e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9

Analysis

max time kernel
137s
max time network
81s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxPlayerLauncher.exe
Size

2.0MB
MD5

6723f12d15525aab7f012dc6050a8d3c
SHA1

a349dc774f9e5fa0023c26d421f94dec8701f19d
SHA256

e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9
SHA512

4fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4
SSDEEP

49152:ZmFShsAj6/KeoXwO4RDQ8ZdTJCaY+4lNT7CM6PMQ3d2OnTqb6cPz:SS+Aj6/uXcDQ81sbB7

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RobloxPlayerLauncher.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Loads dropped DLL 6 IoCs

Processes:

RobloxPlayerLauncher.exe

pid	process
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RobloxPlayerLauncher.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerLauncher.exe

description	ioc	process
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactFiberDevToolsHook.new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak-5fead8c7-0.1.1\lumberyak\Logger.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Tile\ItemTile\ItemTileStatus.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\ShowMoreWrapper\helpers\loadFriendGroup.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Time\Time\DateTime.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaChat\9-slice\hello-button.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioUIEditor\icon_rotate2.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\link\utils\transformOperation.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\Settings\MenuBarIcons\RecordTab.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\ChatWindow\UI\ChatWindow\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\AlertView\CheckIcon.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Utils\useFetchContactImporterInfoOnce.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\AddFriendsTileSquare\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ManageCollaborators\arrowDown_dark.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\InspectMenu\ico_favorite_off.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsPage\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\SocialPanel\SocialPanelUserList\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\ContextualMenu.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Stories\PYMKCarouselUserTile.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\FireEvent\reportCounter.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\VR\Radial\Icons\2DUI.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-c69837d6-1b7ccfde\RoduxGames\Actions\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Otter\Otter\assign.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\NativeUtilProtocol\NativeUtilProtocol\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Analytics\useUserSeenEvent.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\AvatarEditorImages\circle_gray4.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\TerrainTools\icon_picker_enable.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\CollisionMatchers2D\CollisionMatchers2D\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Rodux.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\TerrainTools\mtrl_mud.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactFiberUnwindWork.new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\ChatInput\UI\ChatInputBar\ChannelChip.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuaProfileDeps\t.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-64af4154-868f23dc\RoduxAliases\Actions\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Analytics\Analytics\AnalyticsReporters\Influx.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingPage\noResults.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Requests\GamesMultigetPlaceDetails.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\btn_newWhiteGlow.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Actions\VoiceParticipantAdded.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\update.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactFiberHostConfig.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\Validator\validateSelectionCursorInfoNew.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\jest.config.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoactUtils\RoactUtils\Hooks\useLocalization.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioSharedUI\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\DeveloperTools\DeveloperTools\Classes\TargetWorker.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingUsers\NetworkingUsers\USERS_URL.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Shared-9c8468d8-8a7220fd\Shared\flowtypes.roblox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\SocialLuaAnalytics.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\Rodux.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\UIBlox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\InGameMenu\ScrollMiddle.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\JestGlobals.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RegExp\lock.toml	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak-5fead8c7-0.1.1\lumberyak\example\app\app.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Alert\Alert.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\InGameMenu\gradient.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioSharedUI\alert_error_withbg.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Actions\IncomingBubbleChatMessageReceived.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.4.2\LuauPolyfill\Map\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-8201de9c-db69cf81\NetworkingGames\networkRequests\createGetExperiencesDetails.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-9c8468d8-8a7220fd\ReactRoblox\client\ReactRobloxHostTypes.roblox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-ffcfa086-ca9547e2\RoduxGames\init.lua	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerLauncher.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\Policy = "3"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\Policy = "3"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\AppName = "RobloxPlayerBeta.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\AppName = "RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe

Modifies registry class 36 IoCs

Processes:

RobloxPlayerLauncher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	RobloxPlayerLauncher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RobloxPlayerLauncher.exe

pid	process
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe
1232	RobloxPlayerLauncher.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

RobloxPlayerLauncher.exe

description	pid	process	target process
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe
PID 1232 wrote to memory of 1396	1232	RobloxPlayerLauncher.exe	RobloxPlayerLauncher.exe

