Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31/01/2023, 21:39
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20221111-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
34d6da080af6ae29247f06bcae9292c5
-
SHA1
6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
-
SHA256
ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
-
SHA512
c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
SSDEEP
49152:7EDwfYZf+r0RFD3zjTVTocahQ5MOTeZM2PMQ3d2HST6b6fz:PYZzR53zjG8bGz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe -
Loads dropped DLL 8 IoCs
pid Process 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\VoiceChat\SpeakerDark\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\core\QueryInfo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoactFitComponents\RoactFitComponents\FitTextLabel.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxPresence\RoduxPresence\Reducer\Presence\byPlaceId.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Regulations\ScreenTime\GetFFlagScreenTimeShowLogoutPromptInGame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RobloxShared-edcba0e9-3.2.1\LuauPolyfill.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createAddToConversation.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsScreen\AddFriendsScreen.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\GameSettings\RadioButton.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Localization\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\mountServerApp\installReducer\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-edcba0e9-3.2.1\JestSnapshot\State.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\String\substr.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsTile\getFooterRelevanceInfo.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioToolbox\AssetConfig\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Input\DashedLine.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Settings\MenuBarIcons\HomeTab.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-a406e214-4230f473\ReactRoblox\ReactReconciler.roblox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\ImageSet\ImageAtlas\img_set_2x_5.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\isPlayerVerified.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\rodux-networking-6492c3b7-082e44c0\rodux-networking\NetworkStatus\EnumNetworkStatus.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\TestingAnalytics\mockLogger.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\sky\clouds.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\VoiceChat\SpeakerLight\Unmuted80.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\granite\diffuse.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\RoactAppExperiment.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Expect-edcba0e9-2.4.1\Expect\matchers.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\TestEZ\TestEZ\TestResults.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Button\HoverButtonBackground.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\textures\ui\LuaApp\dropdown\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadWidget\Roact.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\Attendance.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\sky\indoor512_dn.tex RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\water\normal_17.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\BubbleChat\BlankBubble\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\RoduxFriends\Reducers\Friends\utils\removeIdsFromRequestsStore.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Control\Slot\TileSlot.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\FitFrameVertical.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Modal\ModalTitle.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Utils\contactImporterModalInfo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\BubbleChat\ChatBubbleDistant\ChatBubbleDistant.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\BubbleChat\BubbleChatList\BubbleChatList.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\String\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RequestPipeline\JestDiff.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\navigators\createRobloxSwitchNavigator.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\TooltipV2\Controllers.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Style\Themes\LightThemeNew.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\DiscoverabilityModal\Analytics\Enums\EntryPoints.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Boolean\Boolean\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\installReducer\ChatVisibility\transparency.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Array\reverse.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Picomatch\Picomatch\constants.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RobloxShared-edcba0e9-2.4.1\RobloxShared\RobloxInstance.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingHeaderBar\SearchHeaderBar.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SquadWidget\SquadWidget\FloatingActionButton\Common\Constants.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserLib\UserLib\Reducers\Users.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\UserSearch\Components\UserSearchTile\useSearchTileButtons.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestCircus\JestCircus\circus\combined.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.1\JestUtil\replacePathSepForGlob.