7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088

Analysis

max time kernel
898s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxStudioInstaller.exe
Size 9.6MB
Sample260903-try5hs1dle
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4400	RobloxStudioBeta.exe
468	RobloxCrashHandler.exe

Loads dropped DLL 28 IoCs

pid	Process
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
468	RobloxCrashHandler.exe
468	RobloxCrashHandler.exe
468	RobloxCrashHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioBeta.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	RobloxStudioBeta.exe
File opened (read-only)	\??\F:	RobloxStudioBeta.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4792	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Lua\CameraService\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Components\ScriptProfiler\TestData.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\VoiceChat\Components\getIconVoiceIndicator.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Shared\Shared\ReactVersion.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\TopBar\Actions\SetMoreMenuOpen.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\Output.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\Server\ServerChat\DefaultChatModules\TeamChat.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\util\MeshSpaceUtils.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Lua\StyleEditor\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Navigation\Enum\NavigationRailAlignment.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\RibbonTextButton.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\Feedback\Resources\Constants.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\GenerativeAI\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\ui\Settings\Players\Blocked.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Providers\Elevation\elevation.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\SignalsScheduler\SignalsScheduler\rotriever.toml	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateLayeredClothingInRenderBounds.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Control\HorizontalNav\ScrollingListWithArrowsAndGradient.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\ViewRecyclerReact\ViewRecyclerReact\ReactAdapter\createRecyclableComponent.luau	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\ui\Emotes\Small\SelectedGradient.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Lists\ViewabilityHelper.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\AvatarToolsShared\RoundedBackgroundLeft.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\UnitTestHelpers\testWithComponent.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Providers\Preferences\usePreferences.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Lua\DeveloperFramework\Dark\Large\Close.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\Common\Flags\GetFFlagEnableVoiceDefaultServerScript.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Lua\FindReplaceAll\Dark\Standard\ArrowDown.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\PlayerMoreButton.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\Method.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\ViewRecycler\ViewRecycler\Core\ViewportBehavior\__tests__\ViewportBehavior.test.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\ui\MenuBar\icon_leave_highlighted.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\InlineLayout\InlineLayout\Components\InlineLayout\InlineLayoutElements\InlineSpanElement\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Lua\PathEditor\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\ReactIs\SafeFlags.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox\ReactRoblox\client\ReactRobloxRoot.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\RoduxGames\RoduxGames\Models\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\flags\getEngineFeatureEngineUGCValidationIECTelemetry.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\fonts\AccanthisADFStd-Regular.otf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Markdown\Markdown\Parsers\CommonMarkComplianceParser\BuildTree.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\NetworkingChat\NetworkingChat\networkRequests\createRemoveFromConversation.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Enums\ColorMode.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\scripts\CoreScripts\Modules\Chrome\Integrations\ExpChat\ChatIconVisibleSignals.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\mock-31ab8d40-1.1.0\mock\setSideEffect.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\RoduxUsers\RoduxUsers\Actions\init.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\ReplicatedStorage.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\ImageSet\Enum\IconSize.lua	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\VCS\Light\Standard\VCSModify_Highlighted.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\studio_svg_textures\Shared\WidgetIcons\Dark\Large\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\textures\ui\ImageSet\AE\img_set_1x_1.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\content\textures\ui\Settings\Slider\Less.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Generated\StyleRules\Typography\BuilderSans\DesktopAttribute.lua	RobloxStudioInstaller.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_783211686\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1738144147\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1099638092\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1738144147\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1099638092\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1350487134\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_783211686\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1099638092\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1738144147\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1350487134\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1325654762\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_473143420\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1325654762\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_664057022\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_664057022\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_664057022\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_664057022\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_982127282\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_473143420\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1325654762\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_473143420\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1090319089\Filtering Rules	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioBeta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0"	RobloxStudioInstaller.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{0D029F49-6C7B-4847-B78C-135B680FC720}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\ = "Open"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe,0"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe\" \"%1\""	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\ = "Roblox.Place"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe\" %1"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon	RobloxStudioInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9fe94fb0e9d84c25\\RobloxStudioBeta.exe"	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew	RobloxStudioInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command	RobloxStudioInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4400	RobloxStudioBeta.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5852	RobloxStudioInstaller.exe
5852	RobloxStudioInstaller.exe
5852	RobloxStudioInstaller.exe
5852	RobloxStudioInstaller.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe
4184	msedgewebview2.exe
4184	msedgewebview2.exe
4400	RobloxStudioBeta.exe
4400	RobloxStudioBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4400	RobloxStudioBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
872	msedgewebview2.exe
1164	msedgewebview2.exe
1164	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1400	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4400	RobloxStudioBeta.exe
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 4400	5852	RobloxStudioInstaller.exe	91
PID 4400 wrote to memory of 468	4400	RobloxStudioBeta.exe	92
PID 4400 wrote to memory of 872	4400	RobloxStudioBeta.exe	98
PID 872 wrote to memory of 1532	872	msedgewebview2.exe	99
PID 872 wrote to memory of 5008	872	msedgewebview2.exe	100
PID 872 wrote to memory of 5008	872	msedgewebview2.exe	100
PID 872 wrote to memory of 5008	872	msedgewebview2.exe	100
PID 872 wrote to memory of 5008	872	msedgewebview2.exe	100
PID 872 wrote to memory of 2736	872	msedgewebview2.exe	101
PID 872 wrote to memory of 3524	872	msedgewebview2.exe	102
PID 872 wrote to memory of 3524	872	msedgewebview2.exe	102
PID 872 wrote to memory of 3524	872	msedgewebview2.exe	102
PID 872 wrote to memory of 4580	872	msedgewebview2.exe	103
PID 872 wrote to memory of 4580	872	msedgewebview2.exe	103
PID 872 wrote to memory of 4580	872	msedgewebview2.exe	103
PID 872 wrote to memory of 4580	872	msedgewebview2.exe	103
PID 872 wrote to memory of 4580	872	msedgewebview2.exe	103
PID 4400 wrote to memory of 1164	4400	RobloxStudioBeta.exe	104
PID 1164 wrote to memory of 2608	1164	msedgewebview2.exe	105
PID 1164 wrote to memory of 4644	1164	msedgewebview2.exe	106
PID 1164 wrote to memory of 4644	1164	msedgewebview2.exe	106
PID 1164 wrote to memory of 4644	1164	msedgewebview2.exe	106
PID 1164 wrote to memory of 4644	1164	msedgewebview2.exe	106
PID 1164 wrote to memory of 5364	1164	msedgewebview2.exe	107
PID 1164 wrote to memory of 5856	1164	msedgewebview2.exe	108
PID 1164 wrote to memory of 5856	1164	msedgewebview2.exe	108
PID 1164 wrote to memory of 5856	1164	msedgewebview2.exe	108
PID 1164 wrote to memory of 1076	1164	msedgewebview2.exe	109
PID 1164 wrote to memory of 1076	1164	msedgewebview2.exe	109
PID 1164 wrote to memory of 1076	1164	msedgewebview2.exe	109
PID 1164 wrote to memory of 1076	1164	msedgewebview2.exe	109
PID 1164 wrote to memory of 1076	1164	msedgewebview2.exe	109
PID 1164 wrote to memory of 1832	1164	msedgewebview2.exe	110
PID 1164 wrote to memory of 1832	1164	msedgewebview2.exe	110
PID 1164 wrote to memory of 1832	1164	msedgewebview2.exe	110
PID 1164 wrote to memory of 1832	1164	msedgewebview2.exe	110
PID 1164 wrote to memory of 1832	1164	msedgewebview2.exe	110
PID 1164 wrote to memory of 4280	1164	msedgewebview2.exe	115
PID 1164 wrote to memory of 4280	1164	msedgewebview2.exe	115
PID 1164 wrote to memory of 4280	1164	msedgewebview2.exe	115
PID 1164 wrote to memory of 1480	1164	msedgewebview2.exe	116
PID 1164 wrote to memory of 1480	1164	msedgewebview2.exe	116
PID 1164 wrote to memory of 1480	1164	msedgewebview2.exe	116
PID 1164 wrote to memory of 4184	1164	msedgewebview2.exe	117
PID 1164 wrote to memory of 5788	1164	msedgewebview2.exe	118
PID 1164 wrote to memory of 5788	1164	msedgewebview2.exe	118
PID 1164 wrote to memory of 5788	1164	msedgewebview2.exe	118
PID 1164 wrote to memory of 2072	1164	msedgewebview2.exe	119
PID 1164 wrote to memory of 2072	1164	msedgewebview2.exe	119
PID 1164 wrote to memory of 2072	1164	msedgewebview2.exe	119
PID 1164 wrote to memory of 1112	1164	msedgewebview2.exe	121
PID 1164 wrote to memory of 1112	1164	msedgewebview2.exe	121
PID 1164 wrote to memory of 1112	1164	msedgewebview2.exe	121
PID 1164 wrote to memory of 2264	1164	msedgewebview2.exe	122
PID 1164 wrote to memory of 2264	1164	msedgewebview2.exe	122
PID 1164 wrote to memory of 2264	1164	msedgewebview2.exe	122
PID 1164 wrote to memory of 5880	1164	msedgewebview2.exe	123
PID 1164 wrote to memory of 5880	1164	msedgewebview2.exe	123
PID 1164 wrote to memory of 5880	1164	msedgewebview2.exe	123
PID 1164 wrote to memory of 4412	1164	msedgewebview2.exe	124
PID 1164 wrote to memory of 4412	1164	msedgewebview2.exe	124
PID 1164 wrote to memory of 4412	1164	msedgewebview2.exe	124
PID 1164 wrote to memory of 5092	1164	msedgewebview2.exe	125
PID 1164 wrote to memory of 5092	1164	msedgewebview2.exe	125

