Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

RobloxPlay...8).exe

windows7-x64

8

RobloxPlay...8).exe

windows10-2004-x64

8

Analysis

  • max time kernel
    136s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerLauncher (18).exe

  • Size

    4.7MB

  • MD5

    71add7b85d2f54ceb8f29441ac289ff9

  • SHA1

    aff84fe9d9a02041efcc1c31d8832f5c6e568c61

  • SHA256

    ca60b1b987cc86a5e3ef20aadb809afd866ad28291ee0493f396dbd5bc36d444

  • SHA512

    73ade50aabc1b290f215c50702deaaf8969f019883e96544a2403789c611860a2e4fe8a4fe03f817e5c10f3b2913a9034652462f82ba7a67fe171a2dedf0a671

  • SSDEEP

    98304:CFvW3v7lBiz5aaV6natNgusbwIbp7swZEV0eEObn:wov7a5hbguylKV0POb

Score
8/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 31 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (18).exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=252144ad201c7c0df361af1230d28cc870855239 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5d4,0x5d8,0x5dc,0x5b0,0x5e4,0xf70368,0xf70378,0xf70388
      2⤵
      • Modifies system certificate store
      PID:2636
    • C:\Users\Admin\AppData\Local\Temp\RBX-233A29AC\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RBX-233A29AC\RobloxPlayerLauncher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\Temp\RBX-233A29AC\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RBX-233A29AC\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5ac,0x5b0,0x5b4,0x588,0x5bc,0x16a86c0,0x16a86d0,0x16a86e0
        3⤵
        • Executes dropped EXE
        PID:888
      • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        MicrosoftEdgeWebview2Setup.exe /silent /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Sets file execution options in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:2012
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2912
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2524
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2192
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:1256
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0I0MjY4N0ItMUY3RC00NjIzLTg3OTUtMzE1MjNFQ0I1QUZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNUU5Q0U4NS0zREM1LTRENEEtQUQ3QS0wMEIwQjI5Q0NENkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIyODM4NzQwMDAiIGluc3RhbGxfdGltZV9tcz0iNTgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            PID:2364
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{7B42687B-1F7D-4623-8795-31523ECB5AFD}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1656
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    PID:2300
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0I0MjY4N0ItMUY3RC00NjIzLTg3OTUtMzE1MjNFQ0I1QUZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMzI4Q0RFMi04NUI5LTQ0ODctOTVGOC00OENFNkI4MjU1NzV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMjg2Mjg0MDAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:2848
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95217316-F9F3-4258-8DD0-704A4F510D15}\MicrosoftEdge_X64_109.0.1518.140.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95217316-F9F3-4258-8DD0-704A4F510D15}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1956
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95217316-F9F3-4258-8DD0-704A4F510D15}\EDGEMITMP_26235.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95217316-F9F3-4258-8DD0-704A4F510D15}\EDGEMITMP_26235.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95217316-F9F3-4258-8DD0-704A4F510D15}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        PID:2668
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0I0MjY4N0ItMUY3RC00NjIzLTg3OTUtMzE1MjNFQ0I1QUZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxMUMxMDUzNy01MjIyLTQwMTgtODhCRS00RDAxREZBMzczQjN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEwOS4wLjE1MTguMTQwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNjYyOTQ0MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjY2Mjk3NDAwMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI4Mzk5MzQwMDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzBjNDA4NGYzLTFiZWQtNDI0Ni1iOGVkLTIwNmNjYmU2MGUzYz9QMT0xNzA5NzYzMDY4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUJWS3dvMDFqVHQlMmZoMjV6Z0kzWUdMamdRY1ZISWZ0UHo3bW1MbG5kZ0UlMmJ4cUxQczFKaSUyYnZiMXRpaEtHWFQ3JTJiJTJiSk15dlcxd3pIbE5NUFV6T2NGSnElMmJ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTQwNjk2MDA4IiB0b3RhbD0iMTQwNjk2MDA4IiBkb3dubG9hZF90aW1lX21zPSIxNjAzNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI4NDAwNTQwMDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyODUxOTg0MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NjA5IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyOTM2NzU0MDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNTk3MCIgZG93bmxvYWRfdGltZV9tcz0iMTc3MDYiIGRvd25sb2FkZWQ9IjE0MDY5NjAwOCIgdG90YWw9IjE0MDY5NjAwOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iODQ3NCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:308
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:280
    • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerBeta.exe" --app
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\109.0.1518.140\MicrosoftEdge_X64_109.0.1518.140.exe
      Filesize

