Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2023, 02:36

General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • MD5

    15396fe00f8ee8d7ae41bb6884f9979b

  • SHA1

    5b57ca2e66568d55eb67349f7b68b9a792299743

  • SHA256

    9dcd1c7e9bcba6dd6c49e370d0b87ee94e2d0c5d6bbce918759cd942fcd62d07

  • SHA512

    8e3a75b176f5658a2a08ea6a17cd9dfd35bb3c8f7c5bf843ac2d1eef76ebed599710c8122165d07590845db4e30e4b4fb96456521684a2b48506cdaa6674ee7a

  • SSDEEP

    49152:hSN68wfCWTVlrX/tfQgTpiaYRo2RT48MPPMQ3d2XET4b6Qs:As8wKWTVlL/tfibBs

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 28 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
  • Modifies registry class 50 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=4b4135d8a5af5c6ff5bb89faa646bc380209874d --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c0,0x5c4,0x5c8,0x59c,0x5d0,0xf65f68,0xf65f78,0xf65f88
      2⤵
      • Modifies system certificate store
      PID:1488
    • C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5bc,0x5c0,0x5c4,0x594,0x5cc,0xfc32f4,0xfc3304,0xfc3314
        3⤵
        • Executes dropped EXE
        PID:956
  • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe
    "C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe" -app
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe
      "C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5ec,0x5f0,0x5f4,0x5e8,0x5fc,0x7932f4,0x793304,0x793314
      2⤵
      • Executes dropped EXE
      PID:1664
    • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe" --app
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1524
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0xc4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1808

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          1KB

          MD5

          29dfe305b4212892ea463b542ffbb23e

          SHA1

          1e8e9f31519b432624bd9ecf4f1122b315c73645

          SHA256

          5de62195d2b48c7a6b05f14d5bcb0f270cabbd38d9081c28039183376ab99966

          SHA512

          005ff52a781fcb191f42e5aa802d13631b79f13f51a912c8b7cc4ad34fe630e30e6ae34b84140d675df660e4502659d3199aedd9f9ef9788ef0b76069cbe84c0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          1KB

          MD5

          29dfe305b4212892ea463b542ffbb23e

          SHA1

          1e8e9f31519b432624bd9ecf4f1122b315c73645

          SHA256

          5de62195d2b48c7a6b05f14d5bcb0f270cabbd38d9081c28039183376ab99966

          SHA512

          005ff52a781fcb191f42e5aa802d13631b79f13f51a912c8b7cc4ad34fe630e30e6ae34b84140d675df660e4502659d3199aedd9f9ef9788ef0b76069cbe84c0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

          Filesize

          471B

          MD5

          59c7d1c3e315494e116f2c507c82c767

          SHA1

          12a70b21e3d5d6f4aa8b9f06e115754d2ad47de6

          SHA256

          9164088264623e289af26a53f6aae4948e9190885685866c9c7675382406d50c

          SHA512

          a5dafd1fe7527b25a13de644ba43a79e1f2a50aed20f46c8b2b60af9926d08775480fb22f926f903231bf183da016b2dfebb0cc1195505e00b5ab7c84a0f9ac2

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

          Filesize

          471B

          MD5

          b93def072383f54ce5000ce4b8ccf928

          SHA1

          2e5498d461734043bb8388e90ace8e0002ed0bd7

          SHA256

          f76fef89e8b688e22a28018a2db8ebebc33d5d42aef85c52c8b27073858aef56

          SHA512

          036c448d11f475abf480b62c377cc164edf7e8c6879f2cce3ea0aa88dd2ba33c3202c7724833bd771f8b4b3fed5ae3e4f95e061327e2469cbf89b04afc981adc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          1KB

          MD5

          6aa767333e1541ef4ad7ce54fd398854

          SHA1

          c49bd084f33aed56e8bafe5bcfbe7481c6356ec3

          SHA256

          ba4e5c81b594bfad7d73fb1d718859bf6dd398f21b8edc78bdbdcfc1ace481cf

          SHA512

          42d0c6159b80ae1ce1260f7330c5cf0febcd06d5745ea06bbbdca1477612fe0603c5bc3289b58dffca98d7d9422961f6994d0e0e993bf69e2767a0dc85c0e086

