vidar | f1012e68db40209bc8830a4c08293c1f185c9cd364d094f10e8b823318915240

Resubmissions

01-04-2023 00:10

230401-af5y5sfh8x 10

01-04-2023 00:04

230401-acyewsef24 8

Analysis

max time kernel
475s
max time network
476s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fuck-you(and-a-little-dubstep)-By-Tuna.mp3
Size

91KB
MD5

995071bbbce1e5c68e78680b7c0e2980
SHA1

81e65df5c76ac1b7349a21fa0026aee390e93a24
SHA256

f1012e68db40209bc8830a4c08293c1f185c9cd364d094f10e8b823318915240
SHA512

00c29432b4347f17f3341e547af7f7b1ed49936a8dd4392f937ef5e266f9288d30abb1ae5a70e84e4179585aa14754c05d8b5f9559ee94af50ad57a7b569a37d
SSDEEP

1536:DZpLvTLUW0yWJu2nuaalyrOWxGyCdg8mt0k6NdrbmLW4ySx+VR7O55:Vtv/UW0yWJbnu3QWdg8A6TrKWnSxiR7i

Score

10^/10

vidar discovery evasion spyware stealer trojan

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe

Executes dropped EXE 5 IoCs

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

pid process

312 RobloxPlayerLauncher.exe
3036 RobloxPlayerLauncher.exe
1816 RobloxPlayerLauncher.exe
4992 RobloxPlayerLauncher.exe
184 RobloxPlayerBeta.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

unregmp2.exe

description	ioc	process
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerLauncher.exe

description	ioc	process
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ArgCheck\ArgCheck\ArgCheck.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\InviteLinkExpiredModal\UIBlox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\TopBar\moreOn.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\icons\ic-nametag.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\mock\mock\tuple.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\roblox_lua-symbol\lock.toml	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\RoactLayout\new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Style\AppStyleProvider_DEPRECATED.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\CredentialsProtocol\CredentialsProtocol\CredentialsProtocolTypes.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\QRCodeDisplay\Dev\Roact.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\rodux-networking\rodux-networking\NetworkStatus\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiShell\Dev\JestGlobals.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialRoactChat\SocialRoactChat\Models\MockMessageModel.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-2bd849d2-78d25f7e\ExperienceChat\AppContainer\mapDispatchToProps.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\enumerate.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\ContactsList\Components\ContactsList\ContactsListMapStateToProps.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\Shared-a406e214-4230f473\Shared\ReactFeatureFlags.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\RoactAppExperiment.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\PlatformContent\pc\textures\metal\normal.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createGetConversations.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-24c5c11f-f6df649b\RoduxFriends\Reducers\Friends\utils\addUser.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\rules\PossibleFragmentSpreadsRule.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\React-a406e214-4230f473\React\ReactLazy.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Control\HorizontalNav\IntroScroll.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ApolloClientTesting\ApolloClientTesting\testing\itAsync.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\JestConfig\JestEnvironmentLuau.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\LuauPolyfill.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTestHelpers\SocialTestHelpers\TestHelpers\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\GameSettings\ScrollBarTop.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\StudioToolbox\AssetPreview\Rejected.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\LegacyRbxGui\sandside.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Container\getPageMargin.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\LuaSocialLibrariesDeps.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Loggers\Lumberyak.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\AvatarEditorImages\circle_blue.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Settings\Radial\Backpack.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-201ca530-56b79d20\ExperienceChat\sanitizeForRichText.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\AlignTool\Help.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Settings\LeaveGame\Button_1080.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Dash.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UniversalAppPolicy\UniversalAppPolicy\.robloxrc	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Reducers\FetchingStatus.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageBus\MessageBus\MessageBus.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PlayabilityRodux\PlayabilityRodux\Actions\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\AvatarExperienceDeps.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaApp\graphic\GameDetailsBackground\abkg_general.jpg	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\String\String\endsWith.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ApolloClientTesting\ApolloClientTesting\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\Shared-9c8468d8-8a7220fd\Shared\ReactFiberHostConfig\WithNoHydration.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\LegacyIntegrationsTestSuite\LegacyIntegrationsTestSuite\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\AlignTool\Max.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\DomTestingLibrary\types\get-node-text.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-2bd849d2-78d25f7e\ExperienceChat\sanitizeForRichText.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-2bd849d2-78d25f7e\ExperienceChat\BubbleChat\ChatBubbleDistant\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Backpack_Open.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Controls\shift.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\luaUtils\__tests__\coerceToPromise.spec.lua	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exefirefox.exesvchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe

Modifies registry class 53 IoCs

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exesvchost.exesvchost.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1013461898-3711306144-4198452673-1000\{175D0288-1F4F-41ED-9E26-F9EDFDE78BB8}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1013461898-3711306144-4198452673-1000\{05F2DDE8-8C1B-4530-A6E0-28FEC953ACE0}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe

NTFS ADS 2 IoCs

Processes:

firefox.exeRobloxPlayerLauncher.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe:Zone.Identifier	firefox.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe\:Zone.Identifier:$DATA	RobloxPlayerLauncher.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

RobloxPlayerLauncher.exeRobloxPlayerBeta.exe

pid	process
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
312	RobloxPlayerLauncher.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RobloxPlayerBeta.exe

pid process

184 RobloxPlayerBeta.exe

pid	process
184	RobloxPlayerBeta.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

unregmp2.exefirefox.exeRobloxPlayerLauncher.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	2300	unregmp2.exe
Token: SeCreatePagefilePrivilege	2300	unregmp2.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	312	RobloxPlayerLauncher.exe
Token: 33	5060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5060	AUDIODG.EXE
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

