Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1802s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07/01/2023, 21:18
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1964 created 3052 1964 RobloxPlayerBeta.exe 18 -
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 2672 RobloxPlayerLauncher.exe 4876 ChromeRecovery.exe 2384 RobloxPlayerLauncher.exe 3480 RobloxPlayerLauncher.exe 4816 RobloxPlayerLauncher.exe 1964 RobloxPlayerBeta.exe 4484 RobloxPlayerBeta.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation RobloxPlayerBeta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini GamePanel.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 4484 1964 RobloxPlayerBeta.exe 119 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\DeveloperTools\DeveloperTools\Classes\PluginEventRouter.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-24c5c11f-f6df649b\RoduxFriends\Reducers\Friends\requests\sentAt.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Analytics\ContactImporterAnalyticsContext.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\PlatformContent\pc\textures\glass\reflection.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-0195bf64-20bb1a25\ExperienceChat\installReducer\BubbleChat\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Animation\SpinningImage.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VerifiedBadges\VerifiedBadges\Utils\appendVerifiedBadge.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\dependencies.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\textures\ui\LuaChat\9-slice\gr-mask-game-icon.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-0195bf64-20bb1a25\ExperienceChat\Events\bindableEventQueue.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\NetworkingGames.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Components\ScrollView\ScrollView.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PlaceInfoRodux\PlaceInfoRodux\Actions\ReceivedMultiplePlaceInfos.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\DevConsole\Search.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\Stories\Public\RobuxUpsellFlowInGame.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Slider\TwoKnobContextualSlider.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\textures\ui\LuaChat\graphic\ic-checkbox-on.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\Shared-a406e214-4230f473\Shared\ReactInstanceMap.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\ModalBottomSheet\ModalBottomSheetButton.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\ui\Backpack\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\Boolean\Boolean\toJSBoolean.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\lua-promise\lua-promise\Promise.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\RoduxContacts\RoduxContacts\Selectors\getPhoneNumber.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadWidget\SquadWidget\SquadLobby\Components\SquadLobbyPeekViewTopBar\SquadLobbyPeekViewTopBar.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\AvatarEditorImages\Catalog_LightTheme.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\ui\PlayerList\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\Number\Number\isFinite.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\RoduxAnalytics\Reducers\bySessionKey.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\__stories__\CellTypes.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\EventReceivers\TencentAuthInfoEventReceiver\getTencentAuthInfo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppLocales\RobloxAppLocales\Locales\ro-ro.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\TestingAnalytics\formatErrorForIncorrectKey.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\TerrainTools\mtrl_cobblestone.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-b531e02e-6a8b665b\ExperienceChat\Actions\CommandAliasChanged.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-b531e02e-6a8b665b\ExperienceChat\mountClientApp\helpers\setUpConfigurationObjects.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Symbol\GlobalRegistry.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-0195bf64-20bb1a25\ExperienceChat\installReducer\Players\PlayersReducer.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Flags\getFIntFriendsCarouselLoadingTimeThresholdSec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\Dash\Dash\omit.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-edcba0e9-3.2.1\RobloxShared.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoactFitComponents.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\ModalBottomSheet\ModalBottomSheet.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactFiberSchedulerPriorities.roblox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createGetChatSettings.