Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31/01/2023, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20221111-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
15396fe00f8ee8d7ae41bb6884f9979b
-
SHA1
5b57ca2e66568d55eb67349f7b68b9a792299743
-
SHA256
9dcd1c7e9bcba6dd6c49e370d0b87ee94e2d0c5d6bbce918759cd942fcd62d07
-
SHA512
8e3a75b176f5658a2a08ea6a17cd9dfd35bb3c8f7c5bf843ac2d1eef76ebed599710c8122165d07590845db4e30e4b4fb96456521684a2b48506cdaa6674ee7a
-
SSDEEP
49152:hSN68wfCWTVlrX/tfQgTpiaYRo2RT48MPPMQ3d2XET4b6Qs:As8wKWTVlL/tfibBs
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 1892 RobloxPlayerLauncher.exe 956 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1664 RobloxPlayerLauncher.exe 1524 RobloxPlayerBeta.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation RobloxPlayerBeta.exe -
Loads dropped DLL 28 IoCs
pid Process 1516 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1424 RobloxPlayerLauncher.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Style\Themes\getThemeFromName.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppLocales\RobloxAppLocales\Locales\kk-kz.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\Debugger\Step-In.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\AppTempCommon\Common\.robloxrc RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RecordPlayback\RecordPlayback\LuauModuleSerializer\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\views\RobloxStackView\StackViewOverlayFrame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Analytics\Enums\EventTypes.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\makeContextualMenu.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\avatar\heads\headA.mesh RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\InfiniteScroller\FitFrame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestDiff-edcba0e9-3.2.1\JestDiff\DiffLines.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\React-9c8468d8-8a7220fd\React\ReactElementValidator.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Analytics\Formatters\formatContextType.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsTile\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialWidgetsTestSuite\SocialWidgetsTestSuite\jest.config.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\textures\ui\LuaApp\ExternalSite\qq.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Emotes\Editor\TenFoot\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactWorkTags.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\__tests__\RhodiumHelpers\findFirstElement.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Timers\Timers\makeTimerImpl.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Flags\getFFlagFriendsLandingFixNoFriendsTooltip.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SharedFlags\SharedFlags\getFFlagFixFriendshipOriginSourceType.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\places\InGameMenu.rbxl RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\IAPExperience.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\JestConfigs\UIBlox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SetAlias\SetAlias\Components\SetAliasModal\SetAliasModal.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Button\getContentStyle.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageToast\RoactNavigation.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppAssets\RobloxAppAssets\GetImageSetData.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioToolbox\AssetPreview\preview.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\__tests__\UniqueVariableNamesRule.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\GameSettings\copy.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\llama\llama\List\push.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxShareLinks\RoduxShareLinks\Actions\ClearShareInviteLink.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsScreen\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Loggers\Lumberyak.