C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxStudioBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe
    "C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 4400 --attachment=attachment_0.737.0.7371584_20260903T162134Z_Studio_967CF_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.737.0.7371584_20260903T162134Z_Studio_967CF_last.log --attachment=attachment_log_0.737.0.7371584_20260903T162134Z_Studio_967CF_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.737.0.7371584_20260903T162134Z_Studio_967CF_csg3.log --attachment=attachment_log_0.737.0.7371584_20260903T162134Z_Studio_967CF_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.737.0.7371584_20260903T162134Z_Studio_967CF_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.737.0.7371584 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=5edcedc5242d3cc71d4f9fbc9e73967ed4bf1c87 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.737.0.7371584 --annotation=UniqueId=8531589689754029411 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.737.0.7371584 --annotation=host_arch=x86_64 --initial-client-data=0x484,0x488,0x48c,0x460,0x494,0x7ff62308daa8,0x7ff62308dac0,0x7ff62308dad8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4400.2220.11693410391091956319 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffec7535fd8,0x7ffec7535fe4,0x7ffec7535ff0
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1864 --field-trial-handle=1868,i,15423990016112682529,18429866857722632621,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1868,i,15423990016112682529,18429866857722632621,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1868,i,15423990016112682529,18429866857722632621,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1868,i,15423990016112682529,18429866857722632621,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:4580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4400.2220.17839337096954656349 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffec7535fd8,0x7ffec7535fe4,0x7ffec7535ff0
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2528 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2620 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3588 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3944 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf /prefetch:1
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4744 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4956 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=824 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5092 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4788 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5108 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5068 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5080 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 737, 0, 7371584" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5012 --field-trial-handle=1780,i,12839016132543875824,12795255289434794259,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fa3bbf32ccbbb8e420a6abac8273a8637a33fddf
      4⤵
      PID:1932