      74.4MB

      MD5

      2950620c67b61315e773a33dc366ceff

      SHA1

      cf96faa02b27b79ee18b32e3c985e7d7f6b32fe2

      SHA256

      4e81d3fafc90a0b9e3c0d76a78642f17ec5efc22cbb5643c3cef143eddfcb41a

      SHA512

      d274a0f7b321f87f2593645545c3dedf3c89ea4e059f7a6fe0e265969e5f28ccca17afcedec5c074497272d1c17ea20dd5a0306c3620afdf5be501f7251bae33

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2668_1979814015\109.0.1518.140\Installer\msedge_7z.data
      Filesize

      3KB

      MD5

      bd70ed26e6e6f3193043ac09c58c6a1c

      SHA1

      d733a65e17f2851d5116598dd80533efc1656468

      SHA256

      7a474217d20b9a6fe3c3a46c0d6d5b2d2040fa790663f6da9202ee7cb07bb448

      SHA512

      3e2ecade6d687b0736d5eafd7527b24095b9c51f0c8ba99398b23da2d8843c49fc8c1fa37190d385b504d8224c8c517d78d44ae32e10e45d54b19477a6970756

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2668_1979814015\109.0.1518.140\Installer\setup.exe
      Filesize

      3.8MB

      MD5

      3a92a61a6e01c80ecc7d9499abb901b7

      SHA1

      d89d05802d937f9c71ced14282b8a19623fca7c8

      SHA256

      b70b2ed82c7afde8003983992b74f8182f55080b43da3d96dd29e8c0c7e8b47e

      SHA512

      3867efbd984ddd1eec084c70a42104cbc0057c3bed222af8963051779b612b46bf4cea3311452f6564513d7558d49a1e66a9473ad53f1b2fb4c43a9d7d0fb47d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\EdgeUpdate.dat
      Filesize

      12KB

      MD5

      369bbc37cff290adb8963dc5e518b9b8

      SHA1

      de0ef569f7ef55032e4b18d3a03542cc2bbac191

      SHA256

      3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

      SHA512

      4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeComRegisterShellARM64.exe
      Filesize

      179KB

      MD5

      7a160c6016922713345454265807f08d

      SHA1

      e36ee184edd449252eb2dfd3016d5b0d2edad3c6

      SHA256

      35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

      SHA512

      c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
      Filesize

      212KB

      MD5

      60dba9b06b56e58f5aea1a4149c743d2

      SHA1

      a7e456acf64dd99ca30259cf45b88cf2515a69b3

      SHA256

      4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

      SHA512

      e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeUpdateCore.exe
      Filesize

      257KB

      MD5

      c044dcfa4d518df8fc9d4a161d49cece

      SHA1

      91bd4e933b22c010454fd6d3e3b042ab6e8b2149

      SHA256

      9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

      SHA512

      f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\NOTICE.TXT
      Filesize

      4KB

      MD5

      6dd5bf0743f2366a0bdd37e302783bcd

      SHA1

      e5ff6e044c40c02b1fc78304804fe1f993fed2e6

      SHA256

      91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

      SHA512

      f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdate.dll
      Filesize

      2.0MB

      MD5

      965b3af7886e7bf6584488658c050ca2

      SHA1

      72daabdde7cd500c483d0eeecb1bd19708f8e4a5

      SHA256

      d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

      SHA512

      1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_af.dll
      Filesize

      28KB

      MD5

      567aec2d42d02675eb515bbd852be7db

      SHA1

      66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

      SHA256

      a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

      SHA512

      3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_am.dll
      Filesize

      24KB

      MD5

      f6c1324070b6c4e2a8f8921652bfbdfa

      SHA1

      988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

      SHA256

      986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

      SHA512

      63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_ar.dll
      Filesize

      26KB

      MD5

      570efe7aa117a1f98c7a682f8112cb6d

      SHA1

      536e7c49e24e9aa068a021a8f258e3e4e69fa64f

      SHA256

      e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

      SHA512

      5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_as.dll
      Filesize

      28KB

      MD5

      a8d3210e34bf6f63a35590245c16bc1b

      SHA1

      f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

      SHA256

      3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

      SHA512

      6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_az.dll
      Filesize

      29KB

      MD5

      7937c407ebe21170daf0975779f1aa49

      SHA1

      4c2a40e76209abd2492dfaaf65ef24de72291346

      SHA256

      5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

      SHA512

      8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_bg.dll
      Filesize

      29KB

      MD5

      8375b1b756b2a74a12def575351e6bbd

      SHA1

      802ec096425dc1cab723d4cf2fd1a868315d3727

      SHA256

      a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

      SHA512

      aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_bn-IN.dll
      Filesize

      29KB

      MD5

      a94cf5e8b1708a43393263a33e739edd

      SHA1

      1068868bdc271a52aaae6f749028ed3170b09cce

      SHA256

      5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

      SHA512

      920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_bn.dll
      Filesize

      29KB

      MD5

      7dc58c4e27eaf84ae9984cff2cc16235

      SHA1

      3f53499ddc487658932a8c2bcf562ba32afd3bda

      SHA256

      e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

      SHA512

      bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_bs.dll
      Filesize

      28KB

      MD5

      e338dccaa43962697db9f67e0265a3fc

      SHA1

      4c6c327efc12d21c4299df7b97bf2c45840e0d83

      SHA256

      99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

      SHA512

      e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU8C48.tmp\msedgeupdateres_en.dll
      Filesize

