562C04DB6DC631780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Preferences
- Size 5KB
- SHA256 e8f8fc189b22ff695402d432d225a0da1394fba461f6b9490802d8be716a68b2
- MD5 8a06e4ab112626aab0c715a885038aea
- SHA1 184197f7567e17e24a6e9ce7784a994c84b34c63
- SHA512 323f0a177aff6616c56aac69b6b6f3ec193a918d0ed8146675c26b0636da9c56c389e39bcaa3972731e75a8f9557c2763adc5ce0878ab18054a86689828da0a8
- SSDEEP 96:stwJIBdb9/kfv5h16Zm9s7/x+6Mhmuec+DisMkkjeaK+gpGL28XM1C7K:stVGvd9sV+Fuiswj6jOG6K
- TLSH T175C1C7025E68A97B0CC7F519FA29BA13E2F5703274D11D68EBF8562C08DB6DC631780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\WV2Profile_user_2234103132\Preferences
- Size 6KB
- SHA256 9fd17a887a567faf7ef65e6698080d1019a2569061be78c6c2492695d91cce43
- MD5 7327dd5ecd952c2769d5d50e3c435238
- SHA1 12c4b2b1264541c0e035059436d2cb19ab7c7d8d
- SHA512 ba2460ceae838e8ea2123afaa1b30eae723aa71d3094eec03e54961bc137c22755d32e2a751d962b79d19223a7c7ea9f15bb3f8176f16ba5d542636c21030879
- SSDEEP 96:stwJodb9/kqzv5h16Zm9s7/x+6Mhmuec+DisMkkjeaK+gpGXTI8XM1C7K:st/Zvd9sV+Fuiswj6j4Tg6K
- TLSH T11CD1B7025E64A97F0CC7F519FA25BA13E2F5603275D11E58EBF8562C04DB6DC631780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
- Size 223KB
- SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
- MD5 2ef00fa979161001a3a5cd5169a7de48
- SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
- SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
- SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
- TLSH T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\logs\crashes\attachments\d53f6371-f812-4471-99de-37974e35a2af\attachment_0.733.0.7330989_20260809T164830Z_Studio_B6B1C_last.log
- Size 274KB
- SHA256 dfaea0ce33911f4749707521b4a96fe75a4d081eadd14d4429ab907464026d77
- MD5 df5584e9ae9537c482759f3ae9263801
- SHA1 2ae8d2c039043cf18c4c756e086c51ed87983e24
- SHA512 c049b1b6b0f83d176a6f08cb838772e7bc121703548d94b781ded9e002d3a982ecc90b9c8e5c69b33a8e4cdaad869199ffac9cf20429fe5c540fd3a1ce9893e8
- SSDEEP 6144:1sPLNN3iLcCYhlJ+0wWY0AYz1Cc99LaWEH92/LOebvin5LtFCAYvjMzx5mgIsFsq:1sPLNN3iLcCYhlJ+0wWY0AYz1Cc99LaB
- TLSH T1E8547593F1D7032D741F128FD03F1D9EA24BF6667327F1E8723C200E6B519A899A5992
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\logs\roblox-studio-1-6-0-7330989_5AF3D.log
- Size 7KB
- SHA256 0f0ebf78cffd9d189d9476949e96003923a8970e0be0815ee442ea08b6649ebf
- MD5 9cd0ed6bdfa375b3b658423e7d8e5c26
- SHA1 463b9501222aa633356c1f8cc06b5d828f4cce4d
- SHA512 1ea78caad1bfa3f804ee7851aac9a51fb512b4b6f292ca9a4d48e95116639d16c0f04303b15d5c251fc914eb2ca996fb54e0de8ee2ccc12d24add4ccfcf03d86
- SSDEEP 96:KYLlaHWoSh+8H2kH9XVaubSQOhcXw2GSmmb8/ol/vduSQqT2:lLlaHWYoY2l/USQqK
- TLSH T14CE1EE19D3C64139360E128FD76E8D3EC7537C003217B270B6DF108EBB856A866DBA52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\rbx-storage.id