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004A8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3060

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

qgif.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\imageformats\qgif.dll
Size 31KB
SHA256 dece9af97994b58962a3aab7da662527e509b4c86a8881bc93fda31d048cb18b
MD5 99975861a5d0d911055bc3a74c6a9678
SHA1 7aa39db708751a6f5b4c70f0a459acf8757640b2
SHA512 5e6f24b1c717fac7d363a2753a2fdbb07d4162567c6149bd10e1f823f7b372db991fdcdb62e8f6e9d2a5c017a0b069837bc898d69ed0bab5efd78131bcc1d902
SSDEEP 384:pk2xgrGXnLxRwrbos5k3Xjsz77RoFXRnxqVbn+rPCHJ9RPzN4XNuBSMhOliycGNe:dVRwrbBk3Xj+7OFZx17nMgxfNGyMh
TLSH
T1B5E21A51AB7800D2E153C278C82B4E2AE63AB9309B6397CF476255790E337D17E39778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\imageformats\qjpeg.dll
Size 437KB
SHA256 beecab928e1a2adc179db2f959c38798bfe06d6a84c8720d4a62a71a61388884
MD5 0b9d61478c31e86b146ece524e0ee7ae
SHA1 ada89e70eb76728ede965b9f1c119590ffcb5961
SHA512 0673249659ec54b8f773fbe951592ab4de9f4380ce073198ee386d5440ea64d80539aff1efcc6cf49220cb877ffaf9797af40fb9cf7f5d819f6daf12563068e8
SSDEEP 12288:20bdHW+4bJKYjtnLqgYIqcUcYHtpP880E3JxbwEcS0vPh10syMLzBhfywIsD51PZ:20bdHW+gF0
TLSH
T182949243F2605C87C7E54474EE6AC1A6E785B81CC7FB46F779C1ABD97A226F0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\platforms\qwindows.dll
Size 1.4MB
SHA256 f389819f6aaab61aee384e93996d5e4326b8e3b8c956f55d62b042c1dcef9866
MD5 884071d45df422efbbfb24a07172d9e4
SHA1 80540a7878e896dfcca1539e692c52fa76f44c2a
SHA512 63ea7de2f6363a2fb774a683a7fe9d95a82ddd521b5145b6bc97c4f51d9f1ab889b19ec2eeb5fe60c3d29aec5c224881050d9b59cd725e8d4cd4a283c17ca510
SSDEEP 24576:IeEQtwlTkBnj3Htp4ysAqV3QXscl+HflpWkiVPaEzeZji:ElTkBnLHtp4yslV3L//naVlzA
TLSH
T119659D47A3A48298C26BC23DC65B8B17D6B1700503619BCF11A9CE597F63BE3277EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Plugins\Qt5\styles\qwindowsvistastyle.dll
Size 134KB
SHA256 7adcaa0e2d1f2837280adee6df339b3e7b934e7edeab653fc80bf390e622317f
MD5 59f7f63e9c0a42bfb6bddd77150dd9e2
SHA1 ac5524db6f171941b51d09c0df160004bba95dab
SHA512 b405747868030d63c8173bf8d51552d05e326938389470246fe6a3df3f45eb1ea9eb75dd910df5faba61891c11d5444fe8d35b5b03de40b779479e24c15e2e9c
SSDEEP 3072:UYfJgCoOdX7MNwr80k7OTGD+FJ+FOa/MFWxmqd0SRVdff:9BBXwLGva/MFWxmqd0SRVd
TLSH
T1EDD34D13726602CAC463D2B8C55F0517F7B3705453224BEF06A7CEA92F632E27E3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Core.dll
Size 5.8MB
SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
MD5 5979d6d629dbe9bb074bf2c771f22499
SHA1 a28a748f5fd712fdad425dbb6f1f53c4b97bab6e
SHA512 5c296a8eb3f48ca741bef70e44aa6103edeaf903637c83fd9695e5be4465188a0aa5d5d2c4b707cd5233c0a19782e2857b11aca1ef33e408ff0b2e1cb739fd15
SSDEEP 98304:Zp4b13+8FH9aoHVJsv6tWKFdu9CwjiC6ExqfUCAgw:Zp4b13+8FH8EJsv6tWKFdu9CwjEExqfi
TLSH
T1E7568C8776AB0254D0B7C23CCA97811BE672B8018B218BCF126CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Gui.dll
Size 6.5MB
SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
MD5 b8a2735292a7d9d69bc4a09da80a5f00
SHA1 0d3691aaa492bb5b8a1f25e00d5179894f2973f5
SHA512 4103ee4ac9ff72bb766a4dd5bc1b2e3de0ab101de3b19c787856685301a9829c20f75785ea4243bf62ff5e33dae07df6c47cabf84cfc69bb84d8ea9277b7349e
SSDEEP 49152:GxTskH658roWctQZMvBFlAdOqymGH7tTZDsY3hotW6pgCnuoyiugWam/5zmKxwJR:aTs4oNyKVlaWGuraUeJrZxcZ
TLSH
T1AE662986725A6252C977E27E8B4F452EE1F3785283428BC748159B480F737EA1B7FE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Network.dll
Size 1.0MB
SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
MD5 dcf774c4da98b2142e2db51b5a86b510
SHA1 e1481f0af6accafcedc683d69ac6ea47a18dc782
SHA512 2b6094586c95c9701aa5172a40423e585cf74e15bb41735180ebce1ed42479c14e8a51fb73b51cfd8e7283800eb679fc1b8016f25107e4670ff11279e08312e3
SSDEEP 12288:3KmUigw+uCeCrGwtfA8v7Q5EGiVnBOzXvEfZxgzwyU1DC9:3Km5guCeCrdtf/vMKG20YHgzwN1DC9
TLSH
T1E4355B57B36103A5D46AC1B9CA8B8616F272700187279BDF5629DF693F337E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Widgets.dll
Size 5.3MB
SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
MD5 e0f661dbc795f2794a392250819a803e
SHA1 01b41f59675e50074fc16267e5265659ad43e199