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=d0b4c56632452fa149160ea75abb3fd8ebbae2c4 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c4,0x5c8,0x5cc,0x5a0,0x5d4,0x12532a8,0x12532b8,0x12532c8
2⤵
- Modifies system certificate store
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
1KB

MD5
31b910d0e28bfa4faded9cea77abd3e9

SHA1
467a701f23d57c85d5efcafefeb66c369fd4d651

SHA256
129f2ccd30c0580a3ad0f4cbb6d84a8bedc07498fff02680a83bdeeb20dd1992

SHA512
947970353d67a1cde207910fb3ef8e81f42495e2400619c835caa86179af32769695b55eab10e4582d95b0781307ba58671ba451a5cb2a55df564a68b0e41498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
471B

MD5
d869aa372177cefe16f9a4f3e656ae1d

SHA1
dd648b47c178dcd3f7cdf5f87146cd15196d6fa2

SHA256
d7cb6b3e1ae57fd75e9fda78c05e4f630710ccbb005a82518106dbcbc7237906

SHA512
bb6361cedc3ce8e47bda83d9271cd9f5ce6451866785d2f79b427af8ec74ff4b655e5d1f4a3caa052f9919c05cc423bdac2e5d0a878e2ddbac69aaa75c6354a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
1KB

MD5
c674a0c651cafbc666ff3d39fd943be0

SHA1
af67492d7d9e7eedd7d485df51cd08c864bf62e2

SHA256
c7422305f0d70e5796439ee0cdfe4766ffc4731e1c15951ddcc0ff3a4025deb1

SHA512
07526ece36e0e63c5e6ee4dad9aacae6f22c8b9a8b31fe137720fe90dcb2b39818fec263ec561943b6cee327454a90bba5b4b63601e18c4a7ab412090a29dfc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
450B

MD5
dbce66bf014c9ace9982c23fdcc09211

SHA1
fba6991ed3777f2745b2ad6a6db04e5f80aa3c79

SHA256
981dce8c1f2015d77970e44901e81a452282c4b7a1d2ed7c4d986a026ef9fd57

SHA512
efdc17236c306e38c6912f947a6c4f4ec36773fd18378c27350efbaa7dcad0b35b26c11973271a7f2673b826019a4335f81d3efa70c2908dbdd30e924003092a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
86d5db27027347d1bd5592a497494aae

SHA1
17fa44126cc8eebe1c1447f20b6aec149f8a08f1

SHA256
154cffd3792ce610293071e3a84c289dccedc29bb190891766956f0f24ca9f8a

SHA512
fad2d9e0cc59c0611a162b796554624b20f4974ea3d328df6e8a3af485f432200ea8b14f5d3fac4abe919b505e205adcaaa4e7fa658f560d2e101c111b4a860d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
ffb7eac1c1d292696f56f6a838643823

SHA1
3f4a702ae40fff7d2fbdc85e77384f02f2264699

SHA256
437151aee85c2e64fa3ceafb4fb91bd8a93a852ccbbc2bcf66693cabe99f6211

SHA512
f4a7e58afb2a5dafba4dde9cf741728705eb92b1b956d2276526a42afc41acba0d0d7be7d85cfae9a6df1e28a0158c829b2c3def54b99447c9ec2a680e4f49cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
400B

MD5
8b8b9c506e8276be5153c71e50e42aef

SHA1
3160b603613cb201c12c7a62726a741a7d9f84f1

SHA256
afd2d1c42bc94f2dfdad60e6a77a753091b180af0069b1c41e810f182c31051e

SHA512
f6aafe200a06ec67d792e5fc0f205d5c10df8692fa4c8c8c2d20cbefbc31c54fd9608f81c61b390657daf4123524042f60352e44373f1d0c982b9445feb631b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
458B

MD5
c0bb64ff496411e2213f1cef866538df

SHA1
a4079a3cbbd65d5c925f999eb391cd1bac0f2c48

SHA256
1aa6fcf64ee5c6878e03ab000027cd2a556775757dbfe6832ece49d11aac5a3d

SHA512
37cd4713ddfd615d863e521d37a7df29de2655428e43164a490385158347684ba467f5a8599c3e9d19668504a8a0606f7b31223980b09aad043170bd28bf7efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\PCClientBootstrapper[1].json
Filesize
2KB