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\UserTileSquare\UserTileSquare.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\ProfileQRCode\Components\ProfileQRCodePage\ProfileQRCodePage.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioSharedUI\avatarMask.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\terrain\diffusearray.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Regulations\ScreenTime\GetFFlagScreenTimeCallLogoutEndpointAfterLogoutInGame.lua RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0} RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\Policy = "3" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{724C7FC5-0337-40D5-AD5C-B09FEBD7E0F0}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BB89F3E-D9D1-4991-BD8C-A7504F7C9894}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe 832 RobloxPlayerLauncher.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30 PID 832 wrote to memory of 748 832 RobloxPlayerLauncher.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c4,0x5c8,0x5cc,0x5a0,0x5d4,0x6a32f4,0x6a3304,0x6a33142⤵PID:748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize1KB
MD57e25f6fb89e5e90a0332072faad895a0
SHA1da862e41af5f2ad287c45ba85dabbbd034b01b43
SHA256b7e8aaa4b720c9846e65216dad5d59af4671e151c2db9ca1e81d490f23f537a3
SHA5121ae3a7e83612bfc1337c7de63446806746b4546055869434622f5a544f80bd7d3a21a8d84cad1a15190c545336c8c150bd043cfcf536a2857673a69f244cff93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\31A9C487BBB3C199E8D59BE85CDAE127_BF0BDA39B510D85E53F7B2BBE62B01C7
Filesize1KB
MD5a520780c10dcf687a0351a014dd6b18b
SHA1813ae9c32e609938ccff83055a873a8db17dbbac
SHA2565f69b3ad24713f80a24cd24e8fb7727324bf05c077d47720b3e1c0c199e7e257
SHA512441bd58004a41d7600c873126dc1fda0894d059579096a9a0dfa320d18e89979e8b1403ee349702f3b9c837efe49a83fc41c68961e7598c622bcf3e24af4b234
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D6C5BE853DE9635D928C50863E19CD46_58118CA4A1A343467489A27BC4EE02C5
Filesize1KB
MD5a642f3f78f39f6b37d8c9c34c4fb4fa1
SHA19a5e9d9118ea8c5293e4dc68fdbdc3718fb86c6e
SHA256258c29336dfc4fedf9fe1164301ce890a27168549918f391c151050b273593ba
SHA5122eb48b7f13274e7713b42c3a6c2895ff50f1d7e2f4cf6c0b5d3d0c2351e748153c5296a5e5f31c279e67984779fef767f20d27e0fc80bcf2f1cfd5d088176100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize1KB
MD52f781719b89fd318a854a3f619129c30
SHA11168fa63d02ae764755e8f3513e91055f6222c28
SHA25644d1e0330234db53292b070b90299b3a5184d09a05e1a1159cd183435296fa1f
SHA5120b2384a1548aed32c9e0d9acec393520e6d5229b170b73cedeb06415b14e5f17b7e82243581b1b11812a5da2062b3e70ea4ebc899ac0a8a07dde7a178ba8690b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize450B
MD549b35385007491f806f1b407b6756246
SHA19a574c43125a0bbcaf4d9659285c82076991d975
SHA256f0d3cb2279c5afe45a8d2732e5a3f8b375aa1cf3da29cb8dc5572116741d46a4
SHA512a5f61719e835877ac77e3db2635bc87f30377001db4552c5f4795702e0a7278573f9bcc5de201980a72c42e403f3839d90d55a86b6f6e50e0553c03f519e13ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\31A9C487BBB3C199E8D59BE85CDAE127_BF0BDA39B510D85E53F7B2BBE62B01C7
Filesize474B
MD5c3b8596e15fb164e76165ade6a33f02a
SHA1b7148c8cd53b9b40e8a5247d5503550c03fb5d7a
SHA256d7ba78dc5050e8cab6ea576458d68c5bdd2b87ee72a354184d6121bec4aa5b9f
SHA5120622ae73f7b88fd2006c6fbe73517ca2c4cf5de873bd65c00f99b1c8e74101841cfcc1c938f7822cea6735696a024256ce3e6109c3087c1f9988205340db3e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6a352e89c492c8564dff4f8afa54b21
SHA1859519055ea9a023af928f3c7438bb221ffa1dbf
SHA2562baf3b1b4ed31a77c0fed511c41ae706767facddb3ab7126717337a758b32fba
SHA51210ee2d9f59bc4e1015b42f9a2cfeb3528456d78dab6f7bd6d7524a52ae72b35f1f2015b2c53c4eb1382d6ddba01906fe6a1a2763025e892a819359d3afe9e92c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D6C5BE853DE9635D928C50863E19CD46_58118CA4A1A343467489A27BC4EE02C5
Filesize474B
MD5776c7e808d2700bac0fd026c9066ae35
SHA1ea04298f0ce1fba13422407093d2ac775a291e22
SHA256ee606ca235c13fbaf1424a55018d7d74014bc61df27e94ec62f6d730aee40abc
SHA512b02e78a4dbe705441d170b5ef5b07eee79e9d4df2d66bef12a18128099639820f6a16f4717e667127bfe21981f6b3f8d8340bad7d1e32f204ed823dba2cc697a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize458B
MD54ab7ba6508143b09a00b6ae819ee1a9d
SHA18443407bcfbf5846d891f696e07a760553f5f10b
SHA256259548367e0e6e0a84314e1778f3b8c1996b7dd84e003cd78c57646134ac3fe9
SHA512ecd94b9c3806f076681f615888643ae6798c842c25b6077378ced3c6cb15fefb541f011c304b25f4cce58b62aa1e82060d5e0a6e29eca1dc7fd227155409f459
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\PCClientBootstrapper[1].json
Filesize2KB
MD58535124841e1fa6d3e82fd30dba847ea
SHA155873ac0bd7f2282f0c1867ecc87982495edb605
SHA256fab5a3b7d13d4275244d736f813649b12934fc4229bf4ce6883170d362f2cc52
SHA5126dd909fcd2b0b9b08562e97c8de59bf3e3f92fe35650b581b54dd3eacaecc118ea738aec5bc2763eaa15e6fa339bad28fc7d3159fc8176e579c17c60ff91f539
-
Filesize
40B
MD5253e7a6117665ac4a3d10b339934b13a
SHA1d03e06194cdb1063bd5d5dd4fda87710a66156e2
SHA2567e5ae33488d33a5dbf90cc4f7bc6f387847c7c24694e5c9ed7c40d86428ff39a
SHA512ff69af41d15d48316116939655abf50b368ae10585e0c786242f9e4442dc8224f2f0b490ca542f06bff2ad921ce6ce7db8ccd7902242261397d4906252702314
-
Filesize
67B
MD5cf295d810a0888026b7cdd93a640849b
SHA16ab5ab69283a3ccdedbc329912ad88bbad46a73a
SHA256abc5592a659129098db156912eef2db78c93fd712b43f148c61f4771519d84c5
SHA512e913f91109087add9a24550b796194cf895b8e4eb5cbd5ff3df047d6fae801499fa63d7b6fc2b986c1f7e03b410d0b7c98ad5166a5573764527f4f257447d94f
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443