SHA512 1ebec23d6439152f6b00b87002c0df67dcda52b255a9f1a44a4629423c6ecf581a0b78e6aa6c3f5b5bf7846b3af0c3f5319d07142ab69e2f268972a77ca33fd6
SSDEEP 49152:MHiz1l7ZWKSwEaNjsSvVFrta9oxH57t/5yE6fkpQEVE5llmbx/qUqjfQdwXtmLu8:Nw2ELwHkWSUbdwXtmLuxY7pCQ6E
TLSH
T135466A5BB3A54195C56BD238CF8B8613E6B2700447228BCF256A8F592F337E12E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\Qt5Xml.dll
Size 204KB
SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
MD5 5a283d1709c6dae688f071ca0c092b48
SHA1 57fa6cf1fece16ac0cf29323ff8ee5cc49044952
SHA512 410fb85952a9dc98f80b3ecf87dc4d9fa22ce4eb27983dc1b10919130e9d2ddeed64e199f72de69edd4ea9060aaab6f4092cb1241b911043ad3ffacf02386197
SSDEEP 3072:n1pI5DweOktRkjiHRv6XG1/tGACswdqB2dLKskgCjHT5Dn9S7Y4OlK:n/IZweXWoRv6XG1/tdDB2dYz19S7
TLSH
T1EE243A4777254596E42BC238CE1B890BE6B3B8501762DBDF81558B792F33BD2B83E250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanBase.dll
Size 1.1MB
SHA256 43f05f34af9eab78549c1b636b1560176decaf4b685526c3833d8c4d89d52e54
MD5 0619c473b1b51dd02c1425652f0869a1
SHA1 8aac2dd2899750f04141cd322018436457fd506a
SHA512 7058a41f64fdf684341b4c8aac5107baae86c6c1ec81f0cc9e22100fc5c39c5aac0e594f875d10e04de5084d7309f0ce2827fe6a40082ba1c292721897d630da
SSDEEP 24576:a3nRLlUv+otWr8wY6S8dtuTbwQHtivsM:aXXUvNdwVu/5UvsM
TLSH
T1FB45AE4B33964352D16BC278C69B8114F07734159B4286EF9A2BFE291E333E5383F6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanDocking.dll
Size 620KB
SHA256 bf24fd350b7166addcdb68fcc7204c6ff092bd071a0e456042583843359ea0cc
MD5 3d706926fc3da9a327610a35f336c1ae
SHA1 9ed8be3e1488248a9a760444f28eb2ca669a76c7
SHA512 3735c5659c0fb4a1fe979b1c684ac3bb1f0ed61d0d41bd1a98c85857388edcc7dc807a8baebe675db64ffe1281e67c3618c7d256e4559dbc1cdab4a5cc6add51
SSDEEP 6144:VhZG/VmTHcuEaelhVVSmDLvby3oohcDkxAMtn3MTD2pu/Qg0Ew9GqlUedgsE2Ekn:VaJagNSmDL3ohcDg/hMSu0EWTHLaQ0
TLSH
T18ED45C1B72B80391E0A7D138C66BC526E4B778414B5286EF7216DA1D6F33BE13A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanOffice2016Style.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanOffice2016Style.dll
Size 218KB
SHA256 3b248e50012469038589b3a8a0976570b28021a5b3349dc5d9b166b7d19cdeb6
MD5 62a174e64968c1e44c7d3a2af6c5b47b
SHA1 1b69624f9a8ac3e6b0fd040842bba3489d216d0c
SHA512 0937be1a6c0be7ba18f6d47b25cb0794db82eefc978f0bf35bd07f5168a440f1e46a9fab1cbe5ac798cee73f1fb043a12c2005c0ec40d949cb741f0ee9cf9a96
SSDEEP 6144:v+LXUiB1+zTvQyvFn48z/hhkvkG4TxppJZa8ECgVRa4J4U5Zwfw+FKe:WLXx1+zTvRnQc
TLSH
T1D524F74B72960796E467C27CC68F0125F6B374548702CAFF051B9E391F33296BD3AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanRibbon.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\QtitanRibbon.dll
Size 3.1MB
SHA256 e99860d832931bfd751db819f88f553c37d7e905f33f116efba2870116816e26
MD5 92d020b546cd3a06aa17a2a9da58b590
SHA1 b4cbfae5b2eab821e34189e8294b146dff4fbc5b
SHA512 cacf585bc02e35669f18849415ac1cec90da8f6ee70a2a0007953defcb3a8faa22b6d61f97f143ab43353b92a5ccb88607ae59cf3af3ee6402a1ac013649cf86
SSDEEP 49152:LfTX1OLVyjq4LbhndL1ZsY0LUGGaVGvYEnCWmLn+XYQ1cc/RotRNC7C7C7C7C7CW:LMLUjbLnL1ZsY0LUGkjCWmL+IS
TLSH
T186E5DF8B779A0298D2AEC13FD68B4155F6F7748A835396EB4826CD1A4F333E06C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\RobloxCrashHandler.exe
Size 11.7MB
SHA256 85e4cdc59d30fd9a3ee4fd3eac5fe251af9f9b3f2ec717761617b101d01bc57b
MD5 c6d561c050ed4907dc7d3a124d41b042
SHA1 ba1ab7a05e9b408d296260ddb09e839fe68c658f
SHA512 4b86439076e078ed7be0fd03d0c5a161c3e649ae9e338beeb9b6fb8f173b8e27fa18af53bce8211fcdd9ca5d8427a7d365430016c9e251d36ebd8e419e59ea40
SSDEEP 196608:K1gUWVf7F27wHvlaM2GEBgM6Cir56LlDhTg8:HVhpPgyEBgTCXLlDtg
TLSH
T1D3C68D6AB2B800E8D47BD17CC7469607EBB2741603609BDF16A446FA1F63BE41E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\libfbxsdk.dll
Size 9.7MB
SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
MD5 51d82c0e8ad65126413ed39246b5cf46
SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
TLSH
T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9fe94fb0e9d84c25\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Roblox\0\InstalledPlugins\0\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