4500 firefox.exe
4500 firefox.exe
4500 firefox.exe
4500 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4500 firefox.exe
4500 firefox.exe
4500 firefox.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

firefox.exeRobloxPlayerBeta.exeOpenWith.exe

pid	process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
184	RobloxPlayerBeta.exe
184	RobloxPlayerBeta.exe
3076	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wmplayer.exeunregmp2.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4340 wrote to memory of 1480	4340	wmplayer.exe	setup_wm.exe
PID 4340 wrote to memory of 1480	4340	wmplayer.exe	setup_wm.exe
PID 4340 wrote to memory of 1480	4340	wmplayer.exe	setup_wm.exe
PID 4340 wrote to memory of 3584	4340	wmplayer.exe	unregmp2.exe
PID 4340 wrote to memory of 3584	4340	wmplayer.exe	unregmp2.exe
PID 4340 wrote to memory of 3584	4340	wmplayer.exe	unregmp2.exe
PID 3584 wrote to memory of 2300	3584	unregmp2.exe	unregmp2.exe
PID 3584 wrote to memory of 2300	3584	unregmp2.exe	unregmp2.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 3544 wrote to memory of 4500	3544	firefox.exe	firefox.exe
PID 4500 wrote to memory of 4864	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 4864	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe
PID 4500 wrote to memory of 2280	4500	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\fuck-you(and-a-little-dubstep)-By-Tuna.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\fuck-you(and-a-little-dubstep)-By-Tuna.mp3"
2⤵
PID:1480

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
2⤵
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.0.1471066313\1321300562" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1756 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f63156e-7649-4c8b-9873-e37ed020f1a9} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 1916 223e4b16858 gpu
3⤵
PID:4864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.1.1261928696\1866532915" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {675b8ed8-f188-4fc1-8428-ad559f7e6923} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 2316 223d6b72e58 socket
3⤵
PID:2280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.2.2137966816\830435753" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c007ec87-5e0b-496e-897c-932f0752cf4e} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 3156 223e3a92758 tab
3⤵
PID:948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.3.1402891063\1715381857" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 2960 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cf9b35f-5bdf-4c07-a04b-758bb2b11512} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 2452 223d6b71c58 tab
3⤵
PID:5004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.4.445400670\1307173436" -childID 3 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb9e9c13-ec63-4d09-8ec4-6b1fba1f2896} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 4048 223e8a98058 tab
3⤵
PID:5032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.5.461944653\1370917156" -childID 4 -isForBrowser -prefsHandle 5056 -prefMapHandle 5016 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69114210-1de6-460a-8d05-28341650a784} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 5012 223d6b61658 tab
3⤵
PID:216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.6.1847533484\1154768950" -childID 5 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58412726-083a-4c2d-a34b-ed7dbc7db0ea} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 5192 223e9f2c158 tab
3⤵
PID:3944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.7.1008411266\1689880498" -childID 6 -isForBrowser -prefsHandle 5400 -prefMapHandle 5460 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {360bd5e8-580d-4114-bd7f-2ea5d953e87b} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 5384 223e9fab758 tab
3⤵
PID:3740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.8.571795836\328201010" -childID 7 -isForBrowser -prefsHandle 5940 -prefMapHandle 5936 -prefsLen 27020 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d2c253c-6abd-44a1-bce7-b26be3801df9} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 5928 223e665cb58 tab
3⤵
PID:4564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.9.1997398095\653803442" -childID 8 -isForBrowser -prefsHandle 412 -prefMapHandle 6100 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e21895-f457-4d71-9c92-92c36d2e90fc} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 5988 223ec1ea758 tab
3⤵
PID:4644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4500.10.1333127116\1290381331" -parentBuildID 20221007134813 -prefsHandle 6272 -prefMapHandle 6368 -prefsLen 27331 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1078ed32-5db1-4b96-b008-c0d3a3fa6112} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" 6380 223ec1ece58 rdd
3⤵
PID:2056

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zflag --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7d8,0x7fc,0x6e8,0x714,0x6e0,0xb1b480,0xb1b490,0xb1b4a0
4⤵
- Executes dropped EXE
PID:3036

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:o2qH0sBvKEZWO0v9Zp-NNMEw-S5bYe0TNHRomUKm01TuCkaJpRzTkF9jAmGUpZGLLwe9cjNZy8CxQxDJ4H2fWhZj9gU7see8ALg6zeVoSFHQNN11x3amjr0g1TCwzaTp2GDBHdVtFvQiU5bemNumccxOkyrSk8Jlpmv3UOhC_rB6SKnHJlGxsEmRpHAQs_RnaDwTAXOH3BTLpndxTPz_U3xmx8qtIHpoBmxPETC_ERc+launchtime:1680315252820+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167663689912%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Deb372a8d-810d-496b-810e-5ac72d80d5d9%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167663689912+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:1816

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x720,0x724,0x728,0x68c,0x6f8,0x11ab480,0x11ab490,0x11ab4a0
2⤵
- Executes dropped EXE
PID:4992

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t o2qH0sBvKEZWO0v9Zp-NNMEw-S5bYe0TNHRomUKm01TuCkaJpRzTkF9jAmGUpZGLLwe9cjNZy8CxQxDJ4H2fWhZj9gU7see8ALg6zeVoSFHQNN11x3amjr0g1TCwzaTp2GDBHdVtFvQiU5bemNumccxOkyrSk8Jlpmv3UOhC_rB6SKnHJlGxsEmRpHAQs_RnaDwTAXOH3BTLpndxTPz_U3xmx8qtIHpoBmxPETC_ERc -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167663689912&placeId=4924922222&isPlayTogetherGame=false&joinAttemptId=eb372a8d-810d-496b-810e-5ac72d80d5d9&joinAttemptOrigin=PlayButton -b 167663689912 --launchtime=1680315252820 --rloc en_us --gloc en_us
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:4256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:9052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
2c3024c6aec09f36db69877db35f8e4b

SHA1
b582af99bd6ba14ae8fd28bc1cbbaec7b4df393d

SHA256
ee27f9cd887945d699f4a3f406e59c49076f38cef50976821d6439c0ab356a7e

SHA512
f2741ada8dea5939075baf3da61462ccd9430c005eb07f3354abd2f686ce83603f401655adb9e990d45808404c3b48d891f7d04e00766bf2904cd12a60a1e23a