- Size 8B
- SHA256 c15ffd7327485158ba459248e51887b67568f26f47bf1dad2f7717a6f32f1665
- MD5 3a04ba5aee6de8294ebe2b439f15c50a
- SHA1 b12781988a638f7fc137e629d069c7105f382e3c
- SHA512 8be5e904930939352efac4736f43eb4f42fd03b25ad9f7fd9dfd5f1336838b7a8ee62dec22dc19d521f06455fe4457ea2a24e12575bafbe9787bd4a8139ce528
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
- Size 64B
- SHA256 28646db5890cff29bf87c39f5b540f6e920f257b1c3b6b7d43ac029308a87e92
- MD5 ea83c090a19df262e254bfd8a81451b2
- SHA1 818d2a5ffc89f976c9d2fee21a995e0679fa912d
- SHA512 84cbbe3a38058922196af81e97f7db9532a3988b5c360a1691fc6bf4a578933eb30a4608c1f5a24dbb3450af67dcffb7175a6ee6154433592ebcf6f701efcf34
- TLSH T11AA002134E455A2EE44E1264133374D5A0A57971D597084150EF56592D92D7C6258052
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX09FF6C08334142FA825DCC46D98DE6AD
- Size 1.7MB
- SHA256 42d5c0fee75228453277d1c6b628b542992956e348ca424275030ffca9de77ab
- MD5 3216670c5a4c002bf952b7386f4f754e
- SHA1 0440aab21b4ea3ed51d5cc71be8234780e60c47e
- SHA512 fd14d027e9ded72f96ba3d8c80e0c50e683a016cf16054b078b0debca1e53e5b2e44f7208658ea7a36786d6868739c2c0303fa18cb68d7545ff7a72440db97c3
- SSDEEP 49152:Hm92X53hyxHzbOjTHT4UrRnWbs16sh/RMyUVAW0hFbxr:Hm9MxhiHOLT4iL16shJD7B/bxr
- TLSH T1788533066A141E98D83739F389AF04CD7B5DA3EF83C50B5088BAB2AD5C6F6095E5241F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX0C1FB02006BD4967B6E204C900B37E97
- Size 2.2MB
- SHA256 73dd9671312c77bf2eed5733dcf63198005c0ffd0551daaa5718f00bb7ff416d
- MD5 b6eb71df03d4270d0046d2b9e54001c9
- SHA1 a93ab97467274089c7785a588ba8dfecaa4c588c
- SHA512 2f262616ab7a8ed37f6377c20adb0cf5f2f75fdb2af921b14a31d5d07f031f7c4dba4bbc6eb7940e567094a54d81ea3b2034894da73c152739918b7cdb09fa83
- SSDEEP 49152:qDG+FZtZtcOqeuaLD9rfHoDr4CWZb6mBmfrafqD4OHUnUdZT:AjFbzcNerHpjTZemBLiDEngT
- TLSH T119B5331E29AC6C9CD9ED6273AE7FE630B3F9563D90C81F2212C671480CD958F25C6A47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX0E6399A7B29444D9AFCF68A06D234FF4
- Size 684KB
- SHA256 520ebbbc465f7af873fff7abeffce13eae788b4037f18d3121dc534b812bd0ac
- MD5 d821a71ef2f19dc871868056488f35d5
- SHA1 62d020eafa79ac84ab4394361008b547391f7692
- SHA512 ad9e5eedb28dfc303f0dea7b305595fe4f76fdd0059ddcb051815b061667df10485815dc2695f2804c673a55ff1036de07c7c13cb8c89bda42bd3f058345d895
- SSDEEP 12288:jh3RbIzvM//c19mxR09xtzNNKuIhJbVqcN5rReomuEbflGN/61bHMKcq0q:j3bnc19koN7IhbqcN5Wu9Ri/1d
- TLSH T177E423A2CB0FFF1CD84C03F5846E590096F998DE6F91C0F65617A4BFD92AAC4AC4664C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX128239D17BA94933A153BA58A369717F
- Size 1.6MB
- SHA256 4002d5fff231bff11eb9af4045b0b32741ca089940d23fdff1d5c8a5937d7723
- MD5 ff9b4feba213919067847de48c9e2ef5
- SHA1 b627384f7147ee8fbfb0c4712f95c4799d57d878