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioSharedUI\preview_expand.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\StudioToolbox\AudioPreview\play_hover.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Controls\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\Actions\FocusChatHotKeyActivated.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\FitFrame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\Components\SocialTabEntryPoint\mapDispatchToProps.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\TerrainTools\mtrl_sandstone.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\Commands\RBXMuteCommand.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-64af4154-868f23dc\RoduxAliases\getDeepValue.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\LuaSocialLibrariesDeps.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\UserCarousel\Components\AddFriendHint\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\textures\ui\LuaChat\icons\ic-game-pressed-24x24.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\textures\ui\Settings\Slider\BarLeft.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\PlatformContent\pc\textures\water\normal_06.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Tile\ExperienceTile\ExperienceTile.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsExtensions-a406e214-4230f473\ReactDevtoolsExtensions\backend.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\t.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\InputType\InputType\InputTypeMap.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\content\models\LayeredClothingEditor\PartHeadTemplate.rbxm RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\optimism\anyEntryTypes.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ReactRobloxProxy\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux\rodux\loggerMiddleware.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\Dash\Dash\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\ChatWindow\UI\ScrollingView\ScrollingView.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestConsole-edcba0e9-2.4.1\JestConsole\NullConsole.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\JestReporters-edcba0e9-2.4.1\JestTypes.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-ffcfa086-ca9547e2\RoduxGames\Models\ProductModel.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\RoactLayout\init.lua RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EAB5869C-B1CC-4D6A-ADCD-B79271CEB020}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000" RobloxPlayerBeta.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EAB5869C-B1CC-4D6A-ADCD-B79271CEB020}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25212CB4-6FAC-4AE3-AD24-5220C21C783A}\Policy = "3" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ProtocolExecute RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl RobloxPlayerBeta.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION RobloxPlayerBeta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EAB5869C-B1CC-4D6A-ADCD-B79271CEB020}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25212CB4-6FAC-4AE3-AD24-5220C21C783A}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25212CB4-6FAC-4AE3-AD24-5220C21C783A}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION RobloxPlayerBeta.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main RobloxPlayerBeta.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EAB5869C-B1CC-4D6A-ADCD-B79271CEB020} RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25212CB4-6FAC-4AE3-AD24-5220C21C783A} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 50 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Key deleted \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-41dcbd77dbcf416f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1892 RobloxPlayerLauncher.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe 1524 RobloxPlayerBeta.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1524 RobloxPlayerBeta.