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\GameSettings\RoundArrowButton.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\StudioSharedUI\spawn_withoutbg_24.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\ui\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\React-9c8468d8-8a7220fd\React\ReactCreateRef.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Array\from.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactCapturedValue.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-492710c6-1e7909bf\RoduxFriends\Reducers\Friends\friendshipStatus.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\AlertViews\InfoAlertView.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\fonts\Sarpanch-Regular.ttf RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\content\textures\LayeredClothingEditor\Icon_Preview_Clothing.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\utilities\graphql\directives.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-b531e02e-6a8b665b\ExperienceChat\Events\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\Lumberyak.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UIBlox\UIBlox\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Common\formatDate.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\InputButton\Toggle.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\MenuDirection.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Flags\getFFlagUpdateContactImportModalLogic.lua RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags GamePanel.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 bcastdvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bcastdvr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D9A89C3-2A70-4F3A-8535-0BC9F0344120}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION RobloxPlayerBeta.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49A268BD-915A-4411-A867-4F80A72584E6}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49A268BD-915A-4411-A867-4F80A72584E6}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D9A89C3-2A70-4F3A-8535-0BC9F0344120}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D9A89C3-2A70-4F3A-8535-0BC9F0344120} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D9A89C3-2A70-4F3A-8535-0BC9F0344120}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49A268BD-915A-4411-A867-4F80A72584E6} RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000" RobloxPlayerBeta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49A268BD-915A-4411-A867-4F80A72584E6}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\shell RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-f51be0bac4f14d35\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4504 chrome.exe 4504 chrome.exe 2660 chrome.exe 2660 chrome.exe 4188 chrome.exe 4188 chrome.exe 3904 chrome.exe 3904 chrome.exe 4928 chrome.exe 4928 chrome.exe 4612 chrome.exe 4612 chrome.exe 3156 chrome.exe 3156 chrome.exe 4644 chrome.exe 4644 chrome.exe 2660 chrome.exe 2660 chrome.exe 4480 chrome.exe 4480 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 3916 chrome.exe 3916 chrome.exe 2868 chrome.exe 2868 chrome.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe 2672 RobloxPlayerLauncher.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1964 RobloxPlayerBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4444 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4444 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1964 RobloxPlayerBeta.exe 1964 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2676 2660 chrome.exe 66 PID 2660 wrote to memory of 2676 2660 chrome.exe 66 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4420 2660 chrome.exe 69 PID 2660 wrote to memory of 4504 2660 chrome.exe 68 PID 2660 wrote to memory of 4504 2660 chrome.exe 68 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70 PID 2660 wrote to memory of 4736 2660 chrome.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://roblox.com2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcac304f50,0x7ffcac304f60,0x7ffcac304f703⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1692 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:23⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:83⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:13⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:13⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4004 /prefetch:83⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:13⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4980 /prefetch:83⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:83⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:83⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:83⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:13⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:83⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:83⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5376 /prefetch:83⤵PID:488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2444 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:83⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:13⤵PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6064 /prefetch:83⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6048 /prefetch:83⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5616 /prefetch:83⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4508 /prefetch:83⤵PID:368