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          1KB

          MD5

          6aa767333e1541ef4ad7ce54fd398854

          SHA1

          c49bd084f33aed56e8bafe5bcfbe7481c6356ec3

          SHA256

          ba4e5c81b594bfad7d73fb1d718859bf6dd398f21b8edc78bdbdcfc1ace481cf

          SHA512

          42d0c6159b80ae1ce1260f7330c5cf0febcd06d5745ea06bbbdca1477612fe0603c5bc3289b58dffca98d7d9422961f6994d0e0e993bf69e2767a0dc85c0e086

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          1KB

          MD5

          a266bb7dcc38a562631361bbf61dd11b

          SHA1

          3b1efd3a66ea28b16697394703a72ca340a05bd5

          SHA256

          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

          SHA512

          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          450B

          MD5

          1e5b2d29eb6c5b9f8ad820e7ed812f69

          SHA1

          23a58876e63634937978b9b7818d7abbca035f88

          SHA256

          f2eaa6f6b645b814b0d0a1020961d34e586a859d4ae2e2bec8dd2a87791104ae

          SHA512

          68ae8762601ffe4ae9f76e08030bf498be17eff0ef9a85562b8f3a0b1f6f56206a20bff81a600b33c73944dfc3f66ec9441a7a26c9891a8683945e46e6df6f0c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          450B

          MD5

          6d55c025007ab4bb88f9a5ac36cf8f33

          SHA1

          39d1d47c4041dc143bbd580b6823e38c74da91fb

          SHA256

          746149878b08e659a42e8673793ddaad8d8075d6d66a018e6c99e723d8adff3d

          SHA512

          54ed9eda0e407f3da0c80fbde98aeca2cefdeb5c2cbf2df7f746b079748eb572ada2f2ceaf409f6055986b66f018d6298bf8cecb3856e419c770c930e6dbceeb

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          3aa93394a557eb3b83476b75234d3a19

          SHA1

          a9726591a7ea90c529c6a65909dea2a104075938

          SHA256

          59f7594803fdd35ed71e0b3c52580c0575a6584e20b00f4b189cfc668cf27d94

          SHA512

          72ff40d508426e195887ecfecd7d62084b607f0af287aaf51fb7bc0f21d62ac210c1aa5a0c803242184b859ce33f7820fc680e0d6dd2e7c7311c82651a776883

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          f18dd76c59a838f2bb9ff267aecf9129

          SHA1

          d63f3f91bba9e7f13f44be620d23da61da1a55d3

          SHA256

          10c3420018afc538bd9072c2a2c91477090bb94bfc9bda7e88cd30633291c182

          SHA512

          789a0abfe587b91578c36be4d666b4499c8ca396f7528f9293bd3659b8212fe6ec442c5a186b7a4d9daf73925725f2667a69dbf468ae8e77c35933031dd3610e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          4c0b2f878e9325124dad27845ac96b44

          SHA1

          0ca877fa50a70b1c7e80983c0961d82ceb580619

          SHA256

          68edf6c7e8fffebf65e31e8af29ffdd0ebaa3afa1d6cfa5378cd4c506d239727

          SHA512

          a75386a18c7045eeb187b65f3aa07b3fdd32be3e7151f55572b84c794dcf14b1ec67851aa780458cdf99c50064c28baa332f908c6ffb648b235ec73056fba8a3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e063e871735d50a3927c91bad2165438

          SHA1

          8ea64c0705b77a250d2217ab9793483e4ff1927b

          SHA256

          1de6bb2077629f1eb1a419e8191cbf27ee12c997a7d397d955a4b0a3d17eb8c9

          SHA512

          6ce7707712e20a8ea26c0250b51a04b39bec51d0ece4f9902dfc92edae859e56ac71d002845ee55071d2e5aa1e834de8a5962baca15aecd48493d48b2cda131c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