      27KB

      MD5

      4a1e3cf488e998ef4d22ac25ccc520a5

      SHA1

      dc568a6e3c9465474ef0d761581c733b3371b1cd

      SHA256

      9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

      SHA512

      ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

      Download Submit

    • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
      Filesize

      4.9MB

      MD5

      a502990d5df008eb385b5862f37c3a6c

      SHA1

      e6c92247d2ec0a7e823910f096d72a661da19db8

      SHA256

      b9a56ff86f4f6d7ca4c91aba67b55e8487dcd0c31ea75fb8664a4f28aa0411b1

      SHA512

      ff99f05a31be147e15cbfc41d9d9f371749c61dac22c2e46d73a807376c2ef8254f87c83b0d385df8f6d6262a35d95a6ea9790dde10bbb4046ecd6ed1262cbc7

      Download Submit

    • C:\Program Files (x86)\Roblox\Versions\version-70a2467227df4077\RobloxPlayerInstaller.exe
      Filesize

      4.6MB

      MD5

      884f182558478768a43de12bbb5bd168

      SHA1

      831ce37ca2289cf123733306077b936c9407319d

      SHA256

      bb4fa744d72612edd395213bba74efe233464cc8707ec55aa85052b6211757b4

      SHA512

      665e957a508547a673ec354ef8008e16058e7aa50f1520e0539940c99beb35b9375c9546efa3dab58ced01a80c95a68ed17c76350efde3472da625ea877043ff

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      14KB

      MD5

      d098117fe4d051476c36846d44fe111d

      SHA1

      469657fe8e72babf0f7e0adfa520944d78953b18

      SHA256

      9745db9d8a5e9239b9a33edebf6e3466e543029034f0dc2c82e770648da53ffe

      SHA512

      d4cdc2c293bfdae4367516b5899ab79ef10355880cb4e21531e9711a0d25041a6287dae51b62562b4676965ca5d13e3db6cb9abda617bb32284056f456b48009

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
      Filesize

      2KB

      MD5

      414cc78543240371588e915fa02e9ce3

      SHA1

      bebe937c284acb073bb1303b11617de2f8d13220

      SHA256

      0234a2984a42356327f2648005b74b80a13d4caa1fa15ce72aa1c1ae7559976a

      SHA512

      2f0ba4a508e3351a04fb065865eb7b00da2fb0baa1a1aa7968e6c192e9cc17b26e3024f3260a07ea58beb499befe2688a484180ad88ead5f665b41f2c06b9b87

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
      Filesize

      472B

      MD5

      90e7f05c6bd3719bd73d825a8625154a

      SHA1

      54d83e0bbaa567ea6071b98910e2368a26523c53

      SHA256

      dad7d236792743797d90bc4ac7419728df99ad88bfa88f2818add6f8a22a5c5a

      SHA512

      1dfc3cf86fcc308fb5b54b2a08007ac734876aef95fdd23381ebbdb360e8c5ec7dbddf850a6c4e0e3a51ffde9aae935db3c30ea78f5ed8b2de072b00b35c6e36

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
      Filesize

      1KB

      MD5

      76e13853e71ffa71ba76664bbdbee1e8

      SHA1

      6af60fbdff49089b3e7c94f19e88eba5c948d03e

      SHA256

      21831a03f8be39a43e73b568475286b1f6a86b63a1415cf11001eb0f7d745977

      SHA512

      00102eee75aaec5166200d9b4fdd41865884fc33600bd5c756738d03037a47e89991039eb94802d411cd668e35970aad1640260203e7ec5cb77b5ba0ffe163f4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      1KB

      MD5

      5b9dc51eb6ca5e3eb57730ccccac4f46

      SHA1

      07defab0c9026042c3c2163c7f62c3cf1bd0b2ae

      SHA256

      43dfc1607db310f03dcf964636f54ff9dbd749b80ff34f5f2d508e0ae8b4b6c8

      SHA512

      eb4dfcab07d111894bf57dd3f15d2ea1ee2535c492ea94587fd89fe282909d660b9218930a3ada93371b2d58640dc2fb3a9756c44a958d658b758ea91f3373d4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      471B