- SHA512 a2abe07cf16d6dad94b7f652c54c494a0e548c351d5401e3dd3d5f5eac76f71864a49aa94287c6aad3cdd3fa0e790dbc309d3f957db924cedc3d1ec66c684412
- SSDEEP 24576:yeIK0MXn+rx4YDTzx0MVNqlRLRpdB4KsNDx/E19xoGP3WkoogzlcsZO6CSLYDX16:yU0ikx0h/RP+DqxBWoR+gHwsbW
- TLSH T1997533B639819FCBCF35B0BE03131B45593F8FBA0809AA4791FA61593E0A74CF59614B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX16630B98256144459CAA02D65B38549C
- Size 2.1MB
- SHA256 a61c34bb2cc3eff47c35b06559f2f1b38e795e24cd5ef717736f491a914ee4f4
- MD5 e36d1a764f37611194cc9425938e2dfb
- SHA1 cd62fb4a1d8f5d51b35b72b87c6c968be008a2df
- SHA512 29ecfd45cad44e2b0d93e71b248111c9487fd9b7bbd71c3996bb9a3b6c076d5f4384a723d20ca4c68e56e4c7306bf7e99c443c6ad573e5570caf094c4f7581f9
- SSDEEP 49152:VRcnnYWFRC1ezyrgczlbP/uWJ5ZzTht3Q3Ke4SB4WV:jYNEo2EiL3ZHz3B5SFV
- TLSH T199A52316B3032FD5E40C12B548DF4F5633EEDA194251235383F1E56EBDAF3BA188685A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX191590ED467D4713B6A994231147A640
- Size 3.3MB
- SHA256 be92f790f1533676e6efe31ae31f9f5b23f23c6e19562e3a6f729d541b9937fb
- MD5 fcff32a4500fa1bf13b5fbd8c406ab61
- SHA1 45c911e2d9e32b7a1004de946e4dd8a503b2d49d
- SHA512 5664aba4bb32d198aab0989db5c1561cdc29fa3e680607efec050b5cc5ff89535caa9acff5baf28faddd24a5872cfb9156d48df2f8235ac0dd0adb119a003d84
- SSDEEP 98304:f751/bcTNTK6mSvRuxETiluYvv6JXp90Qnxw:f7LoTNISrTiTvv6J590Qe
- TLSH T1F1F53376BCC08F90DD5C6E7068D71F0977BDC2BC9B715A5A0BB8B36538439B52202C66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX7650E11E94B040939C1314B4F0653CF1
- Size 1.8MB
- SHA256 89dbe33183a79242fcb5cf2b06d7b91fcc68e06f2dabed133bf3b153b83ba465
- MD5 2cf5716374bb1dc19da2f050ae91c652
- SHA1 4be1da9e3db27f42374624441816c575e7484ec0
- SHA512 182793cac1cddb2501c683f26f3ceb7ac0869848a8260cbc178668b036833538698b662cba649e71107a013ed0a23f9519b49df14df1f529b2589dc803ec9060
- SSDEEP 49152:VOdl52qAca9Fk70JVSD1DnlInA6XYVtgdKvb49E:Vub2KOeMSDZlInjXYVWYUm
- TLSH T11595330DDAC7BEF8F252DA3A43AE454D63D0901BD1A47BEF65229360778162D40B3B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX77BA1B572678416A9EE62B60F4882972
- Size 3.2MB
- SHA256 e5fb3078bfb3ce4717108e384a54a0b13c893e8ee79373c5e3cf44fefb5ccd5f
- MD5 3e032b85b950e4c48642283184a98255
- SHA1 f298d61a495e256dd366bfbe685b13a2b566a3ab
- SHA512 1f4c385dba9c65e10b3f3ff797098de9343ed8f3235e0cd55af62363742cf463aeb38e994c7c686ef25b22ad0e16965eb68f079d3a2084761bd96bb1a5752278
- SSDEEP 98304:T3TJhH2ZqixjfibqDqlub4m2OvOs29w9VH1O4p:Teci5iu4QB2Omscw9VV3
- TLSH T178F533EFFF56970DDC45DD782C08A1502D6E8E4A8B46FA9708B2C245230F6CEC865E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX83A50356C1834B1CAC1D05946AB43B27
- Size 2.7MB
- SHA256 a2c392a4d90ee1f10498d82adc0ba0ed4d0d981eaeee9fb1d3f892a8b18e698b
- MD5 b1e47a1a868f8bc5bf10329859074e09
- SHA1 fc367086566114012e8e7f5560fd39fc01d370d9