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 1524 RobloxPlayerBeta.exe Token: 33 1808 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1808 AUDIODG.EXE Token: 33 1808 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1808 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1524 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1488 1516 RobloxPlayerLauncher.exe 30 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1516 wrote to memory of 1892 1516 RobloxPlayerLauncher.exe 32 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1892 wrote to memory of 956 1892 RobloxPlayerLauncher.exe 33 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1664 1424 RobloxPlayerLauncher.exe 38 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40 PID 1424 wrote to memory of 1524 1424 RobloxPlayerLauncher.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=4b4135d8a5af5c6ff5bb89faa646bc380209874d --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c0,0x5c4,0x5c8,0x59c,0x5d0,0xf65f68,0xf65f78,0xf65f882⤵
- Modifies system certificate store
PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RBX-58970A5E\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5bc,0x5c0,0x5c4,0x594,0x5cc,0xfc32f4,0xfc3304,0xfc33143⤵
- Executes dropped EXE
PID:956
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe"C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe" -app1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe"C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5d405edfb1976b7e4d3f1f67b16302c21e7e5766 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5ec,0x5f0,0x5f4,0x5e8,0x5fc,0x7932f4,0x793304,0x7933142⤵
- Executes dropped EXE
PID:1664
-
-
C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-41dcbd77dbcf416f\RobloxPlayerBeta.exe" --app2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize1KB
MD529dfe305b4212892ea463b542ffbb23e
SHA11e8e9f31519b432624bd9ecf4f1122b315c73645
SHA2565de62195d2b48c7a6b05f14d5bcb0f270cabbd38d9081c28039183376ab99966
SHA512005ff52a781fcb191f42e5aa802d13631b79f13f51a912c8b7cc4ad34fe630e30e6ae34b84140d675df660e4502659d3199aedd9f9ef9788ef0b76069cbe84c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize1KB
MD529dfe305b4212892ea463b542ffbb23e
SHA11e8e9f31519b432624bd9ecf4f1122b315c73645
SHA2565de62195d2b48c7a6b05f14d5bcb0f270cabbd38d9081c28039183376ab99966
SHA512005ff52a781fcb191f42e5aa802d13631b79f13f51a912c8b7cc4ad34fe630e30e6ae34b84140d675df660e4502659d3199aedd9f9ef9788ef0b76069cbe84c0
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD559c7d1c3e315494e116f2c507c82c767
SHA112a70b21e3d5d6f4aa8b9f06e115754d2ad47de6
SHA2569164088264623e289af26a53f6aae4948e9190885685866c9c7675382406d50c
SHA512a5dafd1fe7527b25a13de644ba43a79e1f2a50aed20f46c8b2b60af9926d08775480fb22f926f903231bf183da016b2dfebb0cc1195505e00b5ab7c84a0f9ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize471B
MD5b93def072383f54ce5000ce4b8ccf928
SHA12e5498d461734043bb8388e90ace8e0002ed0bd7
SHA256f76fef89e8b688e22a28018a2db8ebebc33d5d42aef85c52c8b27073858aef56
SHA512036c448d11f475abf480b62c377cc164edf7e8c6879f2cce3ea0aa88dd2ba33c3202c7724833bd771f8b4b3fed5ae3e4f95e061327e2469cbf89b04afc981adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize1KB
MD56aa767333e1541ef4ad7ce54fd398854
SHA1c49bd084f33aed56e8bafe5bcfbe7481c6356ec3
SHA256ba4e5c81b594bfad7d73fb1d718859bf6dd398f21b8edc78bdbdcfc1ace481cf
SHA51242d0c6159b80ae1ce1260f7330c5cf0febcd06d5745ea06bbbdca1477612fe0603c5bc3289b58dffca98d7d9422961f6994d0e0e993bf69e2767a0dc85c0e086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize1KB
MD56aa767333e1541ef4ad7ce54fd398854
SHA1c49bd084f33aed56e8bafe5bcfbe7481c6356ec3
SHA256ba4e5c81b594bfad7d73fb1d718859bf6dd398f21b8edc78bdbdcfc1ace481cf
SHA51242d0c6159b80ae1ce1260f7330c5cf0febcd06d5745ea06bbbdca1477612fe0603c5bc3289b58dffca98d7d9422961f6994d0e0e993bf69e2767a0dc85c0e086
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize450B
MD51e5b2d29eb6c5b9f8ad820e7ed812f69
SHA123a58876e63634937978b9b7818d7abbca035f88
SHA256f2eaa6f6b645b814b0d0a1020961d34e586a859d4ae2e2bec8dd2a87791104ae
