Analysis
-
max time kernel
137s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 15:45
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20221111-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
6723f12d15525aab7f012dc6050a8d3c
-
SHA1
a349dc774f9e5fa0023c26d421f94dec8701f19d
-
SHA256
e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9
-
SHA512
4fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4
-
SSDEEP
49152:ZmFShsAj6/KeoXwO4RDQ8ZdTJCaY+4lNT7CM6PMQ3d2OnTqb6cPz:SS+Aj6/uXcDQ81sbB7
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RobloxPlayerLauncher.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe -
Loads dropped DLL 6 IoCs
Processes:
RobloxPlayerLauncher.exepid process 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
RobloxPlayerLauncher.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactFiberDevToolsHook.new.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak-5fead8c7-0.1.1\lumberyak\Logger.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Tile\ItemTile\ItemTileStatus.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\ShowMoreWrapper\helpers\loadFriendGroup.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Time\Time\DateTime.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaChat\9-slice\hello-button.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioUIEditor\icon_rotate2.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\link\utils\transformOperation.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\ScreenshotHud\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\Settings\MenuBarIcons\RecordTab.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\ChatWindow\UI\ChatWindow\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\AlertView\CheckIcon.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Utils\useFetchContactImporterInfoOnce.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\AddFriendsTileSquare\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ManageCollaborators\arrowDown_dark.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\InspectMenu\ico_favorite_off.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsPage\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\SocialPanel\SocialPanelUserList\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Menu\ContextualMenu.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Stories\PYMKCarouselUserTile.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\FireEvent\reportCounter.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\VR\Radial\Icons\2DUI.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-c69837d6-1b7ccfde\RoduxGames\Actions\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Otter\Otter\assign.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\NativeUtilProtocol\NativeUtilProtocol\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Analytics\useUserSeenEvent.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\AvatarEditorImages\circle_gray4.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\TerrainTools\icon_picker_enable.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\CollisionMatchers2D\CollisionMatchers2D\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Rodux.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\TerrainTools\mtrl_mud.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactFiberUnwindWork.new.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\ChatInput\UI\ChatInputBar\ChannelChip.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuaProfileDeps\t.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-64af4154-868f23dc\RoduxAliases\Actions\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Analytics\Analytics\AnalyticsReporters\Influx.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingPage\noResults.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Requests\GamesMultigetPlaceDetails.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\btn_newWhiteGlow.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Actions\VoiceParticipantAdded.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\update.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\ReactReconciler\ReactFiberHostConfig.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\Validator\validateSelectionCursorInfoNew.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\jest.config.