-
-
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exeC:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=511b9d269d3e7186c5a8821e34f2723c965c0ca8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x6c0,0x6b8,0x6cc,0x6b4,0x6f4,0x11d3c04,0x11d3c14,0x11d3c244⤵
- Executes dropped EXE
PID:2384
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:83⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:83⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:13⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:83⤵PID:4036
-
-
C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerLauncher.exe"C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:TQ3Rreey962fc28AkeEXnPDXeNiaGwuJFsjm2plTXVt9uOuYIS8CWvMxYtzKcxH0vf2X0NHamXOQYnytS1MJjk-QTlKOacp_TbDF3l2lF-Bj3O5flY8jFa3R1en1XQZfWe_vqLRChsH3T0QlR7pLRql5HInKG0pp5wHoaIHV8gLfb8greJ5ZDVQepYnoXaSi9vhN-OKJq4Ji01EA9ucdeG9KYhFglByHaaEK1U70Fvo+launchtime:1673130210653+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D158577371010%26placeId%3D998374377%26isPlayTogetherGame%3Dfalse+browsertrackerid:158577371010+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp3⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:3480 -
C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerLauncher.exe"C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=511b9d269d3e7186c5a8821e34f2723c965c0ca8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x70c,0x710,0x714,0x5dc,0x71c,0x1033c04,0x1033c14,0x1033c244⤵
- Executes dropped EXE
PID:4816
-
-
C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerBeta.exe" --app -t TQ3Rreey962fc28AkeEXnPDXeNiaGwuJFsjm2plTXVt9uOuYIS8CWvMxYtzKcxH0vf2X0NHamXOQYnytS1MJjk-QTlKOacp_TbDF3l2lF-Bj3O5flY8jFa3R1en1XQZfWe_vqLRChsH3T0QlR7pLRql5HInKG0pp5wHoaIHV8gLfb8greJ5ZDVQepYnoXaSi9vhN-OKJq4Ji01EA9ucdeG9KYhFglByHaaEK1U70Fvo -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=158577371010&placeId=998374377&isPlayTogetherGame=false -b 158577371010 --launchtime=1673130210653 --rloc en_us --gloc en_us4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:83⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,429475407294864926,368950286493098405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1280 /prefetch:83⤵PID:2804
-
-
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 000000000007007C /startuptips2⤵
- Drops desktop.ini file(s)
- Checks SCSI registry key(s)
PID:3904
-
-
C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerBeta.exe\??\C:\Program Files (x86)\Roblox\Versions\version-f51be0bac4f14d35\RobloxPlayerBeta.exe2⤵
- Executes dropped EXE
PID:4484
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵PID:3928
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3928_2104389991\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3928_2104389991\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={c0ef7472-a9de-4a1e-9bc7-af99e267272e} --system2⤵
- Executes dropped EXE
PID:4876
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2001⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:996
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Checks processor information in registry
PID:3516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05
-
Filesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize1KB
MD50feddf7ad4399fe0fb73f1776eaf02aa
SHA1bebf64df114e8418a9fbd926f207b57deda05605
SHA256ca56b0942aa00af4e8aff089f36d68c98937de7ea4d5d3c9d4ec368441faae8f
SHA51239e7b8a63e94be1a563b4e593117afafe2cd7a588e94357f557687831c831fb8a06fb2169c7741daed2d6448bda067ea3dc2f9219928b4fccd11e152b8d09f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD5832400f22ed44b13a5329abfd13652c5
SHA187fcf9643bd4cda31975c5ff0891bef4c032995a
SHA25620dbe93e556bfdd6ed6750d23c54ba62de794e649280b59e019c02544035d9c8
SHA512f49c289b16e39922f5a526c2bf62afef6fdf03c3b20269c3d6df0882f59dae8cb9245215de011c5f0499ee4cf298aa4a0de4b4a3e8bd3b66ae20016b1e15c027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_B77291E64A03293D7961A8AE2B2EF79F
Filesize471B
MD535a88269b1e355b75fc3aaa5049f600a
SHA128c7d2d1dcadd9394afce7f54755e13c893e5262