564995a1-40dd-453d-8714-ddbece4096c3.tmp

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\564995a1-40dd-453d-8714-ddbece4096c3.tmp
Size 15KB
SHA256 c23b27340a1627eb1ae3824d984cdf81b8fac016042c87706e88ce0e612c9ec6
MD5 7b9344d6367bcb13155db38f4c919bc3
SHA1 75f750487fabfd0ecb34fb3cd8d2a7409b029b00
SHA512 59444dbe46c934d10c8bec845eb5f3106605f885445286ce38caf222735718c23237ad688212c375c6fc409865d919e0f3639b4c2e9c34df8bc91066878219d2
SSDEEP 384:K+aQikB+z/xvxjg/qhE5NBSJvFFZjrWh9zm:V/UxvxjgC+YLnyFm
TLSH
T1EF729E2BA5BA7E27D6F7EA04B94D0B4FCBB8A47251C12E744EED1F0D06873981346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ff0b461ba126e03b8ba279d32b7d51630dfc7099123b48ba1b28916d94791a42
MD5 a5970ecf6b53352b53a24724f7e73f31
SHA1 7a548988de5556ce1b30dea08abeb4d28596424f
SHA512 006666dc622422f3995a08656182b4b5ba7438f44fb27e280139b3cca98cf0bb9fda2adc4923517c0dca8517b30c6086b60c8b844fbd51ce4d9adecbce4bb040
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bb42ec7b864707caa06686c7b461b09d136b8f6d8a5ff61afc9783ce5b2b5fa0
MD5 1c32b492e08e5b3ab9d8dbea5a13e0ea
SHA1 f414b67efbbf0973eef00d016f1ac6428a383c96
SHA512 692496295a844042cd9646d1b392bac0c39137759e981be9fdf13d2c0a72ac2c66a9ce7a046c2d6967734d062619877854010567af14d281e082e83f4dcbd243
TLSH
T16BD0125232024234C06121370873660D0500C50F400F8040D82CA61E2E440540902451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2b1c4e9837798aa9af9890fb4e43213142c08d97f2f9ac15012c69c61af7a072
MD5 e764ff4c414d31a51944bb34ba0f3b81
SHA1 e9cc80c9f7bd5945081671b54aa179e2b638a257
SHA512 85b70b61205a27730046733af50e9b55862b91de5a7388acf82b650cf1f9e56936dab6c048f65a790b408562340a1a3e6bc9118cfe87920f43eecb2ccdde1410
TLSH
T188D0125236024234C06122360832660D0600C40F410F8140D82C962E2E440544902451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b5f2c245af38f6d15f1359c80f497e005634bae5ecaaf3308387d586bfd34ae9
MD5 80db6aa8c7b81a75298d3eb56691b902
SHA1 cf22d151b7218ccad2c9b0ada7a6434891925f89
SHA512 579aee586b2da483a7da0042bb86f3dda178523bfe9df140aad64857765b6fd4a1fa7bbd1f9b4c4324288737bf06aecdb929e724b5c28af3bfcc232ee59ba6e0
TLSH
T16E410CD5F9C05800FF6959F0109C6F4AB6181B21593F6F673AD0C0368C43AE4A926EC1
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 9f0985b66297f438eba8570eec0838cccf6d1671661b47179414a912c0bb413a
MD5 e52a260fc613763120cd27dee80c4515
SHA1 3bc35005006c67262ec5922b21f39d4e97741e88
SHA512 e07f30effaa33c2d9dcd999da107b785f440203eafd13cba9eb905aa8599e461bd3e7357e4bfc960c2a576858be780c329934beaf2306a7e4e4b746623b2fd9f
TLSH
T1C9419AF353B4CA6D9A1653F42A15AD1BCF4C0430071C2576C5D0BF9793A25B2E211B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 473a6a816f7e48890d1802667d69f4fa89809cbf2ef03a8dc0ee05b6d5a245b6
MD5 b56c1a695710e61b575a51e7f54fd44d
SHA1 7a6a5178b229499ec516d4caff2ea08138890012
SHA512 beb1538f2facac76fc165ce82449f309192e0c2b3102f93effedfaa76e051b4ce9a341a3b8fe156db1386ce44f784d231a2ae34c2615f403c18dd7009b37a523
TLSH
T111416AF353B08A7DAA5652F42A199D1BCF8C0030071C65B6C5D0BFA793A35A1E211B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 351e83c41d5b5fbe176ad2704ef804e95468750ca3ca09ffbeba9094d4bce0cb
MD5 806495f08f50494738d8bb23b57ba587
SHA1 80a2050a53bf586eaf3f2f3223e7dac3178e6b8d
SHA512 19bd9004769e09f985cc40eec91e1d978bb92c6cc1c02fd7d1210e89335064790d5ce7b5cb783fae766a65148db368e548c434f12ebb54d34cb1a2490a8ed874
TLSH
T124416AF353B08A7DAA5652F42A199D1BCF8C0030071C65B6C5D0BFA793A35A1E211B9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 f23fe12088a3792be54e323efcd3b41eeca137cdcde99dc2df23a3f851e678ce
MD5 296e5afc3783486b5b75fb48706926ff
SHA1 79f6c455e62ca10eac571f167df79aa639db678a
SHA512 f58a5b3cecc80cb50f64e0238cd9d7222b13603b510b42c67043a1b02470aefc70e9c223efa5f9016856ad44e22e422bdbb96ed47604fd509c5aabe6db74790e
TLSH
T1AA417A679D7AB98B55390D7F1F847C0A35BAB8391051A8F8EED3C86DB0494F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 245471158de1543452dba65a535ed71459f586b1cc3e7daa50c9f3990a3d7487
MD5 463b47e0de8e660b1d56a2bbeb9d6208
SHA1 d8ee9808a160f34937fecbbc9a718efe0a746b95
SHA512 7e2d0411bbc00c8ce0cf1eeae9c033fcbee23c3ccb2b5963b53f2a2a9c5e5391805a0881f742624c167ae823e2919b42d13cee1a9678cb570ad363a8932bbafb
TLSH
T1C7417A679D7AB98B55390D7F1F847C0A35BAB8391051A8F4EED3C86DB0495F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 d333ff6223f10fa5e20c2d06f852d75171761efbe113ab8ca156be568034573e
MD5 673625f9db7419f72a91b2c1484d8ba4
SHA1 6537cf62ce3f61eb4721c13a04b9ef0d7067f67d
SHA512 dcf672fad0a676e53dc2d95a6ab7ea2640dd5e313d045f68756924b2560be715d72f8b1f488b3b52d0b3bfd48cc3a03c720834d8592fb6228347e05334acea64
TLSH
T1B1415767997AB98B51380D7F2E847C4A35BAB4351091A8F4EE93C87DB0494F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 84ab1703a45176747672790933dab46ba6fdb92d4dc731e50dc4a2c46d326856
MD5 55bbe6275dd4749d68aabb542aeeff1f
SHA1 8d505c6712d84720f7de19a5607926c1bcd1ad79
SHA512 6e9b4fd91b7613015a9915b94daf68ef3d2aa84748d8f5f3ede7fe05652d9d926a8fc37d3f3bf0275bd70df954e874ac8cab52fb3eca89e9db5c64fdc082c938
TLSH
T182416867997AB98B51380D7F2E84BC0E35BAB8351151A8F4EED3C86DB0494F31725072
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 a97cbaf5d0ffd4ea12e1ca18027fd56d7c7ba51ab1acd524fe2b21d107724e48
MD5 2d646aa8b2697a1eceda05511a1cac8e
SHA1 0c801840c7d99c5568d727ed138872544d1fa4f5
SHA512 7e9e36f32af84fff6469a17f54afb6f4eda9fde72e177f2c44ae7ea08e2ba33da3385af78cfebd9c1db88e4df5ead4fd0a4b837ff55f31bc5c02933d8af3cfc1
TLSH
T176418967997AB98B51380D7F2F847C0E35BAB8391191A8F4EED3C86DB0494F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6dc6444425aff79ec0a7f9944fb9bd6765959a6ef40d3b0622a6042f534d791c
MD5 1a9a7329c372debde235546d7fda6e59
SHA1 caec857dd901d1ef781df220050f9c9c7f05b1e0
SHA512 b71b17f2fc6b5d21676f6a560704c1eb6db46d409d15722b110c81dd271074787d3ed5cba6b0c45d31092bf88c7ba42ebc5597f0f5bad06bf9b995664a45a1f1
TLSH
T1ED417A67997AB98B55390D7F1F847C4A25BAB8351051A8F8EED3C82DB0494F31729036