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoactUtils\RoactUtils\Hooks\useLocalization.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioSharedUI\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\DeveloperTools\DeveloperTools\Classes\TargetWorker.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingUsers\NetworkingUsers\USERS_URL.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Shared-9c8468d8-8a7220fd\Shared\flowtypes.roblox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\SocialLuaAnalytics.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\Rodux.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\UIBlox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\InGameMenu\ScrollMiddle.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\JestGlobals.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RegExp\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak-5fead8c7-0.1.1\lumberyak\example\app\app.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Dialog\Alert\Alert.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\InGameMenu\gradient.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioSharedUI\alert_error_withbg.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\Actions\IncomingBubbleChatMessageReceived.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.4.2\LuauPolyfill\Map\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-8201de9c-db69cf81\NetworkingGames\networkRequests\createGetExperiencesDetails.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-9c8468d8-8a7220fd\ReactRoblox\client\ReactRobloxHostTypes.roblox.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-ffcfa086-ca9547e2\RoduxGames\init.lua RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
RobloxPlayerLauncher.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\Policy = "3" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\Policy = "3" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ProtocolExecute RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D} RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9E334C6-7989-46A5-AEB7-28EBBE725D5D}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65589137-2D16-41C2-888E-CF4F4A44496D} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 36 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe -
Processes:
RobloxPlayerLauncher.exeRobloxPlayerLauncher.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RobloxPlayerLauncher.exepid process 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe 1232 RobloxPlayerLauncher.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
RobloxPlayerLauncher.exedescription pid process target process PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1232 wrote to memory of 1396 1232 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=d0b4c56632452fa149160ea75abb3fd8ebbae2c4 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c4,0x5c8,0x5cc,0x5a0,0x5d4,0x12532a8,0x12532b8,0x12532c82⤵
- Modifies system certificate store
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771Filesize
1KB
MD531b910d0e28bfa4faded9cea77abd3e9
SHA1467a701f23d57c85d5efcafefeb66c369fd4d651
SHA256129f2ccd30c0580a3ad0f4cbb6d84a8bedc07498fff02680a83bdeeb20dd1992
SHA512947970353d67a1cde207910fb3ef8e81f42495e2400619c835caa86179af32769695b55eab10e4582d95b0781307ba58671ba451a5cb2a55df564a68b0e41498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD5d869aa372177cefe16f9a4f3e656ae1d
SHA1dd648b47c178dcd3f7cdf5f87146cd15196d6fa2
SHA256d7cb6b3e1ae57fd75e9fda78c05e4f630710ccbb005a82518106dbcbc7237906
SHA512bb6361cedc3ce8e47bda83d9271cd9f5ce6451866785d2f79b427af8ec74ff4b655e5d1f4a3caa052f9919c05cc423bdac2e5d0a878e2ddbac69aaa75c6354a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2DFilesize
1KB
MD5c674a0c651cafbc666ff3d39fd943be0
SHA1af67492d7d9e7eedd7d485df51cd08c864bf62e2
SHA256c7422305f0d70e5796439ee0cdfe4766ffc4731e1c15951ddcc0ff3a4025deb1
SHA51207526ece36e0e63c5e6ee4dad9aacae6f22c8b9a8b31fe137720fe90dcb2b39818fec263ec561943b6cee327454a90bba5b4b63601e18c4a7ab412090a29dfc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771Filesize
450B
MD5dbce66bf014c9ace9982c23fdcc09211
SHA1fba6991ed3777f2745b2ad6a6db04e5f80aa3c79
SHA256981dce8c1f2015d77970e44901e81a452282c4b7a1d2ed7c4d986a026ef9fd57