SHA51268ae8762601ffe4ae9f76e08030bf498be17eff0ef9a85562b8f3a0b1f6f56206a20bff81a600b33c73944dfc3f66ec9441a7a26c9891a8683945e46e6df6f0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize450B
MD56d55c025007ab4bb88f9a5ac36cf8f33
SHA139d1d47c4041dc143bbd580b6823e38c74da91fb
SHA256746149878b08e659a42e8673793ddaad8d8075d6d66a018e6c99e723d8adff3d
SHA51254ed9eda0e407f3da0c80fbde98aeca2cefdeb5c2cbf2df7f746b079748eb572ada2f2ceaf409f6055986b66f018d6298bf8cecb3856e419c770c930e6dbceeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53aa93394a557eb3b83476b75234d3a19
SHA1a9726591a7ea90c529c6a65909dea2a104075938
SHA25659f7594803fdd35ed71e0b3c52580c0575a6584e20b00f4b189cfc668cf27d94
SHA51272ff40d508426e195887ecfecd7d62084b607f0af287aaf51fb7bc0f21d62ac210c1aa5a0c803242184b859ce33f7820fc680e0d6dd2e7c7311c82651a776883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f18dd76c59a838f2bb9ff267aecf9129
SHA1d63f3f91bba9e7f13f44be620d23da61da1a55d3
SHA25610c3420018afc538bd9072c2a2c91477090bb94bfc9bda7e88cd30633291c182
SHA512789a0abfe587b91578c36be4d666b4499c8ca396f7528f9293bd3659b8212fe6ec442c5a186b7a4d9daf73925725f2667a69dbf468ae8e77c35933031dd3610e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c0b2f878e9325124dad27845ac96b44
SHA10ca877fa50a70b1c7e80983c0961d82ceb580619
SHA25668edf6c7e8fffebf65e31e8af29ffdd0ebaa3afa1d6cfa5378cd4c506d239727
SHA512a75386a18c7045eeb187b65f3aa07b3fdd32be3e7151f55572b84c794dcf14b1ec67851aa780458cdf99c50064c28baa332f908c6ffb648b235ec73056fba8a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e063e871735d50a3927c91bad2165438
SHA18ea64c0705b77a250d2217ab9793483e4ff1927b
SHA2561de6bb2077629f1eb1a419e8191cbf27ee12c997a7d397d955a4b0a3d17eb8c9
SHA5126ce7707712e20a8ea26c0250b51a04b39bec51d0ece4f9902dfc92edae859e56ac71d002845ee55071d2e5aa1e834de8a5962baca15aecd48493d48b2cda131c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize430B
MD5e93de2a504ec5d47a7c13bddfda8bc56
SHA153768b426a7f6158bddbda563688b38571980192
SHA2567ad933d4812d127161c518c25e828ceb5bfbc14a80d307cccbee2c86295b2cab
SHA512977b31b3d739d083f810a09ff107ca256e94134b9c3e79f79ec8a3c54ce0cd0a3a1709c64224c258b3683d097a6d0d74089d6b7b0dc1b19101fba6ccecf8a04d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize434B
MD52b169a664c79f53634e42b23674d6020
SHA1b122ae76e2bc2fb3ce88b2d81c9fad459cf81e76
SHA256b129049a03c0ca26ef59dbb544ba3cba56731570a73bd32e24a7b724276f7e3a
SHA51265cc919f9f86bf72550bbffe86c32f08c2971b7866f310c26f16edf4b779f4ceb4bec60b7a587b41b59cac5d587c09cbd9316e75f76f1963dd6962cc90d6a08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize458B
MD53a85f73ef7d9646230166ea9f0549af7
SHA110d627c3afd8353ff541f56ab4b230803ec7d230
SHA256eb0210cfbe34670f251468b278cd8edec4943b2a91d6a4044aaffd6dd47bdb2b
SHA5121306b374f285b750e2ed3c841fb5e9719a5e6daf28da0d06623e62fe423411ef1c624beade7d0145c70eaacc36bd1baee9d88450c44efa3f44e071854c4dad60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize458B
MD5f4c2616384705bdc688b69834a071594
SHA1f6075bb379f5ea1e02180c91340008fd36dde733
SHA2568bb81b9d8db8c1561a5b20fab202922cede0327ff2914f0374f58b0da37ad99c
SHA5121b56c4f122f6a5a595ba07856bae9d8253767b6ca755d2d7dc32bb15fd17fdba8c407acb2222d8fdf0af1e4382bce7d85e6785bb413eae443bd1ac80f5417631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55b70b80f65717942180ccca3f9a7f353
SHA1bda8195d98fea83d10e7e85ac08b6c4d4356dd3f
SHA256b79e30d36469f0347a5e3bb237c45973989a7649684708d4c66756a27b3f895a
SHA512c41f50ad880850337ed1304d2b5d4c96dc6c50af07a567bcf44b9fca25b98ebe56afab01509df20d5fdee89b014a90dd620ba0a9e31bea11dc2f996d11ce4caf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6OB1Q09Y\version-41dcbd77dbcf416f-rbxPkgManifest[1].txt
Filesize1KB
MD5a5f5606901cb379a20b7e5fc70c103c2
SHA193423ebb99c628e3548ab03ebbfc0e335bcf4ce0
SHA256ecc5e4347d4cb5413eec9f087cb99e3ee670e25b5552acb66a2866c0e0915f43
SHA512f339544c52e8fb291b0b45c6d2a0664b58fe0c6d78a7d4d64f3277a96cc1dee39ed13f4648a610b4bfba6b0fe1479fe7588a42211dee53f6d7409505c1456109
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json
Filesize2KB
MD51d2e8be2220e67b8f843e8549b550c5d
SHA179fca6120e881a3a2a3bb9752daa9e52437aa689