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 0931ca0e019f68e5f4d8011c0bdd7dd393a5c1e281e434321254d5604e416db3
MD5 5ef1f9d555e629da521904378db46d4f
SHA1 ae4a571941d0b500dfdc64cb96d6de2fd93cc8a1
SHA512 93a34888fb3811aeaa21943c0f9296a21c9a9fc004a2ece86f9b8e390dfc015c27609e8ee7fc3f54d70f1bab7f06e4ad6c0a91e6b97ad18df6233b8d371edf56
TLSH
T146417A67D97AB98B51380D7F1F847C4A35BAB8351091A8F4EED3C86DB0494F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5beb47.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5beb47.TMP
Size 1KB
SHA256 59c8ae4ff84e56035b607d0ef51bc23ceebbf505dbba48e82525b4bfb8110164
MD5 1beecd0b45e0a34f7bba678bd31604f3
SHA1 ee7e26b30a6937d27907309c4a1578db5491589b
SHA512 050295d913d5152086bcd34375e81a9fd117431436c10f6ec2a6d0a26b104380721359270ec72796f53de5bbf793251ac30b64d5fc1e61ca01a4726d42ac3116
TLSH
T135418B5B9D7AB98B54790D7F1F847C0E25BAB8391091A8F4EED3C86DB0494F31729032
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 85f3f679bd5744c12f1cad415789f350e2dff5039df641c2145f5e97e8842487
MD5 53b73ff21b5bbb6cc7a9fde46d27e257
SHA1 c0b114b45f7f9c21ab0b5fcecdeea2c52e07aa98
SHA512 53f36e046d63395b990daaedd41dfba89e560250def75fc8f562d1eb52826492cc47fd6ab82561d4980b933423acc84c12490cfb964f4147188c724429019d0d
SSDEEP 96:stn/dxJcbbDWkOdo5h16Zmys7/x+6MhmuecRyH1ejexK+gXF3t28XM1C7K:st/X7JodysV+FtyHQj7RFdG6K
TLSH
T14CD19502AA64BD7B4CCAE108FA69BB13D3FAA06274D51E48E7F8492C05D76DD2307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 d63df9269baf57e3f51c3a04e4283cdd52aa3659d61283e6b35dd567ef95b835
MD5 f8efc08764926a180ef24be934fa91cf
SHA1 07e621f8c8d67bce80eeca3161d2313b7f0b9342
SHA512 0219f84fdc078ab7650751500308051e10061962b3cfcea7ba85f8940b7bcdf429acdabcd34470cf05d7039c2532d26893bcd8322e90f8035118848c30b45892
SSDEEP 96:rn/dhsJcZb9WkWdo616ZZs7/x+6MhmuecmjexK+gXQkI8XM1C7K:r/gbnojsV+Fij7RQkg6K
TLSH
T1BFC19602AE64B97B4C8AE108FA757B03D2F9A03275D51D58E7F8462C09DA6DD631BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 4c5a7cb5da600c2e79657b70710355eda3c34ca7014215d8e522ae30c67fc7ca
MD5 2c6ab6384f4d574c00544f2fbf87abaa
SHA1 1b29668e4737c4d9b46b902d29c8aaad7c03a9db
SHA512 991a4a3c5d82a29ee6883b187c7f77f62226d7dfbab25ae8ea3e7ff91a2ea7ca800f2feb5058933cacf0912f6a28ae525c1ef737087fc0ae662bca16c83d285a
SSDEEP 96:stn/dxJzGbbDWkOdo5h16Zmys7/x+6MhmuecRyH1ejexK+gXp3t28XM1C7K:st/XNJodysV+FtyHQj7RpdG6K
TLSH
T16BD19502AA647D7B4CCAE518FA69BB13D3F9A06271941E48E7F84A2C04D76DD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 efe2a5d3f07fb0378ba8cca958faac1348fffadd3ff804dfc620902ab7dd4cbd
MD5 df0ce1999b322024c78a38c05a11e6f7
SHA1 f62c726d35e95da49a7db796424c92d3aedf6993
SHA512 255925eba9c2f23a82e050de9d88a975a37e8bdcd889abd093190f66578fc32dadb1ad289a6662ab19b65330871ee25cb3658c4300ad00baad2df804343d1675
SSDEEP 96:v1iLPlf/ROo1pkF5d1oiB7VaTEv9V5h5pg5+e0fk0AIXg21deIXPuN:0jvAn9l/kWQ21deIfuN
TLSH
T15AC1A5A7453DC574EF448BEBD8387ECB9AA6009F98C5480A96E2C48C07C1EFD21DE8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 519d30f23fc5ec95d48912fc242489b86965fe73e9a814ddc361dc6c0ab81ed5
MD5 892d4e78478e10ee55437fa7f9078b14
SHA1 e76a6c0ca2153a9a20b92150bacd1f925902c215
SHA512 43fa84d043bae98f0472b599b860ceaa48ec3110bd4b1057e77d4eae4dcecca8e2dc5e95e65ab5b6f8a72e0fc8be037ea2456d7f9d7f3e3e99d502d6654bcdbf
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 335B
SHA256 293172c9176e63ee0125fdc457cba294d7fffdf77a29fe73956e28dc6748ea81
MD5 e30290a867e1a21058872284f74a6a4f
SHA1 0211919d90c0f05b2e7b7b27d68404624e457616
SHA512 827167fd1698aecc9c593faa2881d5110da1e99f53023a1a3a73fa7567ccfbae726a63559678f173a5ad1c09608b7c8530668fa922b796f98d37c2b4171098fd
TLSH
T1FAE0D8B0B9CB852B22C584EF2272E34DC2BA740BB6DE12A59E15F648114B5487107781
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Visited Links
Size 128KB
SHA256 972b0acf4442d046a791f283692bba0899446b58a297596ca10c2d524991310e
MD5 9fc3a91113343a45276b3dffbf491477
SHA1 78605b28a83f0c4b4ec7a5e3253dca10e239f1a4
SHA512 23331e1b9df36de92707523de0e76859cdf1a013a2a57e5439c21c8694843c38ef66a974a4c6b00ebf55b7a8be1ecd3422eb3e0649adb6530247992cc5186af4
SSDEEP 3:ImtVPdm1:IiVPk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 2KB
SHA256 d28896364a9f6cc041e207b9b954139bd96d88db280d3408986ea7e57c8d7dfa
MD5 2b2483a7df82b6f59a1378321a1ea2b2
SHA1 8783a5b6a9197015d82c8b26e5c76a336c40f02f
SHA512 f34838541d98daa1ee34d2e750e443394053946d4b4fe8df4139e836d7bd2bf80ae8707fee359453c57af96427042125b01b889864ab7fd4916ee49bb1c5e200
TLSH
T1E8519573BD717E378AE25A08B94B6B239F359051AB121F4099DC0F0C019765D2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 91af45ad492af16ff2db9264ac4e8f16d93ef6e649513d5c064ad8782d169fe0
MD5 0e7f1ceee8cb10c24d99d9d76914eb77
SHA1 e5d5bb17d1aee58a53c350beade063c4ba454f33
SHA512 0aec25eda62b7343eb357253dc2b7352039ad2e690eff2a95ebda31db577c6fc2747be8af9e7cbb021fe5f304a2d1cdeb2aa466c4d04abbd9354e4a7e769edcf
TLSH
T1A9616376B971BD274EE29A05B9862B17ABA59023E5813F94D9EC0F0C01D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 b333051bf64ba4dbddf64f02e27d6a3c2ade4ccfcf9d664e73922f7efc042b26
MD5 b2534af9e44fb72c8376cca24ffdd450
SHA1 79b202bec890c4f622c1f79199ab301fb762f408
SHA512 bf2db9fb75e0bb05f24717d5ca9788c54b2f833ceffad970d3fd6d3f7069ccf06481faeb3db3885fe7d54da73905b856db8d1cd3152fa71cd3ed2574b113202e
TLSH
T15671867679B1BD274EE39A05F9862B07A7649023E5813F94DAEC0F1C019738D1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
Size 3KB
SHA256 89af22fb624ba280cc4d8263d3315e048dd5e106afe42dc22baf47769e298f9d
MD5 6ef4d1e4d5a4550fc81e404a38d30b45
SHA1 abc870cab80632c6015506612c2ec670bf2e81c3
SHA512 0daa2624b25df5ca8fc70089f46e73c51692ad98024777558c88f3eb535f9d28a1fd3610ba8f3994b12cfd9161351dff09864167b3e4379e5aef2963fe41dfc9
TLSH
T1CB71A67678B5BD378EE39A05F8862B07A7A49023E5813F94DAEC0F0C019739D1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5b8d68.TMP

