ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

Analysis

max time kernel
82s
max time network
91s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxPlayerLauncher.exe
Size

2.0MB
MD5

34d6da080af6ae29247f06bcae9292c5
SHA1

6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256

ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512

c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
SSDEEP

49152:7EDwfYZf+r0RFD3zjTVTocahQ5MOTeZM2PMQ3d2HST6b6fz:PYZzR53zjG8bGz

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Loads dropped DLL 8 IoCs

pid	Process
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\core\QueryInfo.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoactFitComponents\RoactFitComponents\FitTextLabel.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence\RoduxPresence\Reducer\Presence\byPlaceId.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Regulations\ScreenTime\GetFFlagScreenTimeShowLogoutPromptInGame.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RobloxShared-edcba0e9-3.2.1\LuauPolyfill.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createAddToConversation.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsScreen\AddFriendsScreen.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\GameSettings\RadioButton.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Localization\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\mountServerApp\installReducer\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-edcba0e9-3.2.1\JestSnapshot\State.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\String\substr.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsTile\getFooterRelevanceInfo.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Input\DashedLine.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Settings\MenuBarIcons\HomeTab.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-a406e214-4230f473\ReactRoblox\ReactReconciler.roblox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\ImageSet\ImageAtlas\img_set_2x_5.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\isPlayerVerified.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-6492c3b7-082e44c0\rodux-networking\NetworkStatus\EnumNetworkStatus.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\TestingAnalytics\mockLogger.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\sky\clouds.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\VoiceChat\SpeakerLight\Unmuted80.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\granite\diffuse.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\RoactAppExperiment.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Expect-edcba0e9-2.4.1\Expect\matchers.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\TestEZ\TestEZ\TestResults.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Button\HoverButtonBackground.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadWidget\Roact.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\Attendance.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\sky\indoor512_dn.tex	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\water\normal_17.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\BubbleChat\BlankBubble\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\RoduxFriends\Reducers\Friends\utils\removeIdsFromRequestsStore.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Control\Slot\TileSlot.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\FitFrameVertical.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Modal\ModalTitle.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Utils\contactImporterModalInfo.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\BubbleChat\ChatBubbleDistant\ChatBubbleDistant.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\BubbleChat\BubbleChatList\BubbleChatList.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\String\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RequestPipeline\JestDiff.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\navigators\createRobloxSwitchNavigator.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\TooltipV2\Controllers.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Style\Themes\LightThemeNew.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\DiscoverabilityModal\Analytics\Enums\EntryPoints.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Boolean\Boolean\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\installReducer\ChatVisibility\transparency.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Array\reverse.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Picomatch\Picomatch\constants.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RobloxShared-edcba0e9-2.4.1\RobloxShared\RobloxInstance.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingHeaderBar\SearchHeaderBar.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadWidget\SquadWidget\FloatingActionButton\Common\Constants.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserLib\UserLib\Reducers\Users.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\UserSearch\Components\UserSearchTile\useSearchTileButtons.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestCircus\JestCircus\circus\combined.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.1\JestUtil\replacePathSepForGlob.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\UserTileSquare\UserTileSquare.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\ProfileQRCode\Components\ProfileQRCodePage\ProfileQRCodePage.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioSharedUI\avatarMask.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\terrain\diffusearray.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Regulations\ScreenTime\GetFFlagScreenTimeCallLogoutEndpointAfterLogoutInGame.lua	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\AppName = "RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\AppName = "RobloxPlayerBeta.exe"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\Policy = "3"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\Policy = "3"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerLauncher.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	RobloxPlayerLauncher.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe
832	RobloxPlayerLauncher.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30
PID 832 wrote to memory of 748	832	RobloxPlayerLauncher.exe	30

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c4,0x5c8,0x5cc,0x5a0,0x5d4,0x6a32f4,0x6a3304,0x6a3314
  2⤵
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
7e25f6fb89e5e90a0332072faad895a0

SHA1
da862e41af5f2ad287c45ba85dabbbd034b01b43

SHA256
b7e8aaa4b720c9846e65216dad5d59af4671e151c2db9ca1e81d490f23f537a3

SHA512
1ae3a7e83612bfc1337c7de63446806746b4546055869434622f5a544f80bd7d3a21a8d84cad1a15190c545336c8c150bd043cfcf536a2857673a69f244cff93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\31A9C487BBB3C199E8D59BE85CDAE127_BF0BDA39B510D85E53F7B2BBE62B01C7

Filesize
1KB

MD5
a520780c10dcf687a0351a014dd6b18b

SHA1
813ae9c32e609938ccff83055a873a8db17dbbac

SHA256
5f69b3ad24713f80a24cd24e8fb7727324bf05c077d47720b3e1c0c199e7e257

SHA512
441bd58004a41d7600c873126dc1fda0894d059579096a9a0dfa320d18e89979e8b1403ee349702f3b9c837efe49a83fc41c68961e7598c622bcf3e24af4b234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D6C5BE853DE9635D928C50863E19CD46_58118CA4A1A343467489A27BC4EE02C5

Filesize
1KB

MD5
a642f3f78f39f6b37d8c9c34c4fb4fa1

SHA1
9a5e9d9118ea8c5293e4dc68fdbdc3718fb86c6e

SHA256
258c29336dfc4fedf9fe1164301ce890a27168549918f391c151050b273593ba

SHA512
2eb48b7f13274e7713b42c3a6c2895ff50f1d7e2f4cf6c0b5d3d0c2351e748153c5296a5e5f31c279e67984779fef767f20d27e0fc80bcf2f1cfd5d088176100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
2f781719b89fd318a854a3f619129c30