- SHA512 a5f4ecae9b0c1963dce2bbdea4f5466109d4a85ecdf1971204a972a1604bdbcdedc62a7440233e65df3656a4d2d53b9e071295de5ad426bae5c580bc60e3d51c
- SSDEEP 49152:zelO07NChI4pZx+4fiZDTmHlU3nVbH7edSGsnoPXwyuBhKAbgWHlTBJm13yY1285:ze5b4J+4qZXOlU3VDSdSGsnUgy4nEWHM
- TLSH T1BDD53362AECFD8ECD951753F1A9900D2AB11D2B257B461671172BC89DF8B8200ADF34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX84EDD7E6C9F846DD93FB60ADCBB51D8B
- Size 2.5MB
- SHA256 e3bfbd616083bdfaacd55534cfca622c895c859d72304e34de1abf90aba29652
- MD5 418470b2e348678323a3976326976d36
- SHA1 f0ba581b1b209408482e6a83759499459ce247bc
- SHA512 0517684c46d1af09939fb65a36c605995fda1b64844154718b46765e2422abc2b50ffc179a68822eec0a3d85a74d5001ae12cf441be4f78703a0c9fc2ea1bea0
- SSDEEP 49152:hObNKDRK2QZHP05jOE5V4pEUgqWyjjdvDkcmYLpcGvZ4yOB7phNde:ENKQ3Zajt5V4KUgLYkcjHps7fe
- TLSH T14DC53357294B4E8BCC1CE1F473ABE5343FB503AD4B90642AB8F163ACC6863684555ECE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX8B81359A926740238F67A350D5202D88
- Size 1.4MB
- SHA256 c9fcd72987c266c31fe1484d2371fd2550c7048fcba66267093c2ac14272db42
- MD5 52fe9911839b90f36efcfa072a53b732
- SHA1 7434b04418998f86be52e8550b82acb7962b15a4
- SHA512 1a1d1ccefbf17e3ed49346e030cb58f14ca597b533ff4df1e19c3ce7a641c3efab01b51aaaf2e145e3d6f37828bf6b566a1318f12214656c81407b3ced301f62
- SSDEEP 24576:jmZ5A64JEnkZoaSGowEdV5hEmit31n26N5aWY6oFzE8fJWa2:jm0tSGL+qmitlnbN5aWKFzEK2
- TLSH T1976533AA3AA11B23D804637D5DCF0F413B7C9A198790AF47DB3161556C0B7D8C8E6D8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX9C6F0A9EE35E44C7828B9AB66CF4860A
- Size 2.6MB
- SHA256 a0a4a352707dbeab7f8a42a93d89482d34fa85f3c284040b3993482c6bc5e95f
- MD5 d7c27f7fec51bf9d5c6b34c3dfc3e429
- SHA1 7bf285c54f31ad6e8a0df737323ca0fab6bc2f18
- SHA512 6deb472d166f239c3fa8a6304df48a8094282b2f82aac30541fffe001d8cb5b305b58492c4767b74c517f387efe1a8879d3bc5898926c02a7a5eb38adebe8a05
- SSDEEP 49152:aF2uOq4y1iHkK3WeW0e83ittYgyu/wgV43+NlOkoDW:aFKGiHhWBn5tt+qbTXOkh
- TLSH T136C5338976B2FE40F82312F5D7EDB0A11237839B07CD7172A6831AD137992F8966543B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXA6420EDACCBA422DA913C88A5C6B280D
- Size 3.4MB
- SHA256 bd01d319fd02fdc83b210e2261311c47070803197cf37c40b37d1d6f7c80a483
- MD5 1c255a13eaa742469843ae219b155681
- SHA1 fab5c0683c47bd67e14643178fc5e317cde4f24e
- SHA512 1ab8034c4636c9810018d9b5ca5991f0dfabed4a21d9e81ae5d456db2145c54c4ee582b4f7b7e7d7337f2734c66c083ebef464896b4cdd8befd09e050aaa65a6
- SSDEEP 49152:PW7YcRRRvE2qyXK+5sQwOQ9YvyqQBZRccRhMWm63h+HsgCKaJyi5lhpq1/jCZIHb:u7hRIIXK+urOZvY9RCT4kKHhpq1rP
- TLSH T13EF53304BC17FFC8DA8EBC7369FBCB00F17E87A9978C0A1755A92160DE99464148B16F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXC4F866D0089B42E68F58CD751AE2FECC
- Size 2.9MB
- SHA256 7d14f67cc87abddf752269fbbac71dc443e9da2a6a039d180cafcf062979d40f