MD5
3e511c368304454f7c38d2bc125ea762

SHA1
fc6a9ecc9cd17efb1ab85287d7a5006b0f3ad0c0

SHA256
8921eb5bb390fe87bc77cfb96ea9c8a914ede063c256b7db3119f2babd5f4a2b

SHA512
5ccc497dc5125ae885282b7e725346d010ef25efb95452ba5eafb4686a3fd5c8465dc7923bdac33bf570ed41501ce38121865f5ee92b5dc1ddbebb3b18d73842

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
Filesize
40B

MD5
79f65757db3c167af32797deab297fd5

SHA1
7f053b60623dc7b7af27b5f29efb596fc639b5bd

SHA256
b32842ab643a0d4b2ae18a52f5f2962decb8524b3a7085aa25a9bbaafd9501b1

SHA512
52032d4692228dec996658bf6745e782b993c472d638bb7835106fee12cc97c15e2df983f99cbc147744b1c147fa55ac51170f07208d4daabdd407e2fe4bfe74

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
Filesize
2.0MB

MD5
d9d2e5377a7c4c4fce388bd63223f027

SHA1
3fde9184f7d1b3b9f694b92e3044d2650da06e4b

SHA256
29e95a701df0a8d0f896c3978c44a214306eef238c2fc56454e5dcd7206cd804

SHA512
f087605d59547838b93e061c43c7d87283496f64c33633d495868518d7949b444233aef8566ad0b6fcd21ed9c0f4dc5b18935c9cff43e17bb9053a05595785c0

Download Submit
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
Filesize
2.0MB

MD5
d9d2e5377a7c4c4fce388bd63223f027

SHA1
3fde9184f7d1b3b9f694b92e3044d2650da06e4b

SHA256
29e95a701df0a8d0f896c3978c44a214306eef238c2fc56454e5dcd7206cd804

SHA512
f087605d59547838b93e061c43c7d87283496f64c33633d495868518d7949b444233aef8566ad0b6fcd21ed9c0f4dc5b18935c9cff43e17bb9053a05595785c0

Download Submit
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerBeta.exe
Filesize
57.6MB

MD5
4807aab213ee368e3e679518f0c17d96

SHA1
1b4368ee8e9fea0bc2b9b916cc3a5edfffc8b19d

SHA256
e3f8a3e5ec91b521066c7ec0ab5ce6aa8ed3e648f6769b54fd44d08677983b87

SHA512
b57decbbe65ee9e77cd56adc1a28d9d1cc17fd9940ad2e11f7d73bfa3ab35e3e847fa490857a1f91696e6cd87f2a77b378d335d78113e1c375230413753fe27e

Download Submit
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerBeta.exe
Filesize
57.6MB

MD5
4807aab213ee368e3e679518f0c17d96

SHA1
1b4368ee8e9fea0bc2b9b916cc3a5edfffc8b19d

SHA256
e3f8a3e5ec91b521066c7ec0ab5ce6aa8ed3e648f6769b54fd44d08677983b87

SHA512
b57decbbe65ee9e77cd56adc1a28d9d1cc17fd9940ad2e11f7d73bfa3ab35e3e847fa490857a1f91696e6cd87f2a77b378d335d78113e1c375230413753fe27e

Download Submit
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerLauncher.exe
Filesize
2.0MB

MD5
6723f12d15525aab7f012dc6050a8d3c

SHA1
a349dc774f9e5fa0023c26d421f94dec8701f19d

SHA256
e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9

SHA512
4fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4

Download Submit
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerLauncher.exe
Filesize
2.0MB

MD5
6723f12d15525aab7f012dc6050a8d3c

SHA1
a349dc774f9e5fa0023c26d421f94dec8701f19d

SHA256
e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9

SHA512
4fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4

Download Submit
memory/1232-54-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/1396-55-0x0000000000000000-mapping.dmp

Download