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5b8d68.TMP
Size 1KB
SHA256 8e31b2ab3800287bddd7f5fea1f2511546244a389007e6dda52e21011456e3c3
MD5 2e5102dec1aa3fb0a8d5e0517d8e8070
SHA1 899db8ee0dc84b73ae262cba631ae1ed0bc421cf
SHA512 533dc33afda6b950de1e159f4d7e62333d3cca3a90a6891561b0d6fa5a009b1ac36bb5113fc086d7e8d978253f7e1f720ec9d8a3cbf946a4207bd624f2023adb
TLSH
T1412165F1F9B22F339F826A46B157A61B5F105063A3110E40A5DD4F1C02A618DA62EC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 484d7dfe28911838f57bbae468742b9af5b60ef4b332e890dcd89c69b567c804
MD5 bf127e1a28c38cce538d1fa765e5d38b
SHA1 34a36bcc72744b92fb6321581d89f5418f755d13
SHA512 1a458224f7151e487d9beba178a6ccfba3e34d80be089e73e11a1be97c9fabd0e361380473d49f1f2df8d8f3fe4b723ca1a722cb2526972cca7aacdb27180382
SSDEEP 3:LsOllllklkXlivJ7/l:LsUlPiR7/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxStudioInstaller_F11CD.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\RobloxStudioInstaller_F11CD.log
Size 7KB
SHA256 5e04c886dcdfdb20332d06834b90be730e0c2387eb3dce91f691290feb402556
MD5 6d717b6050093cf2e05598e48452ae48
SHA1 3c75493eb1a01ef475c29030282297ae0a159976
SHA512 837bc0aefb4c6db29ff5f4f77311db79455b670a185f06c78d2d8d88f36e0368b32143385e8b88cb98ad4e72f39e8365e939b40ecfb0901860e9e5807bf78e71
SSDEEP 96:KZLXeFSJbZ6lhBHPHLXLpupSvOhn2kSYO1b+I/W/JAhG6kkq2:wLXeUb4lhZc2Mcb+chG6kkZ
TLSH
T1D8E1FF5AD265043932CC128FA7435D2E9F137D052257E3B0F2DF609EB3896ACAAD5782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 e7220a74df6cf8a004e293f2e31d50b9986cb06a2ff5b5e1e2a0484db7a81c51
MD5 641cbbfa3649c55953305f5fa26d14f1
SHA1 2e8b403cb636f76929f391b2e7af085acb15ac8a
SHA512 846d1a06b5a6b242dc5d70e38d6257002311910e0c2b0ee67090ed519d4d9798577ae1d9e6ef6e7b80d53c9512f0a64cd7d37e94a003a76211683d135bb3a142
TLSH
T1B3A0022C56452148D8527425960609FD08AE56212C8811141765A6CC9FE9723D14D0CE
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_1405786797\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1164_405871267\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