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\AppSettings.xml

Filesize
149B

MD5
48f58abeaac832f838efd2beb25f4c90

SHA1
7878e28b62e5d9bc9042a3e44094e39668f03384

SHA256
893a58e7946728c9dd5caac10e5bdc306a465e406c1f979ded52a13dafebce2d

SHA512
c5e3025b63eead12a0f8192ea41afd1216dd87b14a07d22ebafc6d3d899a06e80da947b3fcd1b3f2cf53b89b3de9967f89c415394d66c277556373b620dc827e

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe

Filesize
58.0MB

MD5
cd199f81c3a2cbdbf8ede573d6c19013

SHA1
f0fb145f124ac1d299a34ca7efaf98eb946718e1

SHA256
87da9bc3377e4503712a5fa01f1b4560effd3908cf25257f9c639ea671b34a78

SHA512
f06dde6f9ea5bf11d876b117a33f46a8ae5a22ecdf8fc768af4d975b626661e89ca7a866585131b1c4289a2038e8bccd28dee13b570ab4c37e1eef7ee037b08d

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
9bf77ce85a5a981d86a0f7a4672ba22b

SHA1
62fb7e9f8b763de11a63a156c847e7df4dde7fad

SHA256
44ed3a7243fe9995a4439683d11971670eb00101c3832ad30db5242560b2b354

SHA512
2ead42546c80b3dbb87ac93f1324c85fc0bfed5a7c51a1217993c18d43886a9e7580a80ba9a2b6ec4c7eefd23d274fce561845ab508b427afc906ad594f58e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
21ed9ca0f4579a63723066fab3cdb1e9

SHA1
625f8780cba0177fa7d9b747df0bd45511ddc900

SHA256
818a6653f6011a83d251998208826644fe68d228a739c87ec14e470e10817889

SHA512
203e8fa995dfd86617536e1fc445fa1fdfbc0ec462d238cfbfe1d03c81b51c81297335c4c54503070c25897858fbedd659c348ab994f9195635ff75a0f3ecda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
0cc22a011ccaaebc8d6e46ebb016a84e

SHA1
0ef4e417095e7a31d5a6d24fd9b098886185f274

SHA256
308735064ff38c7fd32d09fa073f491b50d25b2dcf542a66d59b5adf5e64944d

SHA512
4f44bc1d97d34c12a603dfe12ec4317d6509e725a82ba9b94212687acd45e838d9d0c0b3b52ae23d927a173876eea6d84abe1c6df96b6ae96170488967933caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
d25c8d0b8ae6ad984a9cad67bce822de

SHA1
9ae96e4fa6df08c07c52c8a9255c15e10830348b

SHA256
428733e5c3949d0759ed1e0960d605daa8d40898164d380a3475ed9cee0913f7

SHA512
60b01de6896f6232669276175815e13eade5e2fd761ab25cdc5f43cd3e9d2ee157b66d35c172e927ccb274f8f76e00b4f971dc5db0fb049785d0d67c2242119a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
430B

MD5
c86b401ea2f1ba949f761592ba4613a9

SHA1
c4398e7a38c0b63ae3d45ea193d849ad9058b25b

SHA256
8a14f8f5f3cd8846d97210f671a98d84ce1206c1fad55504750c29badd11ce39

SHA512
b70e833514ebed818660888276107b53ce9d1980a6b6407d3586fa8bbfd18fa9a9b49755723526211897f3ff77037cac9be824a3874243e6459c5babb6ad3f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
58dd3f139124e3abdb1193e611eefd25

SHA1
7c03a79cf044b44c3b82274a8090b5967b754ccc

SHA256
08bba6e213566365e700a3dcfde83b252e0f6925fa24d359f0c402f6b7551565

SHA512
da88dbad4154fe99be56eb5d75efc2abfad17d8722aeb9cf2a28f4febc5016c840537b17da85238a9513369e103b865a6e654358216e1ed2b2fc22320858bbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\rbxcsettings.rbx

Filesize
176B

MD5
962dfbff733f64a454681f85402e5d5e

SHA1
fe6ce4cd7f798b6b55b04a6a7624d56eb67ec69e

SHA256
8b11d42752b869ba38bc2d1b8f9d77b938a619050377bf644f3575fd7410eeb9

SHA512
416d81e9ff95fbb2fc8a662af89291e17243681a37d7bff16621cb43193e485f8fdad51cd90261a198db06ed3bbd2389bec8597f3b78d0f6fd0ab15db452f6c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
dbfc662304aa4236ac6c685fdd3ee597

SHA1
bee96b9256c93a35398a8c6a341da9470c6101c2

SHA256
dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590

SHA512
6730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\zflag[1].json

Filesize
7KB

MD5
8410c7ee4ca1a560a7fe10d1897da791

SHA1
bec0f2259f74e6da19646aab8b10779a158354f3

SHA256
b0ad8274a116bd24b0d2d4462919a39c0a167ae82761d6aa9fc140db38c6e70a

SHA512
f7d47bc10cd22700d17049ddf1beeebbda55e9a7bd4d38cd1c26fb672b8d352a60830097c3dee131662d208a66c33f2c1f0fbc94c642ce9a9fe48e32f6b838c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\BatchIncrement[1].json

Filesize
163B

MD5
bedbf7d7d69748886e9b48f45c75fbbe

SHA1
aa0789d89bfbd44ca1bffe83851af95b6afb012c

SHA256
b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

SHA512
7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\PCClientBootstrapper[1].json

Filesize
2KB

MD5
b13dea5b9e2b4505bb9db753eb9fbf66

SHA1
3a2010795af14a15390482865f284d4bdcf5f861

SHA256
b786ef5ad5eeeb83d622b94a4112ed40816d0759a712c8b2e8f9930fea7faa8b

SHA512
65ff85bbb36d8a14983e19f510580aa19a773a7fdfa12384dd9968fa26da7f8f4152f534d55ec8d02b953f70d444507534aa64d042654a65094bbf0bc7a6eee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\zflag[2].json

Filesize
119B

MD5
8e7e1124df5cb13bde562332564be4a4

SHA1
37314dc17a1a5635581abbaedff6ab677469a334

SHA256
fca98f982f815aaa96f89bb30515e35e5dde746fcd175fe987d5d885d0a8b4b0

SHA512
2f16df7776ff2d8e3ec1288ecc9f333553e875c2040f83677a1ca0b6f0ad664b957a0a71001f11cd5721a13c1b0a38e1cce29239c772ced1b9ca689b474b1d8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp

Filesize
156KB

MD5
816c23a0036bb244a0aafd1a374fbce1

SHA1
d5b10d712fbeb0f6c0d5894837f4ada1ee5602a6

SHA256
caa3c3d2a2535b5ad98a862cde0f80f6843bcf658e9181d6cb27293fbe79e5e0

SHA512
930cc826816399cad4d9c38e3680ae71282d3caae03a8c5cb04ecb6372bbc6bea463d323e568692691cf6402442bfcbd8177edfb55a40ec1a3169b57e12c8a41

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\10139

Filesize
10KB

MD5
db12d1e4a355dba6b3d0398f26f23e1d

SHA1
1c83faa139545ccdc51eebb931ca979c0a279213

SHA256
59c6709919fb53aaa94d8a2213f24384f4680febaa46b196e94d1aa3e73b8f44

SHA512
e45294bedc3d12a0801759dd10f435c3ed4599824c50a3a9de4f056c39d7cb442e985813c9e0cdc817a646ab1ee991436553f9af854de82ec1a8d8b136f30219

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\10939

Filesize
10KB

MD5
a4771e74bf58c1fa1678cc02108c5214

SHA1
18d4ece72841d2a2330ca7265ad358ce52df0bf9

SHA256
f5597a87cb4f79900afcb03c4421895edf32debdd12e08d3007be12d1a0803e4

SHA512
ba3a8816402117bfde174e1e92a334e2d699c3075c95b8347c1489017583f5909150b74bbd96d99e687fb66689d6313d5ae958696c1b28c570882027c186beed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\13169

Filesize
10KB

MD5
3f9ce275e4304357ff396567bcd5a360

SHA1
d34d8920b099c9e9e36d52adc7865e457256c14c

SHA256
49905411adcb819de8d60ff7410284723b44c7111620e6ba8279ec281aba30c4

SHA512
f7d5d4cdfe84f3891a64e4aed02ac181ce949f7940cb3b966d147bb77af967c8c75023411158c340a4c4f1d7adfebb690f03ede123a92c5258b0974141c80caa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\15460

Filesize
11KB

MD5
5684a555a3ef68bb3f2b3a824f6f8246

SHA1
d2f795b983da6fd516f152317cd9a85021edf37d

SHA256
54c18fa5f7b2619cec9dd94189ed3c1054538fbbbe86ee928094e3fd8bdbe6b0

SHA512
76eb356c5b908b173a2f230bdbc7e5e0929458aad238ed1280df59868720e300a6c765f84dbbd7ff6200768e0cd6972bd594365974845a7ade3e3531df95aabf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\16547

Filesize
11KB

MD5
3f97b1f063efe98bf14dbf3e87f8e9a9

SHA1
a1dc781b2a79a46043929e5cd48021e8ad0e96f4

SHA256
0a6d920dfb6c0881c28a57c47b29e3a18a026ea3202f300d62b9527ccfc1959e

SHA512
360b2b00c7a53d41d972eb3dabd2f9174f81627094096c1d0ad0fee05dcbc83bba703812b4ac69f463457ed7672461e1dd72c5e714d558e78d0739758554e9d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\18470

Filesize
8KB

MD5
a46ad03faf2c095346635a988a08a9c3

SHA1
8c74656d06f885da243bd829b60b167d738dab8a

SHA256
2abca3d196e9835b7c4ccc759c3823f56987bea7187542fec90a4abd52ddd071

SHA512
6f86686eaa500e81532aaec2c6b78836b41136e909e47d7d620ae50b7aecede2b5bbf5410fc514deffb451583cd7afacfc1348a80a6e4e6e7a8c5e444eb59585

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\19263

Filesize
10KB

MD5
3fe987d75be7dd7bf54073d0d45b423a

SHA1
4c656f51a7cea0fa9edcc4770e1c9b0019f497f1

SHA256
fac679d77f6e27298a05784d0afb8d246d54e1a57791494fa13e410a40a2c2ef

SHA512
eb1faf2dac91e95a7016c2add8da220c5d8b40358ce7588e7947423a78567b03c38b69e6397c12b31aec7c52413951a77574675b01b40d6f304d2e4634a83d26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\19538

Filesize
10KB

MD5
f73e5c97a4dd72dd31181ce4a4f5db0d

SHA1
f28a59dd90a27dcb556a1810be29fb9d0970c0f4

SHA256
c783dae09c46c6f30048f85bca8209150adb7ff7f2ebde118a9856a386c6395c

SHA512
c1a451b474647f80ec4aa224a586f0fecbd92a9501bbb7dabb5943ab01bb4c4590091504d452f17589cad24d86212b1d384e77cf3dcd33f182fc3d3498d28a63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\20033

Filesize
10KB

MD5
3f19852974c97b127ac01c1b5661dde4

SHA1
b8872c90fec8133e164060182630b8083ebf01b9

SHA256
61082bd08260b3b80b14558deee9f01b5ecb547923fd4220af9125c066c3ae35

SHA512
807cc8c0df2a16756259afbf86524453bce50139fe6f44af9a14fba7439e01d72de1595c70932b5ca529a1b35c8d7468069fe72d488e5c1a6a9795267f8d32d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\20083

Filesize
26KB

MD5
3fc8f75d6876b19406455002fa037af3

SHA1
01d49a3ee9ca6fa8b70c07604b632fc32c9770d3

SHA256
d00d3056125abde4a2bfe54f3b459511b5f6541e4ab3dbf0ed9bbab6e1aefcd0

SHA512
2299719c7c59a1bdf4693c86556f4525e56d679585e37d0449ec4a0f3c1cd280b049fb554e01140a47a230174fc275df7bf094436de7d9fad75adf6cd7d64d8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\22049

Filesize
10KB

MD5
d152815690fc8b3a55ed686c879d5881

SHA1
f63c95aa274501f6db9481c7ff0836eb9e93ba07

SHA256
6874b87c68e6c24bbfdf93bc8fd45979f75950be3128a12c294efa29e6db1ac1

SHA512
7ab0c939078f598205663710e90782f78b67f47ec5a08a7ac8142300e3d5ef06a29ea9fd21591d891594317d207c3231c18e5e6ca445e718671b96eb52281271

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\24030

Filesize
75KB

MD5
dc68ff52be366a8ce04c27078d44dac5

SHA1
1ca0c85a73c07e0c0fa9f5a4d713ff4e681ffc5e

SHA256
ac5203892d40fe274801ca06cd542c83854a7b736aadcd6bbaa2c726d7a47ca6

SHA512
59575715b06bdbe7d0b34c7cf577ce1e0ff8275fc6bcb54bcb3212ef72998f93b5ebc7797b14694d0c1ae8b80884baead175659273b94f4c990f25d64923231f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\27587

Filesize
10KB

MD5
dfb20b4ef57dc2f366ec8fa823c600e6

SHA1
a0dc6d93356e6c9d7996727500f9dc3067de36e7

SHA256
479381cc3b9979710063b73c538e4bbd65399161014674d2a59dd84376cd9b8c

SHA512
bc7b0e557425a2098582fde99fb2e0e11be50f94c026b4eaaee4f8c8e10ad6d34143f472e23961b3a4381ae6c3bf39c3aeffd0c5d7b21b4d620ba76953a42e6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\29261

Filesize
14KB

MD5
c00fa36f7b0a1130563502c5b992a23d

SHA1
a0c815972369400f95469a58c00d116203db17ef

SHA256
e3f8b66f4f2f99ebdc955fb5c859e909a73938dded6f3594b89b07190e625899

SHA512
16846a4bdc115279cb22be221a1174f63db8166ce9bded6720701dc17381f4621042ea4ce23b824ad4d8cd03950c3385b450b8918d970761357ace67a904dbe5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\29710

Filesize
10KB

MD5
1cde272c8592f1c05ed4020f1bf851c3

SHA1
876d053456864cd238eb1738dac2713d80151364

SHA256
4ed49bdd8d60cdc418ac09da0f7d51e2888b919e8557a7b670855bbf40a84c2e

SHA512
a107078200a1478cb646c0baba0b41b3568535a758df892b89fc0297b95d9cdd0f926a3f7418ffca4c5fe4d3643b6e283518834d34ffb018d099f84bd1db249a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\29934

Filesize
10KB

MD5
3b9c92d3b887ba4f6b96c8f447c621d3

SHA1
e1b81cc9b18161672f47e7bd9f506cd06265067f

SHA256
0305163ba05824809924ca40afb02677090c3e49deda1510346f50a9ddb00a6f

SHA512
2511eff3b770d87297b41f2e3f762784aa2fc7845cb5977ae050b4317fb77e4f3186a39f772a7ba5c731a1ea9e0ed5cb76f4f26a604847ef8138457705b7d44d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\3390

Filesize
10KB

MD5
e5432c00d8edd190e662e6952b1e290c

SHA1
4b0b369906c080c2084c173689229fcb4594343f

SHA256
6d83342f2a20705e4b14abb9feaa04757699e65c19803c5fa5157cede7f5d0c2

SHA512
394e7a42fc90bfb8173eb222d24b2e4f1c4de45e77a4a488d51ccb5724633fc2298a019a829093e05ba52986f9b1638fcbadc604276bc1c308247a04c1a6b393

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\4695

Filesize
9KB

MD5
0aba042be8a183aafa69adfd9cbdb9bb

SHA1
b2fbca8c7493af2bca7b3d5f3e0f7ac7b7cf76a2

SHA256
08809760d4a9485d8e37c21e3940a1c663567f1730f8c9fb21eae072166ac039

SHA512
154bfc036670a07d96bdd95e32e6d5625e9d444d956053516f4b079fba927d625e21f03283cbc13136ade4a356e80a9dd0aad52c0a2e6a5fffa06b373dc8c423

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\7016

Filesize
10KB

MD5
37e2a67c513b31e6647a749e454b8ffa

SHA1
84574fd579cd5cc485e1d98a529777460dfe45c7

SHA256
4132d729f6a0e5dcaf43611de3365ea70158b23deb151627f84e2250c10c9ca5

SHA512
19778b0fa2e31277063745805d66d849c4b1cb3a4efd712972c333838b4ccacc2c08f5399b746841ccd1c14db61c8992c53f55b565e6d73a7e2139f86e6cc963

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\7035

Filesize
75KB

MD5
87acfe3fe86cdbe2207ab73cc5aedb61

SHA1
9e06e66647795bee927c79197c7fb4cdbea8c13b

SHA256
e4a76db8bc86aa449c1a4132f92d8a12cfc40d4c7c9143a6609ff1e6e906a1e3

SHA512
f92714855920cd1e43e5398518180c029f40de41094fd6cf383e67a75cd6c3b7791c54841147e12664f5b96ac5d2e02125c110643e1f2dcd5b6a02b5f2deaf87

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\9727

Filesize
14KB

MD5
e592fb2d34f7148862ba2d944f21032b

SHA1
828049386da9226594a95239da285fcdb9d49e07

SHA256
cee941f0d31c2ee88d52869056422a27aef11e4584a479dde169afc9fff1d266

SHA512
35b8f5c3cf4349c264d29ecc950b35231d6d64090c77a0b48495fd3b449fd6a08376afbfb1d49f58c2215782572b0e67dd82364b01bf066496ba75f31447e66c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\9887

Filesize
10KB

MD5
b21501c7bed6b63ad1ead0b088073819

SHA1
d957557161ed4675d41dd4fcf0cf1eb41abdb05b

SHA256
3199589b91c66bd240e16330b7d30ece69d010a238a176cb64e3efc0d036921a

SHA512
c4e017460a7a327da8fce78fd8e3072341dadd81470934cfc60369d3a3dd605d02f99b38f4ec16c1db571449ccc720811acdc5ff49f2df264494125589926d88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\9921

Filesize
11KB

MD5
b54fd01e708b82657cee5794bcf61495

SHA1
16901a298137a0a44637b9d1d6cb76dabb04fda0

SHA256
de6888e66179056c354bb5249a818918d6b8af1a490c7d0afeb4c8fe2c8bd165

SHA512
e2a57d574611153c6273288bbaa5252e0be403c74568238ab5ce86189b4f147137751d6971a5fb8a6f15407a0ae36fcbae399360eabd9a1bb1eced7a10a72665

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\34E9ADDF242E0D127631B69627717274F6E09DC8

Filesize
105KB

MD5
88d6c0a9833cd52717a411d550a38b80

SHA1
705a9061712328d60a265a512ea52bc5e0e626df

SHA256
529b2e7630712f3c0b66263804663115eb8e2619600f8c1209e428cd60969a42

SHA512
31aa217b0a01ead372bfd4abe91d1ec604adb9d2119544fe4b65bed9762d45d57bec627c40b56a6f362c51f7029db8d7517ea503da401f6c59bcf53054f6d419

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\4EED77ABF2B13446DC47048EDC01C87DFC8AFFC2

Filesize
30KB

MD5
7166e1a6dc03f667236df5358b7e422e

SHA1
15c84354c04bcc11aca7e4b291dbfd9ef1b6a909

SHA256
3a9edd73a608229f3ee3b039b87e9bc31896a2a5ba1c0cf84f9524d4b6adca22

SHA512
8279a000da516460c6a76e511437b2ade7355d8ca6a31d3ed830537ce184d16b34b37d9130e83354e7e70323f7fec4635161d0b753afec7fe0858e5174d238ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\440d1074f7fd8b765ce3298d9eb12e6b

Filesize
91B

MD5
812a0a64bf26c2f960cc1f1b7082d811

SHA1
56d21caea73c13d03591176e812e771a9b2c4d8c

SHA256
7e33f7d27175209fde404adfcc332f94fe9bab57c2280555a67d0670087b0596

SHA512
d35ae2ef95478441701c7310e0f4d3f28f649af482d35ee005c71e4eb2fa77b65496581aca522d72c7f24d9c5936f9a370efd63119954eb2fa07e236f3732942

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\6308009873b6e28576872a25a9dcd1a8

Filesize
30KB

MD5
ad95d3440d347d35380e5ab49277d884

SHA1
6da3eeb0de64d1887ae1927fe1845a91152c506e

SHA256
6169a9a495471d9b4c8b7dfb3dbeb9aa57778df205c8332fe941fd9c0fd7cf3b

SHA512
7f51bf8f73d722564ac28e0931b38bddad4c3a063c69f69fe9ea406a3e9f39806658a6816872dfc374ce1184489a37343f8e041cb081b7e812d340e120d206ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\95825116ced0527a94000b521e235f59

Filesize
91B

MD5
024b275b96a4c7d96529a13422dfcb31

SHA1
c4c7216849e61b627ea4c8dae99d005e63034115

SHA256
79dc8ac12e2211392c3b836c4f5533d1d4e6d9610b5ef2f72a65290ac67fb2c7

SHA512
2f6edb7d1ce098b8afe55b3724ce8682aa0106b91d54ff36632f17ed7f646eef1d7c3def45981fd24c854dd3fede589753f7ed7290a417ad2cda83148c178831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX01F1A70AAD7E40D7BF0DC101BCE4879D

Filesize
91B

MD5
934a11b8eaef18e6790e660f167b251b

SHA1
1195e4573af3ac1c966de8210b162d76f57df7e4

SHA256
8a8ffcca05368fdf6f8941aa5ebf50c565c4946e660dac731827703d5d36665a

SHA512
7b9ec190b7cbdaa40921a775beb6cc245f9e92b12785d0c1a9fc6285a996a809a2c80546a099fbdf5e2628404e4cedc2ab652f3e02c27012fd2fb3ea6d1ddaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX4F755F42EE6A438E846157DB8E2E8FAE

Filesize
91B

MD5
b04c0dc18c7d55cd67b193981117e8e5

SHA1
de1b8da5292626c82c5369243ab17e1fe87819e8

SHA256
0e9e0d48cb004bf17d389dc2d43451e7c45546210703bf2c36048568477f538a

SHA512
e6a2aea601a6cc021d9537fd56eaf034dbc5932f9dfeca57fa69921733af8d1c22fa4997a596f2895ca60a9a064ace6a135a8c5893381595521da9cdcfcfbef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBXD633E592377E4A82B86BC452CEC84E22

Filesize
91B

MD5
9de52d85b06da1acd48afa0d6d1d19aa

SHA1
6683b9c8eabeb1f315873fa6bcdfaaafa9353ad6

SHA256
8b231ef4bd7d12979f583d8c1b89c66ae7e379d6557a1bb6bfeffcafc15f1a2b

SHA512
f3c1210177102ad92dc8661720f12f4c6aed3a86991b59c823471464feb2eed41cc1512acc864cdace009852380701c20a694fdc0311d5a023c2b9298979c8fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b51141a3d127e135436238dc1f015b74

Filesize
12KB

MD5
b5efd3fc152ff5eb5434f68b5c9c407d

SHA1
c834960c0b205844f49b41f49cdfc35e0327b8f6

SHA256
a9dda51463d11431d97672caba031da86f3aa3dab29422d3aeea382ca3a5b3c5

SHA512
977a0f5733a3805d1464b956c01cc7e80e35026584afe84880a76d57d793771c90c006acaca67fec57baa2c3e17b85a77a6deee528df3f40141c613fc35809e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b7bc72169a3d8aa122674a65addfed71

Filesize
6KB

MD5
5929f65b55645aa9683064aeddc00170

SHA1
c142b250e33cf38361ee53e136dcde515ac9263a

SHA256
5e2a6c6d0642d8d7db9c3ffbd383f20f0cb0f4dd4774b7cf28e95dec327e2d1c

SHA512
d9d39209cc838c86a2c2e50b62aba635d199b8ec0975714afe0e1eaf97d7d42d7fde2c163c9dba64073fd4f5ad1f6f162537e29cf8004de9901ac177afa80642

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\def5959416f105e27ed4ca23a227f26a

Filesize
8KB

MD5
0266011180ff81ca36a43fb7589619a0

SHA1
0fdfbcbb86132a83fecdde3cdb53fc00cfcb756c

SHA256
5b4f09856c1bcb630770686ee26ef3303cd1d72a085ca59318d3122e6c2037f7

SHA512
5c40230416039b774780639c7f29a275c444b9ea5b81ceaecdfb5a22ace323ddc03895396c3862c0e682961dd73e28a99d302c540437dd41d606d38d609d23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e543c0a551366e41ad32042cf326a8f3

Filesize
53KB

MD5
0db4791482d2a60b0b78363c28a1f028

SHA1
83e174f9aabcd84d44eb293a30379bcf9978c7a6

SHA256
d9660618e7bb13d46dc8ab39490f5849590877e7ca01edcf371e58908ce3ff37

SHA512
0461e17f09972981c554111428bc0b664b91c67856b31cd1c0c2b7acba39fa519688efe5e599745edb04eaa4671ddc4801de3c541522ff6ceb6f781dc9e13a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

Filesize
40B

MD5
0ca31608456198a7793ecaf190b56d51

SHA1
e8a67477e7bfaa7c3b8c99dbe4fc02ff0b0e96f2

SHA256
2ecf49889d579fc69ec93deff3b3c634bc29ee623bebcc1e86a519d8589dd886

SHA512
a86e88e67aa6a6cb71dde09d80d14a77f0150a2ad7bb88af25f2266238291885c0dd5103246c76354e01f9acfb58785e4c6206a0f00d8fa53c89ebc204c8b82e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
2aad8641ef9ccab7953a985db29859df

SHA1
6f8f05d5e22a0efc3b32d91e064e60c83363216c

SHA256
063794b24a5eac609c2fa994404b7262e904993633ccf8cf12b8b746a877eade

SHA512
c44980783f5ece04aab0b1ffc90002c8ec5ed189bbc620a8805eae309c85dadbc37ce6fc8e480bf3e6e19fbbcd815e4641d03343c3026d891ddb4a90a15d1587

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
14KB

MD5
32f933994be17620fef0fba4ae8c7b4f

SHA1
e573de2c6ed2cc28b6b17ccf9c640dfc639c4bfc

SHA256
8a9ec0f965ab70e641faa0bb4578c9e37992a0baaf1779bc8097c664fc195c25

SHA512
352519fe7fa3b9262c7e655a1ee75bb50ffbf0410734879b6c53eb71d8242edc2df7e62a534601b37e9f7b7102d4e10ae0b7f5f2a4bfd6375194c09b01fba5d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
63b1bb87284efe954e1c3ae390e7ee44

SHA1
75b297779e1e2a8009276dd8df4507eb57e4e179

SHA256
b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a

SHA512
f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
b1c8aa9861b461806c9e738511edd6ae

SHA1
fe13c1bbc7e323845cbe6a1bb89259cbd05595f8

SHA256
7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70

SHA512
841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
10KB

MD5
777197e8d919052bac9387f08dd02a26

SHA1
0d97f6e73a1bc34c02a07306e8dda3cd594f6ef3

SHA256
de534bcd5be0c888e14172d73d14ee1c8acde3d18f6b8015b6217200cb1f503a

SHA512
f5daa7fc41e907c80774bdaf03a30938dd90fc233926407632c535de33d7b34fba343fd537cb4f68dea3b8bd8cb2ff5233dee2b99bf112df86ba1f3151e6daad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
10KB

MD5
6bd5bff8469e61e345e83d2d730eb2e9

SHA1
15a4a08edd2be5922957170cfb2406c86e94c149

SHA256
1dd9aa1e94b51749abefcc6a9dc9a9e61c6d46a6ea1ae4dd782304a760ce4ec7

SHA512
7184df0a0f55ce97ee3d5fd98d61a4090d217ce47ca90103f75cf954eef17d3036630c305c227898def80bbb751b5c6e8d0aa5e892c078caba18ce11dd44f000

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
34b72799900b7e47c3c97454d53a305d

SHA1
642c038f9b415e78940083990f5cb0d25a5cb835

SHA256
ddbb7d727002551aa4aad282671599698714d13fb44f0e3beaa3df69e9082871

SHA512
374c11e817325ce258f62023a780e1fc9aa067ad78fcde83d73fa5eccdb8601652facd8bf1745645b6b8a5a935d3d05257eb6a9dfe9444fc955a827f9cf2e59e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
651b6e1142d8da935cb646a3e8882ac7

SHA1
678fa336ed2ff9797376e5902bf4cf25cd023bb2

SHA256
e31dc2f5d8920373c53ecb259bcf26f5fa1e3fbea19d339c93d949b1e17a8056

SHA512
e3e1c8b957b8520c221336310c11b231221eb3487a9f54c626daa76039bc2f77f976e6388a598e12a8c6a21889a8c85372afecfecd966956f8e1ee6aaa0d63cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
142e17a86eb8a1fd1953da4d2d4ff649

SHA1
589575aa600850f51873775af6f3dfc720ffa40b

SHA256
3eb3ea989c01122f331d3c8b1db61087488d1080f6c134f810fd64c092e76864

SHA512
52b86a88a80146117ccb54bdbfd71b4b262a8a5fcddc571a74704b8d997ab9261539a73eb50bfb6b97e87e503e7f5537dff7d9cdb573b1112807274c26375c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
7fda13438963287a3e7302c3c84a9bce