SHA25608876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025
SHA51220e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json
Filesize2KB
MD51d2e8be2220e67b8f843e8549b550c5d
SHA179fca6120e881a3a2a3bb9752daa9e52437aa689
SHA25608876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025
SHA51220e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\PCClientBootstrapper[1].json
Filesize2KB
MD51d2e8be2220e67b8f843e8549b550c5d
SHA179fca6120e881a3a2a3bb9752daa9e52437aa689
SHA25608876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025
SHA51220e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\WindowsPlayer[1].json
Filesize119B
MD54a36f518afc2633dea8592f2554f6133
SHA12f0286860d7b9c26f47215393fc94fe1b24e7ad0
SHA2569d2871555cb58928ad2c6ce8fabe5efbbae984091ef0c72a042b2c50c119d428
SHA512be32a8c9bdc63ba1280278c7f0c0242cef01d3bf1ed9c0dff5b6141e4d76301067850b9574478e1472c24fa3614345707753858c3d76e10f404e16e02f3dac03
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9XNRFMOH\WindowsPlayer[2].json
Filesize119B
MD54a36f518afc2633dea8592f2554f6133
SHA12f0286860d7b9c26f47215393fc94fe1b24e7ad0
SHA2569d2871555cb58928ad2c6ce8fabe5efbbae984091ef0c72a042b2c50c119d428
SHA512be32a8c9bdc63ba1280278c7f0c0242cef01d3bf1ed9c0dff5b6141e4d76301067850b9574478e1472c24fa3614345707753858c3d76e10f404e16e02f3dac03
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EF53UGF7\PCClientBootstrapper[1].json
Filesize2KB
MD51d2e8be2220e67b8f843e8549b550c5d
SHA179fca6120e881a3a2a3bb9752daa9e52437aa689
SHA25608876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025
SHA51220e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EF53UGF7\PCClientBootstrapper[1].json
Filesize2KB
MD51d2e8be2220e67b8f843e8549b550c5d
SHA179fca6120e881a3a2a3bb9752daa9e52437aa689
SHA25608876f9e34ee41f9e7dc4d02d62b2fcfe1c3b6d9d34cb53ff41bca5f2c90a025
SHA51220e026d68c6a4504429305ed9914c99d5f282043c0d82e09e45ac2b7fb1705db18547c779e7c6bf6215bc06905c78aa5e89035432480e0836d42c02ce3391b08
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
40B
MD53ee4b91aa2ad3722fa195e2d81b4d924
SHA170fbda48a2ebde692821d4873bd3c357a69b35e0
SHA2567aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b
SHA5121aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d
-
Filesize
40B
MD53ee4b91aa2ad3722fa195e2d81b4d924
SHA170fbda48a2ebde692821d4873bd3c357a69b35e0
SHA2567aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b
SHA5121aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d
-
Filesize
40B
MD53ee4b91aa2ad3722fa195e2d81b4d924
SHA170fbda48a2ebde692821d4873bd3c357a69b35e0
SHA2567aff432c0cec5ceec3cf54a40be72fee45e25ac596105f66225a25cde9d9219b
SHA5121aa044953149b40c7c7ae8b39db0316f93573147e4992f8e211241db6cc8e350b26ee31af26009d4c44bf90f1f078666a70cd8b9289fca46686d18766510738d
-
Filesize
68B
MD55b72a5d7564000fefa7c32f1bf35989d
SHA191605149a91382995ffc36fb139474bab1e05e3d
SHA2569fb1f78fcd3b40a34a33e3a55a28c246d26ae3bd9e6b9b297b345f14f6c498e2
SHA512a81bc679144ffa26cb10b73dfda2dcff7a70ddf3e08539eafd1f48f7fad0d40da9ecdf4d51d3d860c73ff33c3888e15e38cac8180d67cde38a3918a8ed3687cc
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
2.0MB
MD5322ad896786eea9f94746287710f78bb
SHA17cd1e382ca1a8b61df3f2fd7c6307eb549bb7730
SHA256835fe15f0f4e6b78524e1ffa2eb43e117f38e0bc677535636c99e820f54de1a8
SHA512e05c413f17338b4b1bf35e64fb61c2930f30dace0028cf0dae8143bd010f2b58d309aefa1a2d6cc636efef15bdaf0075abc790d55a26dca9f263e79f21d10389
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
57.5MB
MD5ccac7596d7a99ec3cf796b286378e5e0
SHA1e1967831b8472ba519c81e425bdcff10098cd208
SHA256b720401158d02a6eaf8548df938192f4e9700e2844bfde64257413644b7a4d27
SHA512d889713d868173a66317a2ec10d20c1fd2bd2a90ab5c7436eb82978ccc75faafc78aeecaac8ba00ff8f563ec4ae1b6245ac0679421f2f9957b6c71fb505ab905
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443
-
Filesize
2.0MB
MD534d6da080af6ae29247f06bcae9292c5
SHA16b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd
SHA256ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b
SHA512c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443