memory/2252-761-0x000002D812050000-0x000002D8122AF000-memory.dmp

Download

memory/4184-982-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-979-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-980-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-981-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-983-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-984-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-973-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4184-975-0x000002021FFB0000-0x000002021FFB1000-memory.dmp

Download

memory/4280-859-0x00007FFEEC620000-0x00007FFEEC621000-memory.dmp

Download

memory/4280-858-0x00007FFEECA70000-0x00007FFEECA71000-memory.dmp

Download

memory/4400-247-0x0000016C1FBB0000-0x0000016C1FFB0000-memory.dmp

Download

memory/4400-114-0x00007FFEC9130000-0x00007FFEC967D000-memory.dmp

Download

memory/4400-115-0x00007FF615F70000-0x00007FF616F70000-memory.dmp

Download

memory/4580-347-0x00007FFEEC620000-0x00007FFEEC621000-memory.dmp

Download

memory/4644-755-0x0000026F054C0000-0x0000026F054C2000-memory.dmp

Download

memory/4644-768-0x0000026F05600000-0x0000026F05605000-memory.dmp

Download

memory/4644-765-0x0000026F05660000-0x0000026F05662000-memory.dmp

Download

memory/4644-754-0x0000026F05490000-0x0000026F05491000-memory.dmp

Download

memory/4644-759-0x0000026F054E0000-0x0000026F054E3000-memory.dmp

Download

memory/4644-760-0x0000026F05490000-0x0000026F05496000-memory.dmp

Download

memory/4644-756-0x0000026F05490000-0x0000026F05491000-memory.dmp

Download

memory/4644-757-0x0000026F054D0000-0x0000026F054D2000-memory.dmp

Download

memory/4644-767-0x0000026F05C30000-0x0000026F05C33000-memory.dmp

Download

memory/4644-763-0x0000026F05610000-0x0000026F05612000-memory.dmp

Download

memory/5008-333-0x00007FFEEC620000-0x00007FFEEC621000-memory.dmp

Download