SHA256ad9cd64a215c859e31235ffee67856a7b2a44d800077d467b4d05780b6944dd9
SHA5121a112d19399006b9e57f0c9fed129f4f1ff3d411f701cf7933adb5ea31d8f44a2658b038e694655b591ea20fb46682ec2b617aeb3d83ef40eefae84e3584b3af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize1KB
MD5b9bb1703647881624933ccf903d163a3
SHA12f283d29f94f1468fb620169b7c1ab2a717e3a5f
SHA2563a3a140ebfd7e7feee08fba16337fd9ed49b7ee17ff1f430f96751a8b456e4f3
SHA5125ed255cc2fe30e29832239b3bce12937861904231e98b246623ff421e02be25b48d3573bdab7bd01f5af1ef47833473a02dfdff0c3e085380d7b893461b67092
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize450B
MD5511edb9d38332fb56ffa603df17a4799
SHA115979518076bacede220376472b53f20ca2e60cc
SHA256559fc60ee66535771a13c73afc58f8be1e1519963c3808ce601a68318cbbab03
SHA5125325433d8e38f5aab39fb9b092d3df3865324e3cbd19369ebed7e9898b9139504a1f0992d2fa343cc2cd1f36baabfba862f1e647b6e28df63bf9b51528e31983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize430B
MD5410463110cacb6a7ac088007402c655f
SHA10f3bd18103e7af2f40e367a5a7d8ef3befddbe73
SHA256fc013c6baad0061209369e64548e421485f517f89b0406992b0abcce7af52ac4
SHA51291c67694e7a6127e462ff8a79ef2a8443512638a1607fe595e2b4b129ee64e3b7eca2ea2093452bf97498b54d216ae3b8dc78cb840f50099f1bdc073391d2f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_B77291E64A03293D7961A8AE2B2EF79F
Filesize426B
MD588a7508caf116a385ddc0b5a5aaa0613
SHA1c13bb8a0125b9eadbd156a7264fc2d9b2f246e5d
SHA2569d5a15d566073ab148d41cd06e4d239878d13525171ef8fa40219f5714f750fb
SHA5121602dedfb7a11326fa35b7f050904fd8bdb062675abb8002c6f3a5baa2cba348ee6c0f6c02bf5c5f5dd50824f4f3788477cc1e8c70463421fee3d9acb9ddbfe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize458B
MD55bf79291e1302224d5785ba00c9e4e49
SHA1f54fb39ab31cc1dd891853e921cad9b9f9b3b8fb
SHA2568811fc266e5afa2ec1b3d381cc5719fd9895c4118b65cf51ccedcbb6297cd526
SHA512e464d32ec11b2967bc5ac638157e504930b4eafe458d1414f21aea424bf951621df698e72581b0f19f9b27d8a8caef12ce946e260c10aa2b5712ea764b21da20
-
Filesize
5KB
MD5dc1dce3f75a923916b2e8a522ed2081f
SHA1fa52db1aa36f88c07b2599fa6271b7a41446de33
SHA2561651f103c8b7ce904f9b5f58ba34c3cdcbca8ccf8b9dde705ab492033f25c7f7
SHA5128e1a63d1350aa3b60ec00dde3868b6d5c87c294b6c48b56c5c850b0c62873f884b12acc64c621e4f8e3c2cccbdc53c8298be02bd69763376a66b150b631841a2
-
Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
Filesize
2KB
MD57f144b263ad24bcbe812b0fd29e21057
SHA17bfd3bfb8e4f10f83bbe6c3d8f777e7b57b6df2e
SHA256cdf6052aa52799d7ec5603813ae2eb7b63ee3ec92c0308ced16edc0a1b5e55bb
SHA512233d5d1075644a690b9c447382ef414b26acecfc2002db1efeedda3c3b6bafe894ba31a018ecb8917e7ee219220a003040883e658de2ed2ef84ea5b20c35fd66
-
Filesize
2KB
MD57f144b263ad24bcbe812b0fd29e21057
SHA17bfd3bfb8e4f10f83bbe6c3d8f777e7b57b6df2e
SHA256cdf6052aa52799d7ec5603813ae2eb7b63ee3ec92c0308ced16edc0a1b5e55bb
SHA512233d5d1075644a690b9c447382ef414b26acecfc2002db1efeedda3c3b6bafe894ba31a018ecb8917e7ee219220a003040883e658de2ed2ef84ea5b20c35fd66
-
Filesize
2KB
MD57f144b263ad24bcbe812b0fd29e21057
SHA17bfd3bfb8e4f10f83bbe6c3d8f777e7b57b6df2e
SHA256cdf6052aa52799d7ec5603813ae2eb7b63ee3ec92c0308ced16edc0a1b5e55bb
SHA512233d5d1075644a690b9c447382ef414b26acecfc2002db1efeedda3c3b6bafe894ba31a018ecb8917e7ee219220a003040883e658de2ed2ef84ea5b20c35fd66
-
Filesize
119B
MD5e767c1735320b3744a6b3345a1e0d1d3
SHA19d107fae8af4054576be9bec3d118f5caca18bb4
SHA256e103e4b095fb312d25bd045711385634c56e21ebbb3b968973d5868a7d834516
SHA512f1d8f3935a1c4dcb2aee29515c84756d845662f1aac06a53192d602064a6db76ff2813ab62d3964bbaa7bc2cf4c820b62a43b41c61f2294ae1214c551141b899
-
Filesize
69B
MD5dc93c46ce1b959aa42e959dd04d0b1a1
SHA185570b388e3ea90065d174df75573f53c94e2a38
SHA2563e72584cb4e6f0ee40d702e8c704a1c861e719fec9426caf87556a6a1149927c
SHA512b32635b07d20628d17f2a12425b9b00276c1dc3542138ebe3f2d4abdd6f01a7c4c2cf5099f38f57cbd6cb288c45f2252f44eb01f6ed02d08380aa46226953cac
-
Filesize
40B
MD5f42d1be12f6a41ab4460130a85983bc9
SHA198169d2793e823901af4f5fc349242b0c5cd690f
SHA2568d6ae6de3b0d36eee5eaf9a34937bbd7eafdf11f435356baa2840ca31b71e226
SHA512e38c4db423118cf64b38d148467a6d590b52768b46c056ea7ff26331c2fe70c33ce4589076576a390112ff1f75df55e31b917b7d1eb95fe107961dd4ebdaa469
-
Filesize
40B
MD5f42d1be12f6a41ab4460130a85983bc9
SHA198169d2793e823901af4f5fc349242b0c5cd690f
SHA2568d6ae6de3b0d36eee5eaf9a34937bbd7eafdf11f435356baa2840ca31b71e226
SHA512e38c4db423118cf64b38d148467a6d590b52768b46c056ea7ff26331c2fe70c33ce4589076576a390112ff1f75df55e31b917b7d1eb95fe107961dd4ebdaa469
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05
-
Filesize
2.0MB
MD5776f4082c2536d4310eb37bf7c78df70
SHA1a3761e94cee217cb3f8ccc902736bea704ff97a3
SHA256a42fd36d3983f27f3327edeb4b0dfb7744e4cf951ccda876d4048825864c1fae
SHA512bf3c9d9c12e7c675695d2e296e566058cb7b16b5772f2c0ffbaf14e4e2398a48a4ca2ef64e5e7251b4336ff4616835908d81679cd48e4b189f0af8e94fc5df05