SHA1
1168fa63d02ae764755e8f3513e91055f6222c28

SHA256
44d1e0330234db53292b070b90299b3a5184d09a05e1a1159cd183435296fa1f

SHA512
0b2384a1548aed32c9e0d9acec393520e6d5229b170b73cedeb06415b14e5f17b7e82243581b1b11812a5da2062b3e70ea4ebc899ac0a8a07dde7a178ba8690b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
49b35385007491f806f1b407b6756246

SHA1
9a574c43125a0bbcaf4d9659285c82076991d975

SHA256
f0d3cb2279c5afe45a8d2732e5a3f8b375aa1cf3da29cb8dc5572116741d46a4

SHA512
a5f61719e835877ac77e3db2635bc87f30377001db4552c5f4795702e0a7278573f9bcc5de201980a72c42e403f3839d90d55a86b6f6e50e0553c03f519e13ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\31A9C487BBB3C199E8D59BE85CDAE127_BF0BDA39B510D85E53F7B2BBE62B01C7

Filesize
474B

MD5
c3b8596e15fb164e76165ade6a33f02a

SHA1
b7148c8cd53b9b40e8a5247d5503550c03fb5d7a

SHA256
d7ba78dc5050e8cab6ea576458d68c5bdd2b87ee72a354184d6121bec4aa5b9f

SHA512
0622ae73f7b88fd2006c6fbe73517ca2c4cf5de873bd65c00f99b1c8e74101841cfcc1c938f7822cea6735696a024256ce3e6109c3087c1f9988205340db3e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6a352e89c492c8564dff4f8afa54b21

SHA1
859519055ea9a023af928f3c7438bb221ffa1dbf

SHA256
2baf3b1b4ed31a77c0fed511c41ae706767facddb3ab7126717337a758b32fba

SHA512
10ee2d9f59bc4e1015b42f9a2cfeb3528456d78dab6f7bd6d7524a52ae72b35f1f2015b2c53c4eb1382d6ddba01906fe6a1a2763025e892a819359d3afe9e92c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D6C5BE853DE9635D928C50863E19CD46_58118CA4A1A343467489A27BC4EE02C5

Filesize
474B

MD5
776c7e808d2700bac0fd026c9066ae35

SHA1
ea04298f0ce1fba13422407093d2ac775a291e22

SHA256
ee606ca235c13fbaf1424a55018d7d74014bc61df27e94ec62f6d730aee40abc

SHA512
b02e78a4dbe705441d170b5ef5b07eee79e9d4df2d66bef12a18128099639820f6a16f4717e667127bfe21981f6b3f8d8340bad7d1e32f204ed823dba2cc697a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
4ab7ba6508143b09a00b6ae819ee1a9d

SHA1
8443407bcfbf5846d891f696e07a760553f5f10b

SHA256
259548367e0e6e0a84314e1778f3b8c1996b7dd84e003cd78c57646134ac3fe9

SHA512
ecd94b9c3806f076681f615888643ae6798c842c25b6077378ced3c6cb15fefb541f011c304b25f4cce58b62aa1e82060d5e0a6e29eca1dc7fd227155409f459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\PCClientBootstrapper[1].json

Filesize
2KB

MD5
8535124841e1fa6d3e82fd30dba847ea

SHA1
55873ac0bd7f2282f0c1867ecc87982495edb605

SHA256
fab5a3b7d13d4275244d736f813649b12934fc4229bf4ce6883170d362f2cc52

SHA512
6dd909fcd2b0b9b08562e97c8de59bf3e3f92fe35650b581b54dd3eacaecc118ea738aec5bc2763eaa15e6fa339bad28fc7d3159fc8176e579c17c60ff91f539

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

Filesize
40B

MD5
253e7a6117665ac4a3d10b339934b13a

SHA1
d03e06194cdb1063bd5d5dd4fda87710a66156e2

SHA256
7e5ae33488d33a5dbf90cc4f7bc6f387847c7c24694e5c9ed7c40d86428ff39a

SHA512
ff69af41d15d48316116939655abf50b368ae10585e0c786242f9e4442dc8224f2f0b490ca542f06bff2ad921ce6ce7db8ccd7902242261397d4906252702314

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\49PW3KK2.txt

Filesize
67B

MD5
cf295d810a0888026b7cdd93a640849b

SHA1
6ab5ab69283a3ccdedbc329912ad88bbad46a73a

SHA256
abc5592a659129098db156912eef2db78c93fd712b43f148c61f4771519d84c5

SHA512
e913f91109087add9a24550b796194cf895b8e4eb5cbd5ff3df047d6fae801499fa63d7b6fc2b986c1f7e03b410d0b7c98ad5166a5573764527f4f257447d94f

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
322ad896786eea9f94746287710f78bb

SHA1
7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

SHA256
835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

SHA512
e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
322ad896786eea9f94746287710f78bb

SHA1
7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

SHA256
835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

SHA512
e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
322ad896786eea9f94746287710f78bb

SHA1
7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

SHA256
835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

SHA512
e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

Download Submit
\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

Filesize
57.5MB

MD5
ccac7596d7a99ec3cf796b286378e5e0

SHA1
e1967831b8472ba519c81e425bdcff10098cd208

SHA256
b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

SHA512
d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

Download Submit
\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

Filesize
57.5MB

MD5
ccac7596d7a99ec3cf796b286378e5e0

SHA1
e1967831b8472ba519c81e425bdcff10098cd208

SHA256
b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

SHA512
d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

Download Submit
\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
34d6da080af6ae29247f06bcae9292c5

SHA1
6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

SHA256
ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

SHA512
c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

Download Submit
\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
34d6da080af6ae29247f06bcae9292c5

SHA1
6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

SHA256
ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

SHA512
c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

Download Submit
\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
34d6da080af6ae29247f06bcae9292c5

SHA1
6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

SHA256
ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

SHA512
c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

Download Submit
memory/832-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download