          Filesize

          430B

          MD5

          e93de2a504ec5d47a7c13bddfda8bc56

          SHA1

          53768b426a7f6158bddbda563688b38571980192

          SHA256

          7ad933d4812d127161c518c25e828ceb5bfbc14a80d307cccbee2c86295b2cab

          SHA512

          977b31b3d739d083f810a09ff107ca256e94134b9c3e79f79ec8a3c54ce0cd0a3a1709c64224c258b3683d097a6d0d74089d6b7b0dc1b19101fba6ccecf8a04d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

          Filesize

          434B

          MD5

          2b169a664c79f53634e42b23674d6020

          SHA1

          b122ae76e2bc2fb3ce88b2d81c9fad459cf81e76

          SHA256

          b129049a03c0ca26ef59dbb544ba3cba56731570a73bd32e24a7b724276f7e3a

          SHA512

          65cc919f9f86bf72550bbffe86c32f08c2971b7866f310c26f16edf4b779f4ceb4bec60b7a587b41b59cac5d587c09cbd9316e75f76f1963dd6962cc90d6a08b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          458B

          MD5

          3a85f73ef7d9646230166ea9f0549af7

          SHA1

          10d627c3afd8353ff541f56ab4b230803ec7d230

          SHA256

          eb0210cfbe34670f251468b278cd8edec4943b2a91d6a4044aaffd6dd47bdb2b

          SHA512

          1306b374f285b750e2ed3c841fb5e9719a5e6daf28da0d06623e62fe423411ef1c624beade7d0145c70eaacc36bd1baee9d88450c44efa3f44e071854c4dad60

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          458B

          MD5

          f4c2616384705bdc688b69834a071594

          SHA1

          f6075bb379f5ea1e02180c91340008fd36dde733

          SHA256

          8bb81b9d8db8c1561a5b20fab202922cede0327ff2914f0374f58b0da37ad99c

          SHA512

          1b56c4f122f6a5a595ba07856bae9d8253767b6ca755d2d7dc32bb15fd17fdba8c407acb2222d8fdf0af1e4382bce7d85e6785bb413eae443bd1ac80f5417631

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          242B

          MD5

          5b70b80f65717942180ccca3f9a7f353

          SHA1

          bda8195d98fea83d10e7e85ac08b6c4d4356dd3f

          SHA256

          b79e30d36469f0347a5e3bb237c45973989a7649684708d4c66756a27b3f895a

          SHA512

          c41f50ad880850337ed1304d2b5d4c96dc6c50af07a567bcf44b9fca25b98ebe56afab01509df20d5fdee89b014a90dd620ba0a9e31bea11dc2f996d11ce4caf

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6OB1Q09Y\version-41dcbd77dbcf416f-rbxPkgManifest[1].txt

          Filesize

          1KB

          MD5

          a5f5606901cb379a20b7e5fc70c103c2

          SHA1

          93423ebb99c628e3548ab03ebbfc0e335bcf4ce0

          SHA256

          ecc5e4347d4cb5413eec9f087cb99e3ee670e25b5552acb66a2866c0e0915f43

          SHA512

          f339544c52e8fb291b0b45c6d2a0664b58fe0c6d78a7d4d64f3277a96cc1dee39ed13f4648a610b4bfba6b0fe1479fe7588a42211dee53f6d7409505c1456109

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json

          Filesize

          2KB

          MD5

          1d2e8be2220e67b8f843e8549b550c5d

          SHA1

          79fca6120e881a3a2a3bb9752daa9e52437aa689

          SHA256

          08876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025

          SHA512

          20e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json

          Filesize

          2KB

          MD5

          1d2e8be2220e67b8f843e8549b550c5d

          SHA1

          79fca6120e881a3a2a3bb9752daa9e52437aa689

          SHA256

          08876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025

          SHA512

          20e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json

          Filesize

          2KB

          MD5

          1d2e8be2220e67b8f843e8549b550c5d

          SHA1

          79fca6120e881a3a2a3bb9752daa9e52437aa689

          SHA256

          08876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025

          SHA512

          20e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\WindowsPlayer[1].json

          Filesize

          119B

          MD5

          4a36f518afc2633dea8592f2554f6133

          SHA1

          2f0286860d7b9c26f47215393fc94fe1b24e7ad0

          SHA256

          9d2871555cb58928ad2c6ce8fabe5efbbae984091ef0c72a042b2c50c119d428

          SHA512

          be32a8c9bdc63ba1280278c7f0c0242cef01d3bf1ed9c0dff5b6141e4d76301067850b9574478e1472c24fa3614345707753858c3d76e10f404e16e02f3dac03

