Analysis
- user interaction
yes - max time kernel
265s - max time network
279s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
11/10/2026, 04:38
General
- Target Ghost420-GUI.exe
- Size 11.5MB
- Sample261011-e9fnkady6n
- SHA256 1ab85281a80dd02de04af092ee72dbcf43d0d9e5a8a543e05f41efb9acdb3639
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Powershell Invoke Web Request.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 18 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies registry class 30 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghost420-GUI.exe"C:\Users\Admin\AppData\Local\Temp\Ghost420-GUI.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3156.2852.144858217378300459762⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fff1875b078,0x7fff1875b084,0x7fff1875b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1380,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2280,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3500,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4436,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=312,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sirmeme.ghost420\EBWebView" --webview-exe-name=Ghost420-GUI.exe --webview-exe-version=1.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4244,i,17070150718457821084,16530959114361807232,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:143⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "try { (Invoke-WebRequest -Uri 'https://sirmemegithub.com/api/v1/repos/RealSlimShady2000/Ghost420/releases/latest' -UseBasicParsing -TimeoutSec 20 -Headers @{'User-Agent'='Ghost420'}).Content } catch { exit 1 }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exe"reg" export HKCU\System\GameConfigStore C:\Users\Admin\AppData\Local\Ghost420\reg\ghost420_export_3156_1791693717688.reg /y2⤵
-
-
C:\Windows\system32\reg.exe"reg" export HKCU\System\CurrentControlSet\Control C:\Users\Admin\AppData\Local\Ghost420\reg\ghost420_export_3156_1791693717788.reg /y2⤵
-
-
C:\Windows\system32\reg.exe"reg" delete "HKCU\Software\ROBLOX Corporation" /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\System\GameConfigStore /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\System\CurrentControlSet\Control /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "try { Invoke-WebRequest -Uri 'https://www.roblox.com/download/client' -OutFile 'C:\Users\Admin\AppData\Local\Ghost420\reinstall\official-installer.exe' -UseBasicParsing -TimeoutSec 300 -Headers @{'User-Agent'='Ghost420'}; exit 0 } catch { exit 1 }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"explorer.exe" C:\Users\Admin\AppData\Local\Ghost420\reinstall\official-installer.exe2⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Ghost420\reinstall\official-installer.exe"C:\Users\Admin\AppData\Local\Ghost420\reinstall\official-installer.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 22403⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20261011-0542.dmp1⤵
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-9b554450a0fc4e65\RobloxStudioBeta.exe"C:\Program Files\Roblox\Versions\version-9b554450a0fc4e65\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch2⤵
-
C:\Program Files\Roblox\Versions\version-9b554450a0fc4e65\RobloxCrashHandler.exe"C:\Program Files\Roblox\Versions\version-9b554450a0fc4e65\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 2064 --attachment=attachment_0.742.0.7421053_20261011T044548Z_Studio_1D778_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.742.0.7421053_20261011T044548Z_Studio_1D778_last.log --attachment=attachment_log_0.742.0.7421053_20261011T044548Z_Studio_1D778_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.742.0.7421053_20261011T044548Z_Studio_1D778_csg3.log --attachment=attachment_log_0.742.0.7421053_20261011T044548Z_Studio_1D778_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.742.0.7421053_20261011T044548Z_Studio_1D778_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.742.0.7421053 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFiles --annotation=OSPlatform=Windows "--annotation=OSVersion=Windows 11 - PlatformId 2, Version 10.0, Build 22000" --annotation=RobloxChannel=production --annotation=RobloxGitHash=1c8ca3efc668590d4a4a6fa1d1fd55945891d456 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.742.0.7421053 --annotation=UniqueId=7913409229557084201 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.742.0.7421053 --annotation=host_arch=x86_64 --initial-client-data=0x444,0x448,0x44c,0x420,0x474,0x7ff714a47cf8,0x7ff714a47d10,0x7ff714a47d283⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
AppSettings.xml
qgif.dll
qjpeg.dll
qwindows.dll
qwindowsvistastyle.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Widgets.dll
Qt5Xml.dll
QtitanBase.dll
QtitanDocking.dll
QtitanOffice2016Style.dll
RobloxCrashHandler.exe
WebView2Loader.dll
dd-win-prof.dll
libfbxsdk.dll
mimalloc-redirect.dll
mimalloc.dll
msvcp140.dll
msvcp140_1.dll
vcruntime140.dll
vcruntime140_1.dll
RobloxPlayerBeta.dll
Roblox Studio.lnk
backup.json
backup.json
backup.json
backup.json
backup.json
backup.json
backup.json
ghost420_export_3156_1791693717688.reg
ghost420_export_3156_1791693717788.reg
official-installer.exe
powershell.exe.log
StartupProfileData-NonInteractive
05ad996224bf0ecb21cd232070fbbd2b
10461fdfb35f35cca13dbe35dcf21343
1d0390337d1a4a58e5514be1a9481ad6
4f4c9d8cec0d24ea75a5850e2f437c3c
5ea6d67868506baa039fdc217dc3432d
62e414b0f47c1553aa458201d8212858
7071af81f7fad1d26ec29b7699f2d96f
7261e58eb4c49c6ebdad1ff1171a3360
8b51abc8ab8054a9eb519b3408c7bd1d
8f379ec2b22ff106b837d79f7fdbf0d8
b0eaea6e38883c2f552ebfc3c49a66a7
e90e79d9e1684e52378e9e9b8c40d651
eb9dd4d0637fd6ae21747e6b6a281d21
fe7b3ecee91e83f9fade72e8b0f4d47f
OTAData.json
cacert.pem
8913724486d5e3c463c493b25346ca31
RBX4069B068F2E84A1F9476280E1EA0F089
RBX83C60CBC65AA4DAEA1ADE15BDB22797D
__PSScriptPolicyTest_y53fa0bk.le5.ps1
105dceaa-ae24-4415-adc1-b19e2466216b.tmp
40ca1c0b-4a37-4fdd-bfbc-d5198e82c4e3.tmp
51e0a33e-bbaa-4a8a-beac-f28add6dc85f.tmp
5f489e24-0b25-431c-b6ec-51873b2c0974.tmp
88ec86eb-7f9c-47ea-b821-fc42069e04d3.tmp
manifest.json
crl-set
manifest.json
settings.dat
settings.dat
settings.dat
throttle_store.dat
temp-index
temp-index
index
data_0
data_1
data_2
data_3
2d62dec3-b9d2-4410-aad1-fd4499e3fcc7.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
CURRENT
MANIFEST-000001
a28c6198-3e1e-4306-a737-566565096f91.tmp
c6db05a2-900e-4a74-a458-253e563d3e5b.tmp
index
Local State
manifest.json
df44bfa1-5092-4097-a543-4c2b41067f5d.tmp
Roblox Studio.lnk
manifest.fingerprint
protocols.json
manifest.fingerprint
manifest.fingerprint
memory/1816-154-0x00007FFF374A0000-0x00007FFF374A1000-memory.dmp
memory/2064-967-0x00007FF7070C0000-0x00007FF7080C0000-memory.dmp
memory/3632-26-0x00007FFF374A0000-0x00007FFF374A1000-memory.dmp
memory/3632-247-0x000001D9A47D0000-0x000001D9A47F9000-memory.dmp
memory/3944-203-0x0000016EB2B10000-0x0000016EB2B32000-memory.dmp
memory/4344-574-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-562-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-564-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-563-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-570-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-573-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-572-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-571-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-569-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp
memory/4344-568-0x000002AE04AE0000-0x000002AE04AE1000-memory.dmp