SHA512efdc17236c306e38c6912f947a6c4f4ec36773fd18378c27350efbaa7dcad0b35b26c11973271a7f2673b826019a4335f81d3efa70c2908dbdd30e924003092a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD586d5db27027347d1bd5592a497494aae
SHA117fa44126cc8eebe1c1447f20b6aec149f8a08f1
SHA256154cffd3792ce610293071e3a84c289dccedc29bb190891766956f0f24ca9f8a
SHA512fad2d9e0cc59c0611a162b796554624b20f4974ea3d328df6e8a3af485f432200ea8b14f5d3fac4abe919b505e205adcaaa4e7fa658f560d2e101c111b4a860d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5ffb7eac1c1d292696f56f6a838643823
SHA13f4a702ae40fff7d2fbdc85e77384f02f2264699
SHA256437151aee85c2e64fa3ceafb4fb91bd8a93a852ccbbc2bcf66693cabe99f6211
SHA512f4a7e58afb2a5dafba4dde9cf741728705eb92b1b956d2276526a42afc41acba0d0d7be7d85cfae9a6df1e28a0158c829b2c3def54b99447c9ec2a680e4f49cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD58b8b9c506e8276be5153c71e50e42aef
SHA13160b603613cb201c12c7a62726a741a7d9f84f1
SHA256afd2d1c42bc94f2dfdad60e6a77a753091b180af0069b1c41e810f182c31051e
SHA512f6aafe200a06ec67d792e5fc0f205d5c10df8692fa4c8c8c2d20cbefbc31c54fd9608f81c61b390657daf4123524042f60352e44373f1d0c982b9445feb631b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2DFilesize
458B
MD5c0bb64ff496411e2213f1cef866538df
SHA1a4079a3cbbd65d5c925f999eb391cd1bac0f2c48
SHA2561aa6fcf64ee5c6878e03ab000027cd2a556775757dbfe6832ece49d11aac5a3d
SHA51237cd4713ddfd615d863e521d37a7df29de2655428e43164a490385158347684ba467f5a8599c3e9d19668504a8a0606f7b31223980b09aad043170bd28bf7efa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\PCClientBootstrapper[1].jsonFilesize
2KB
MD53e511c368304454f7c38d2bc125ea762
SHA1fc6a9ecc9cd17efb1ab85287d7a5006b0f3ad0c0
SHA2568921eb5bb390fe87bc77cfb96ea9c8a914ede063c256b7db3119f2babd5f4a2b
SHA5125ccc497dc5125ae885282b7e725346d010ef25efb95452ba5eafb4686a3fd5c8465dc7923bdac33bf570ed41501ce38121865f5ee92b5dc1ddbebb3b18d73842
-
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.datFilesize
40B
MD579f65757db3c167af32797deab297fd5
SHA17f053b60623dc7b7af27b5f29efb596fc639b5bd
SHA256b32842ab643a0d4b2ae18a52f5f2962decb8524b3a7085aa25a9bbaafd9501b1
SHA51252032d4692228dec996658bf6745e782b993c472d638bb7835106fee12cc97c15e2df983f99cbc147744b1c147fa55ac51170f07208d4daabdd407e2fe4bfe74
-
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exeFilesize
2.0MB
MD5d9d2e5377a7c4c4fce388bd63223f027
SHA13fde9184f7d1b3b9f694b92e3044d2650da06e4b
SHA25629e95a701df0a8d0f896c3978c44a214306eef238c2fc56454e5dcd7206cd804
SHA512f087605d59547838b93e061c43c7d87283496f64c33633d495868518d7949b444233aef8566ad0b6fcd21ed9c0f4dc5b18935c9cff43e17bb9053a05595785c0
-
\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exeFilesize
2.0MB
MD5d9d2e5377a7c4c4fce388bd63223f027
SHA13fde9184f7d1b3b9f694b92e3044d2650da06e4b
SHA25629e95a701df0a8d0f896c3978c44a214306eef238c2fc56454e5dcd7206cd804
SHA512f087605d59547838b93e061c43c7d87283496f64c33633d495868518d7949b444233aef8566ad0b6fcd21ed9c0f4dc5b18935c9cff43e17bb9053a05595785c0
-
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerBeta.exeFilesize
57.6MB
MD54807aab213ee368e3e679518f0c17d96
SHA11b4368ee8e9fea0bc2b9b916cc3a5edfffc8b19d
SHA256e3f8a3e5ec91b521066c7ec0ab5ce6aa8ed3e648f6769b54fd44d08677983b87
SHA512b57decbbe65ee9e77cd56adc1a28d9d1cc17fd9940ad2e11f7d73bfa3ab35e3e847fa490857a1f91696e6cd87f2a77b378d335d78113e1c375230413753fe27e
-
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerBeta.exeFilesize
57.6MB
MD54807aab213ee368e3e679518f0c17d96
SHA11b4368ee8e9fea0bc2b9b916cc3a5edfffc8b19d
SHA256e3f8a3e5ec91b521066c7ec0ab5ce6aa8ed3e648f6769b54fd44d08677983b87
SHA512b57decbbe65ee9e77cd56adc1a28d9d1cc17fd9940ad2e11f7d73bfa3ab35e3e847fa490857a1f91696e6cd87f2a77b378d335d78113e1c375230413753fe27e
-
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerLauncher.exeFilesize
2.0MB
MD56723f12d15525aab7f012dc6050a8d3c
SHA1a349dc774f9e5fa0023c26d421f94dec8701f19d
SHA256e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9
SHA5124fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4
-
\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\RobloxPlayerLauncher.exeFilesize
2.0MB
MD56723f12d15525aab7f012dc6050a8d3c
SHA1a349dc774f9e5fa0023c26d421f94dec8701f19d
SHA256e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9
SHA5124fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4
-
memory/1232-54-0x0000000075E01000-0x0000000075E03000-memory.dmpFilesize
8KB
-
memory/1396-55-0x0000000000000000-mapping.dmp