- MD5 a51ea046a292277ed1736cbb701ae2c2
- SHA1 b2655d82ec3318dedc6abd8a83017b089abe6b14
- SHA512 f84457c5405524c579cbff6aa50e41da312ca651b0645e557dcc5d1f7cd6f530367a0a9e58a3def7b91f3346786de8d7f78bad5d0de5a9902e210b01a82f16a6
- SSDEEP 49152:bpgeES6rTJXNJwT6ondUAXerrSCqBjO8DSfmdT7YrUf73phWjueIjUmzM6Bl5+6t:bpvQvJbwT6odPWrSRO8SOAOZgjFOLzdZ
- TLSH T122E533FCA5ABCA0FF75473F5DCB2FA10164D122A7AB95C59079990C5321CE3E620A8F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXC8FF9A32F31F45A19D4FD357253B15A7
- Size 2.6MB
- SHA256 ceab32c1a489798ca58f763041ab58759be62c9d578e2fc81d9161467a77c407
- MD5 a9f5bde9a0629fc5dd2d64dde8263219
- SHA1 654586f814c3f4d228b7d899eab3374a398caed6
- SHA512 ed2c0a2d5f70e5fceb19f1c3d81cbae92dbf45792ad62c235f3a0f6e3791b6307caaeaa5d510c45cae58ccb3b66aa09c66054ca9ce498cb8e887fc90a1cf0aef
- SSDEEP 49152:VqTeFaiZMsEiJ72jv7l5X1zQERAjsF6w8gktICfp/H3EEuyoq/bxWShMvHk0KwWV:VbZMsEs23/FpRAj0LIv0Euy9/d1SHk0+
- TLSH T1B7D5336BE4814ECCE0DE7233D77446243E7D638D92902372ABB9E4913C6E97740DAC96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXCBDD333E6E6B4A029E0DFE84B76B8BDF
- Size 3.3MB
- SHA256 50b8240974a29d68a1179653d3cb3650fe04cf5e0e516cfb5cd2e0ebe1bd5931
- MD5 f2110103dd6b57a0d4b77f27ddd4c490
- SHA1 a779b5b0018b45cec96253d6b21ce7629a8d7c39
- SHA512 b797072a2591d21457cbe02111cf95433e10f4a5a37b706a485cf837b2606a0b28aa7ec5f95e26fd32fdf0ebe65b941e5eb445dc7ccaae60bc3f6e257c77c6aa
- SSDEEP 98304:zWITih1NxZWbR5wIxtoebGvDPhchW2LzECMba5:zhTWxZWbIqt1bsbhifLgCMA
- TLSH T160F5336596E2C8C3DC2897BAECE92F100A5F85FC3CD4A561791F1266EF1183FA445C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXDB66A2D77CD44281BA1ED51A8F20B7CD
- Size 1.3MB
- SHA256 78e142a332888e31ae17b558d30c0a262b78384a859bd11508cf7970ee339d77
- MD5 a440aa930192b7b2fcd890ba498e33cc
- SHA1 268ef851b9f9c3265838bab187a3b653d77bee81
- SHA512 bc4030820d03aaa80b44895afd8fa8299bb3ce75f406111afc5d11f494358760f556f7aecbae547dae3575ab6109c4862014839ae209779d79b35bece9b36e0a
- SSDEEP 24576:3GyAFHwGkV6vIHIc/mIO/EOJBojlgn+CPCmx+b2ZFBCsJByu/ClqHyMd7:WhFwGsj/mI2EIGlYbzxukBCstCTG
- TLSH T1785533711825CF92E8A01B3187FDB865341EA77DF9F336F609F990B81C894963506A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXE52D377E9DBF4C39AD0A4ACEB53C1465
- Size 2.2MB
- SHA256 e4a4d7a191dd9cee7603d1d7087933c03c30cb58fd531a321c59f4b7fdc75629
- MD5 f269b99438625f0bccebabc9c24ecd7e
- SHA1 7caa336ac8d948714c6a28af5146d8122dcbe6dd
- SHA512 562686704e9d531185017af56f75f226b27326348a4ec60c15c8914ea045c66b800c9d0763831c6d2dcb9a7d92ab3f7b160bee21aa1b517468727d68122b7f36
- SSDEEP 49152:/oZ94L+qOFgm7vfEDnfb7pJY4lRsonsqCQMEmdO/4IwZ7oF2:/IFwHrll+ohCQUdc4Iw82
- TLSH T12AB533661A63C9DCCE5B7774B3F24BB124DE17CA0DE03BA423A5E95474A9C6C0A061F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH