Overview

overview

7

Static

static

1

RobloxPlay...er.exe

windows7-x64

7

RobloxPlay...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 18:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerLauncher.exe
  • Size 4.7MB
  • Sample240224-xcfamsca31
  • SHA256 ed8ba6067230192e4f3a2a988adb331d4294951aa54e310fb92386b4cba6b506
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 18 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks whether UAC is enabled
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=501fb42525634f66854f868cf845d92677f9848b --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7b0,0x6b4,0x6b8,0x7fc,0x7c0,0xd5e0f0,0xd5e100,0xd5e110
      2⤵
        PID:4436
      • C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe"
        2⤵
        • Checks whether UAC is enabled
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c8,0x5cc,0x5d0,0x5a0,0x59c,0x16086c0,0x16086d0,0x16086e0
          3⤵
          • Executes dropped EXE
          PID:3876
        • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            4⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2296
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2748
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4952
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3764
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:4532
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3808
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjA2NTgxNTQtMjg2My00MTBELTkwQUUtOThFM0Q0QjBERjBGfSIgdXNlcmlkPSJ7M0U0QTAwNjctQTU0MS00MDA5LUFFMTktNjc2NkZFRjlBNTU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4OTUyQ0FGMy00QTc4LTRGRUMtOURDRi1EMzIwMDAyQTNCRjN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODMuMjkiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Nzg5Njg1NDE1IiBpbnN0YWxsX3RpbWVfbXM9IjUzMSIvPjwvYXBwPjwvcmVxdWVzdD4
              5⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3660
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{60658154-2863-410D-90AE-98E3D4B0DF0F}" /silent
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3576
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjA2NTgxNTQtMjg2My00MTBELTkwQUUtOThFM0Q0QjBERjBGfSIgdXNlcmlkPSJ7M0U0QTAwNjctQTU0MS00MDA5LUFFMTktNjc2NkZFRjlBNTU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QUM1OTc5Qi0xNjMzLTRCMkItQTNERi1FODA2MDAzOUQzQjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Nzk0MjE1NjAyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1524
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\MicrosoftEdge_X64_122.0.2365.52.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\MicrosoftEdge_X64_122.0.2365.52.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\EDGEMITMP_EEF36.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\EDGEMITMP_EEF36.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\MicrosoftEdge_X64_122.0.2365.52.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\EDGEMITMP_EEF36.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\EDGEMITMP_EEF36.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0E5B4154-3E5B-4683-9EB7-9D507B642C14}\EDGEMITMP_EEF36.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff71fde99a8,0x7ff71fde99b4,0x7ff71fde99c0
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            PID:3804
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjA2NTgxNTQtMjg2My00MTBELTkwQUUtOThFM0Q0QjBERjBGfSIgdXNlcmlkPSJ7M0U0QTAwNjctQTU0MS00MDA5LUFFMTktNjc2NkZFRjlBNTU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBQUQxRkZGOC00QTE1LTQ3QjUtODA5Ny00NjJEOTRDRURGRjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMi4wLjIzNjUuNTIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4MDYxODYzMzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODA2MzA1NDE2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA4NzM2NTQ4NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjQzNzU3OGEtMjZhNi00ZWRmLWE4MWUtYjMyMzZjMmYwMGQyP1AxPTE3MDk0MDQ5OTQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TWVRRW55NzNGeSUyYkU5cyUyYjBCZWlyZTFESTNrNWdrNlQ1WUppUkhYWHdiUnljUjkwNU9uQlhHa3BCenVxOWI5UzlYNnBSbCUyYjk2blg2M3RzZ2dOSVByRGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzE0Nzc1NjAiIHRvdGFsPSIxNzE0Nzc1NjAiIGRvd25sb2FkX3RpbWVfbXM9IjIxNzY0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA4NzQ3NTc0OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMDE1OTU3NjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NzM2MzU1MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2OTYiIGRvd25sb2FkX3RpbWVfbXM9IjI4MTA2IiBkb3dubG9hZGVkPSIxNzE0Nzc1NjAiIHRvdGFsPSIxNzE0Nzc1NjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ3MjAxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5344
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1768
    • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe" --app
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:5616
    • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe" --app
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:6044

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\setup.exe
          • Size 6.8MB
          • SHA256 a3f61bf9ad99f6ed55906ed9ef95aa1b7817d5e9a9e7cfb40c7750787240a73b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdge_X64_122.0.2365.52.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\MicrosoftEdge_X64_122.0.2365.52.exe
          • Size 82.4MB
          • SHA256 d10fcd6dbdd6c767aa81e02128999c7f5a7cc11483f0f1b01470016da108edb1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 179KB
          • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeUpdate.exe
          • Size 201KB
          • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 212KB
          • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 257KB
          • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdate.dll
          • Size 2.0MB
          • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_af.dll
          • Size 28KB
          • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_as.dll
          • Size 28KB
          • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_bs.dll
          • Size 28KB
          • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 29KB
          • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_da.dll
          • Size 28KB
          • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_de.dll
          • Size 30KB
          • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_el.dll
          • Size 30KB
          • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_es.dll
          • Size 28KB
          • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_eu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU9B07.tmp\msedgeupdateres_eu.dll
          • Size 28KB
          • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxStudioLauncherBeta.exe
          • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
          • Size 3.0MB
          • SHA256 a7cb7466699716c8a29ecbd9bc645c92444dee89c7a68748b64f48183930cb7e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerInstaller.exe
          • Path C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerInstaller.exe
          • Size 4.6MB
          • SHA256 bb4fa744d72612edd395213bba74efe233464cc8707ec55aa85052b6211757b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeWebview2Setup.exe
          • Path C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          • Size 1.5MB
          • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Program Files\MsEdgeCrashpad\settings.dat
          • Size 280B
          • SHA256 4a1d19116a58161f0a808aceba13e3c6c12a23ccff5a4cbb4c50edde61d17426
          • MD5 SHA1 SHA512
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 100KB
          • SHA256 c4cb7540179e3e47776ca603b388e1fe200b223d72a2300935dd41479359f7d2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Size 2KB
          • SHA256 195dc5abaff1a15478c17d9c38aa2a7bcaf7f86af3309e12e92d02e8bb2d138a
          • MD5 SHA1 SHA512
          Submit Download

          72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
          • Size 472B
          • SHA256 7faf042f1546d1c489c6a72f5a63f638735ec44c2e28ab5d109d1aae265e6ec8
          • MD5 SHA1 SHA512
          Submit Download

          75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Size 1KB
          • SHA256 c53f716c852901bf6e112465b4f40bbef9e6c26de48dc2b8d2eebce955ed0e51
          • MD5 SHA1 SHA512
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Size 1KB
          • SHA256 8fa7d1a5d4706b3ac7fc8155a5cc2c92213e5d824416bd3f0e7c1851fded4e13
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 471B
          • SHA256 ee52d7f679c03b6e7a94abdab70ffcbba90d28bdaeba59fd8aa59e3a2c4e9465
          • MD5 SHA1 SHA512
          Submit Download

          B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Size 2KB
          • SHA256 8c8cd1831fed75171a62a774bdef0a77930342c7b0121402ed9a002a67307116
          • MD5 SHA1 SHA512
          Submit Download

          BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Size 1KB
          • SHA256 19525c60521905ca2765a7c58a64a3acf3e66882dd62cf4c278348f4b6a49b61
          • MD5 SHA1 SHA512
          Submit Download

          07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Size 488B
          • SHA256 5eb1ab4ccb20c76c1f752a1790f351950dfef3b6301e73a0781dc5d579ea7129
          • MD5 SHA1 SHA512
          Submit Download

          72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
          • Size 492B
          • SHA256 60f32b95dfa2bc030081d72fdeba45c6b2564c7d56d8b8030831adb6a1b0aaa8
          • MD5 SHA1 SHA512
          Submit Download

          75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Size 434B
          • SHA256 011830414b5e10105d2c086694ef9ece8124969a1de8d45b8c82dcb9b408b809
          • MD5 SHA1 SHA512
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Size 482B
          • SHA256 44d2fb0d4dbe3d3519e2a66fe75f30398c6bb369634683260a9135276b87bcdf
          • MD5 SHA1 SHA512
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Size 482B
          • SHA256 1a236f241ef070fba04e56ad545625ebce79d52ea34c777cc5513d4bd58a358f
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 400B
          • SHA256 0eeac82a2037c3b655c201f049b9c7b6651a415bd5b3ce2728bd2f4e99b7e607
          • MD5 SHA1 SHA512
          Submit Download

          B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Size 458B
          • SHA256 ba511877c9b76ec60f49a1c487cf1453bd5ad92fc0c02fe48e2c54d7a97ce4fa
          • MD5 SHA1 SHA512
          Submit Download

          BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Size 432B
          • SHA256 d16975aad4fb4185b1fdd9c1ccf4b48a72ecd3ed9bcd4ff81b9d1f6d4469891d
          • MD5 SHA1 SHA512
          Submit Download

          PCClientBootstrapper[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2FZEPF9T\PCClientBootstrapper[1].json
          • Size 5KB
          • SHA256 e9641eefdefbf9d549b0f74ad9a711d92fddf66c1bb099b68a98500267de7687
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          version-70a2467227df4077-rbxInstallerPkgManifest[1].txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2FZEPF9T\version-70a2467227df4077-rbxInstallerPkgManifest[1].txt
          • Size 83B
          • SHA256 43ea54ae7dd93e1c7c506b8a8cf28745364b482c1f8e31357a05debccc593766
          • MD5 SHA1 SHA512
          Submit Download

          RobloxPlayerLauncher[1].exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FW5012D\RobloxPlayerLauncher[1].exe
          • Size 5.0MB
          • SHA256 2a5b535ccd9620aff782560722a034f5a2556a11df84e9bfe62c0b84fc86228d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          version-70a2467227df4077-rbxPkgManifest[1].txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FW5012D\version-70a2467227df4077-rbxPkgManifest[1].txt
          • Size 1KB
          • SHA256 184f6d4cf6105a41c4b651c2f72d7134fe01c0e5824b489b869041f96325fabf
          • MD5 SHA1 SHA512
          Submit Download

          BatchIncrement[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HPXI3SB5\BatchIncrement[1].json
          • Size 163B
          • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
          • MD5 SHA1 SHA512
          Submit Download

          version-70a2467227df4077-rbxBootstrapperPkgManifest[1].txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HPXI3SB5\version-70a2467227df4077-rbxBootstrapperPkgManifest[1].txt
          • Size 82B
          • SHA256 a700240448fb42106dc569cc786c0f4d8a83e2a4e8999802a4c32e5737c9f4c9
          • MD5 SHA1 SHA512
          Submit Download

          WindowsPlayer[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTB8EEY3\WindowsPlayer[1].json
          • Size 119B
          • SHA256 39b4d267880abe6cbbc9db4e89152a3faec2e1f0ea9f4ee208382326f5d1bdf2
          • MD5 SHA1 SHA512
          Submit Download

          RobloxPlayerLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe
          • Size 2.9MB
          • SHA256 fac04c5b07000bcbea69a377eb8f0746ccf4842f8f8133c8cd2abbbe24be44b1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe
          • Size 2.9MB
          • SHA256 25acdecbf6523e7657680d35bf0cff4bdf543c18ad87abf2c0c2d357d0b8b47a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RBX-B67B6632\RobloxPlayerLauncher.exe
          • Size 2.6MB
          • SHA256 fec6ae44bf1aa9cdca7f8426e3cbdf9117c4a9390b535835be9660ca990b99fb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
          • Size 40B
          • SHA256 8283eaa200246ee359f4a10241f8fa12f4e9c0222b40d4168b6fe0ebfe92a8b0
          • MD5 SHA1 SHA512
          Submit Download

          memory/1768-435-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-434-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-433-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-445-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-444-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-443-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-442-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-441-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-440-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/1768-439-0x000002F187020000-0x000002F187021000-memory.dmp
          Download

          memory/5616-503-0x00007FFA76A80000-0x00007FFA76A90000-memory.dmp
          Download

          memory/5616-508-0x00007FFA76BF0000-0x00007FFA76C20000-memory.dmp
          Download

          memory/5616-480-0x00007FFA78F90000-0x00007FFA78FA0000-memory.dmp
          Download

          memory/5616-483-0x00007FFA790A0000-0x00007FFA790B0000-memory.dmp
          Download

          memory/5616-482-0x00007FFA790A0000-0x00007FFA790B0000-memory.dmp
          Download

          memory/5616-485-0x00007FFA790F0000-0x00007FFA79120000-memory.dmp
          Download

          memory/5616-484-0x00007FFA790F0000-0x00007FFA79120000-memory.dmp
          Download

          memory/5616-486-0x00007FFA790F0000-0x00007FFA79120000-memory.dmp
          Download

          memory/5616-487-0x00007FFA790F0000-0x00007FFA79120000-memory.dmp
          Download

          memory/5616-488-0x00007FFA790F0000-0x00007FFA79120000-memory.dmp
          Download

          memory/5616-489-0x00007FFA79180000-0x00007FFA79185000-memory.dmp
          Download

          memory/5616-490-0x00007FFA77B50000-0x00007FFA77B60000-memory.dmp
          Download

          memory/5616-491-0x00007FFA77B50000-0x00007FFA77B60000-memory.dmp
          Download

          memory/5616-492-0x00007FFA77BE0000-0x00007FFA77BF0000-memory.dmp
          Download

          memory/5616-493-0x00007FFA77BE0000-0x00007FFA77BF0000-memory.dmp
          Download

          memory/5616-494-0x00007FFA77C00000-0x00007FFA77C10000-memory.dmp
          Download

          memory/5616-495-0x00007FFA77C00000-0x00007FFA77C10000-memory.dmp
          Download

          memory/5616-496-0x00007FFA77C00000-0x00007FFA77C10000-memory.dmp
          Download

          memory/5616-497-0x00007FFA77C00000-0x00007FFA77C10000-memory.dmp
          Download

          memory/5616-498-0x00007FFA77C00000-0x00007FFA77C10000-memory.dmp
          Download

          memory/5616-499-0x00007FFA76970000-0x00007FFA76980000-memory.dmp
          Download

          memory/5616-500-0x00007FFA76970000-0x00007FFA76980000-memory.dmp
          Download

          memory/5616-502-0x00007FFA78F80000-0x00007FFA78F81000-memory.dmp
          Download

          memory/5616-479-0x000002AE872D0000-0x000002AE872D1000-memory.dmp
          Download

          memory/5616-501-0x00007FFA76A80000-0x00007FFA76A90000-memory.dmp
          Download

          memory/5616-505-0x00007FFA76BF0000-0x00007FFA76C20000-memory.dmp
          Download

          memory/5616-504-0x00007FFA76BF0000-0x00007FFA76C20000-memory.dmp
          Download

          memory/5616-506-0x00007FFA76BF0000-0x00007FFA76C20000-memory.dmp
          Download

          memory/5616-507-0x00007FFA76BF0000-0x00007FFA76C20000-memory.dmp
          Download

          memory/5616-481-0x00007FFA78F90000-0x00007FFA78FA0000-memory.dmp
          Download

          memory/5616-509-0x00007FFA78C80000-0x00007FFA78C90000-memory.dmp
          Download

          memory/5616-510-0x00007FFA78C80000-0x00007FFA78C90000-memory.dmp
          Download

          memory/5616-511-0x00007FFA78D30000-0x00007FFA78D3E000-memory.dmp
          Download

          memory/5616-512-0x00007FFA78D30000-0x00007FFA78D3E000-memory.dmp
          Download

          memory/5616-513-0x00007FFA78D30000-0x00007FFA78D3E000-memory.dmp
          Download

          memory/5616-515-0x00007FFA78D30000-0x00007FFA78D3E000-memory.dmp
          Download

          memory/5616-516-0x00007FFA78B30000-0x00007FFA78B40000-memory.dmp
          Download

          memory/5616-517-0x00007FFA78B30000-0x00007FFA78B40000-memory.dmp
          Download

          memory/5616-514-0x00007FFA78D30000-0x00007FFA78D3E000-memory.dmp
          Download

          memory/5616-519-0x00007FFA78B50000-0x00007FFA78B5B000-memory.dmp
          Download

          memory/5616-518-0x00007FFA78B50000-0x00007FFA78B5B000-memory.dmp
          Download

          memory/5616-520-0x00007FFA78B50000-0x00007FFA78B5B000-memory.dmp
          Download

          memory/5616-521-0x00007FFA78B50000-0x00007FFA78B5B000-memory.dmp
          Download

          memory/5616-522-0x00007FFA78B50000-0x00007FFA78B5B000-memory.dmp
          Download

          memory/5616-524-0x00007FFA76E50000-0x00007FFA76E60000-memory.dmp
          Download

          memory/5616-525-0x00007FFA76F50000-0x00007FFA76F60000-memory.dmp
          Download

          memory/5616-526-0x00007FFA76F50000-0x00007FFA76F60000-memory.dmp
          Download

          memory/5616-523-0x00007FFA76E50000-0x00007FFA76E60000-memory.dmp
          Download

          memory/5616-527-0x00007FFA76F80000-0x00007FFA76FA6000-memory.dmp
          Download

          memory/5616-528-0x00007FFA76F80000-0x00007FFA76FA6000-memory.dmp
          Download

          memory/5616-529-0x00007FFA76F80000-0x00007FFA76FA6000-memory.dmp
          Download

          memory/5616-530-0x00007FFA76F80000-0x00007FFA76FA6000-memory.dmp
          Download

          memory/5616-531-0x00007FFA76F80000-0x00007FFA76FA6000-memory.dmp
          Download

          memory/5616-532-0x00007FFA76E20000-0x00007FFA76E47000-memory.dmp
          Download

          memory/5616-533-0x00007FFA76E20000-0x00007FFA76E47000-memory.dmp
          Download

          memory/5616-534-0x00007FFA76E20000-0x00007FFA76E47000-memory.dmp
          Download

          memory/5616-560-0x000002AE872D0000-0x000002AE872D1000-memory.dmp
          Download