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\WindowsPlayer[2].json

          Filesize

          119B

          MD5

          4a36f518afc2633dea8592f2554f6133

          SHA1

          2f0286860d7b9c26f47215393fc94fe1b24e7ad0

          SHA256

          9d2871555cb58928ad2c6ce8fabe5efbbae984091ef0c72a042b2c50c119d428

          SHA512

          be32a8c9bdc63ba1280278c7f0c0242cef01d3bf1ed9c0dff5b6141e4d76301067850b9574478e1472c24fa3614345707753858c3d76e10f404e16e02f3dac03

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EF53UGF7\PCClientBootstrapper[1].json

          Filesize

          2KB

          MD5

          1d2e8be2220e67b8f843e8549b550c5d

          SHA1

          79fca6120e881a3a2a3bb9752daa9e52437aa689

          SHA256

          08876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025

          SHA512

          20e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EF53UGF7\PCClientBootstrapper[1].json

          Filesize

          2KB

          MD5

          1d2e8be2220e67b8f843e8549b550c5d

          SHA1

          79fca6120e881a3a2a3bb9752daa9e52437aa689

          SHA256

          08876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025

          SHA512

          20e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08

        • C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

          Filesize

          40B

          MD5

          3ee4b91aa2ad3722fa195e2d81b4d924

          SHA1

          70fbda48a2ebde692821d4873bd3c357a69b35e0

          SHA256

          7aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b

          SHA512

          1aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d

        • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

          Filesize

          40B

          MD5

          3ee4b91aa2ad3722fa195e2d81b4d924

          SHA1

          70fbda48a2ebde692821d4873bd3c357a69b35e0

          SHA256

          7aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b

          SHA512

          1aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d

        • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

          Filesize

          40B

          MD5

          3ee4b91aa2ad3722fa195e2d81b4d924

          SHA1

          70fbda48a2ebde692821d4873bd3c357a69b35e0

          SHA256

          7aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b

          SHA512

          1aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VF1FQ9LY.txt

          Filesize

          68B

          MD5

          5b72a5d7564000fefa7c32f1bf35989d

          SHA1

          91605149a91382995ffc36fb139474bab1e05e3d

          SHA256

          9fb1f78fcd3b40a34a33e3a55a28c246d26ae3bd9e6b9b297b345f14f6c498e2

          SHA512

          a81bc679144ffa26cb10b73dfda2dcff7a70ddf3e08539eafd1f48f7fad0d40da9ecdf4d51d3d860c73ff33c3888e15e38cac8180d67cde38a3918a8ed3687cc

        • \Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

          Filesize

          2.0MB

          MD5

          322ad896786eea9f94746287710f78bb

          SHA1

          7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

          SHA256

          835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

          SHA512

          e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

        • \Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

          Filesize

          2.0MB

          MD5

          322ad896786eea9f94746287710f78bb

          SHA1

          7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

          SHA256

          835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

          SHA512

          e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

        • \Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

          Filesize

          2.0MB

          MD5

          322ad896786eea9f94746287710f78bb

          SHA1

          7cd1e382ca1a8b61df3f2fd7c6307eb549bb7730

          SHA256

          835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8

          SHA512

          e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe

          Filesize

          57.5MB

          MD5

          ccac7596d7a99ec3cf796b286378e5e0

          SHA1

          e1967831b8472ba519c81e425bdcff10098cd208

          SHA256

          b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27

          SHA512

          d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • \Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe

          Filesize

          2.0MB

          MD5

          34d6da080af6ae29247f06bcae9292c5

          SHA1

          6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

          SHA256

          ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

          SHA512

          c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

        • memory/1516-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

          Filesize

          8KB

        • memory/1524-126-0x00000000013C0000-0x0000000006AA8000-memory.dmp

          Filesize

          86.9MB

        • memory/1524-130-0x00000000013C0000-0x0000000006AA8000-memory.dmp

          Filesize

          86.9MB