SHA1
f5ceabd3941d3c6a06f21d78fb35aea185c589bc

SHA256
01b5111634b28cce90ee9a8c6517b48ae7b6c893a5d1420a698632f0b88e2467

SHA512
ff8f4c03b11c0fb43eb4a46cdb04a93b1745cdc97d4218a3e85d8d532cc361b659848bfdb7e4620320b31f3257311c5f19e5ecf00d2f0efb5704513bb2c7d35d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
e634ac441c2273c642969f867aef6afe

SHA1
778204b8eebbc39764ccb18a7edd7e966fda86b2

SHA256
3c10773f8136c2b075ae137573d4f5355b5518ab317b1db6680f690de0aab5be

SHA512
95252fe76138167e2ef7f09b1d6f4d901258d5417f3e59f4874384dfa09286a238d10162b111aa87803d8dec29e70f189ec20f64c8e1a0d7927a131216f6264f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
10KB

MD5
8f6873625b313da729800caa3f649fef

SHA1
f8b21da692a7a3c7045021c925cfaa86dc47b83f

SHA256
683f6d8d7351a1151d06ed91448a25f7d8e21d5cd88364d0fd3ad672fe23885d

SHA512
c03528bc3c40159e5839f562235ba05b4e5d23c5a9382626eabf5d889f21504b706d78c5339f61f0fcc08853692ea7e45284026da368cc12da1961caf3dbcb68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
13f655f4aa58ef709bb8fb5d40f9742f

SHA1
ad0231a5c22cd69bd0060c2221dfaabf247b36fe

SHA256
7236565e6ce4453dcd521034b90ad58472cc34220fbe48c96c508313d1bba045

SHA512
c24e9678f5b140d9c5643787e3e914334a7fc74ab9c7d2c41bddc5fb34024f672ecd623acdd8bb80331eedcec3956673cf961735c57a97ab640c7bc3cf4257f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js

Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
845B

MD5
e6e959dda3fac66eaa5d2038497acead

SHA1
149b5f840bd1834c5f5d71765d0c9498b70dfa2b

SHA256
7f6f48fc86f6e5720f3ce1f479e3db3755c382f1b4b87b98ad46b45761fe6e45

SHA512
416a879df658104e8da3b1abce4955338a3011fac694b4818c30a2efd17337544e612e527727ee44dfee0d74d08c9c0f0164a5d23e71a4046f48f640c6853f56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
905B

MD5
6a35130076f3f11bb38094a2cab5a50f

SHA1
3881395829d623cf4f1c86d962606dd69f0210ac

SHA256
5060fe80159a9163f75d6f6c53d984fd343ea0218a11bbb1c21ff17794901581

SHA512
dfb883f3f2a750a02fc3d845e3d70144ca054863280de1ad78483a412fff08eaa1a60217fe682e99bdeeddbfdbea2f539f610e2d1273e0e7ff1407bbcfd25b67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
9f830ddbe8323a8eae8200b2e3d4dfc2

SHA1
d6f557eb2cc77316822b0087339b6d12e8a74763

SHA256
c4ba68bf97d4021b28bf79897184982f85a5e4e544900411ce1750e2fcaefd3f

SHA512
06c2d9c422805240cb590e3494a0f56b2f24cb5d100b76f728f14bfc4ac9c8c7ea1b611acf4af5dd21c3facd107648f98fe5ce2ce8fe4b69db0a7e4a51990111

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
c982f1c957e8152904a6ee19ff4ae2d2

SHA1
660ab8c76b008880ad7c1ea0b28a4ad1b82c4630

SHA256
8d4868e74ccc8ea9546c1f7e81daa1b26ae9b3073822e351c0d65dd84a53d470

SHA512
d6cf6932961f169aebaa8cf92945731b388ccce42648ff5b9b8c813450103a5ae5ec51fea6514efd4130f4217c0ccd298141a369ce90e13cd0385fced5c505fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
3d078de0cd71926fd8ee20a1c735dfcc

SHA1
d604be9e551aac7f600ace841673a064d143019b

SHA256
deff3ac0493d6986e0acff4e5e56135146b952289da6adc77a406528390ff822

SHA512
2fb78ded4e6de9b5334a3a5a614abc801d9d7834f7592b07d6abec7ca9aecd588b3a397f6c7421ae15658c1ddd714191166a0b65aec1e593a515f7f0673e1b63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.5MB

MD5
22b80264adad0470d691cf2dd0f81a97

SHA1
12f1c388e5badccaf47008b81217e1e471c751df

SHA256
5942195f74e9aef72f78adbadd237365a214a00a2068cfde4be659dcff345521

SHA512
17ebd3b15bfcdf61da5cd1e51ba8ff1cabdc1c7c075957380355fdb6037eb1aa7425176331750fed5a7fe8d8cd3e5b05d347742b3d1f9f37397e431409abd109

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.UejTSAQH.exe.part

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/184-4592-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

Filesize
4KB

Download
memory/184-4597-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/184-4593-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/184-4594-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/184-4596-0x0000000006010000-0x0000000006011000-memory.dmp

Filesize
4KB

Download
memory/184-4620-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/184-4598-0x00000000001C0000-0x00000000058EA000-memory.dmp

Filesize
87.2MB

Download
memory/184-4595-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Filesize
4KB

Download
memory/3360-8924-0x000001C63A820000-0x000001C63AF49000-memory.dmp

Filesize
7.2MB

Download
memory/3360-8826-0x000001C63A820000-0x000001C63AF49000-memory.dmp

Filesize
7.2MB

Download

pid	process
312	RobloxPlayerLauncher.exe
3036	RobloxPlayerLauncher.exe
1816	RobloxPlayerLauncher.exe
4992	RobloxPlayerLauncher.exe
184	RobloxPlayerBeta.exe