      MD5

      572ea307898c8c6eaa8dc4985a77e177

      SHA1

      07f16d7a86f8b799364a5c654253e9a2058667af

      SHA256

      a0af8a9e91c0c0e591be7382e2e875d6ad52eb6fa86dbba599704a5d5189e298

      SHA512

      01f77c6cd80e50006476a66170dcf4238b6b8d5173a20c071605411dc49610d88950b52d6d8935e07301dd69a42c84c713fa50f7d6bc75686b452f77a5a6d191

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
      Filesize

      2KB

      MD5

      f95bd71a77c00c29a93e2af6fdf201fd

      SHA1

      4ebbc400e4ee80a714bd6dd4f745e4defad223fc

      SHA256

      5d5d9b76d2bde2a8707bcf90736295dcfe6f1f16b71fe56c2259dadfb7218891

      SHA512

      cf1bfa4240dda937615b8002623ca14782c9301cb86e96d7bdb40456cac2d07a1856b095c7c6fc95b7ef8050ccda66dc81987b26ecd1f60d3088c6a5aeb6167e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
      Filesize

      1KB

      MD5

      ee312d0cdef286ecc6116c770dbdffcd

      SHA1

      b16485959a655ef42e98fda3391eb83b4bd91922

      SHA256

      52bc0dea85163eef64a11acb9e95e8c287c487579be1d1fb25161e5a2b7e5be9

      SHA512

      3891cdbb13a401db459b2d5eb5962b8b87bd0b735f58db23f7ac3551d5d3a93287d8d4d8b4ae4f294b3ca207cebd934683db3ce507db2babe73952b724b7cc91

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
      Filesize

      488B

      MD5

      06d28e076ac00c037610f2b0f0975811

      SHA1

      58a06884677d5f7f1b26b2711a5a070e0df7542b

      SHA256

      e8e13997d5be0f403a78d4468cd618c451026f681ddc2906ef38cddeb2dd8b15

      SHA512

      fda3fb7fd85099d8b3e04c273e802ab0245cc9e09c1a5d41cf7c590786cf5a3eaf6688da953e3a9490c8a8ca0165eac8ce4688000b97ce23773d9a8671ddc593

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
      Filesize

      488B

      MD5

      f5dba0acabf34ed1b1482f7e292f25bb

      SHA1

      09247175a9f40031be7ec4eb1e27556bb6405a2e

      SHA256

      447b5ec8d975a538be549b8a857dc754499678c07b59d1bfbe71ec7487c58db7

      SHA512

      953841bd4b1839429c0e3a691dce8afc703250072ae3f6f59dd9fdc65eb2ba855d5c1995114f58c773e06bb86363452e40073e64c3ae715a29dfc952e60e135b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
      Filesize

      492B

      MD5

      ed362903628dee8023e86c5f4606b4d0

      SHA1

      62d845e45d7e3be406cdfe615059388fbe8b79a4

      SHA256

      ad83dbb242812da25d77c0adde0bb59b8b9e42faa09ede59c4ef78086e74ee18

      SHA512

      522dfb571345c431ce486db0842039da7c4ecd73221917483a9ec18ba33092142626b3d651cd6ff0a35ca418f0f212957dfd926ba9af9136e5418d14005848d9

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
      Filesize

      434B

      MD5

      5473062501aeef5deb1662eb56039509

      SHA1

      dae4650b9126baaeed6b2ef93341aa1d5b6e8765

      SHA256

      f1d6b49e307e1226e5ab6afff9a385c60dbc9ff13257ce1fa6fd8bbb7c100792

      SHA512

      696ef55033282436636d016bf61077370d3a608c95811720a3fb870cc4fa22510b5440de2edc74d76be27b12c40676e09369dd3e6554108c070e31fbe30523cd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      f8959b6cc34021ccf535812e377adcec

      SHA1

      dc619166fccdf9eacfb8a4392cfd3673d8829a7f

      SHA256

      ee1c8b41282a4816c994318cba661174df3e488cb38a38fee8b8d703dc852417

      SHA512

      4f7249383927a163c3dfa3d649a6b0f83857b0fbf678b2e1579c7a771fce11be5d2286fba2d6df94cb60ee4030d7e8356057f8262e644bcca24b1b95961487c9

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      51d20f94f317da6b9c66df88ad5a6cbd

      SHA1

      5524adebde41c131c038fb19d070490379d0251f

      SHA256

      bb4d8eb8a0875c077e08fae3ede60adffb66f1bb069f5cb548fe8a63d7191d00

      SHA512

      dbdd9ea4e173fe77cf5bcf1ced2c7a09ed3d9ac9a17a758a2298c1eeea74a3c069d0a450d9396ac22f74d2bbc8df861bd3e05160f72f0cf35467f6d29d783566

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      7d77aaf3fd4f57f85462bd1189e4fadb

      SHA1

      b51a2c4a58b2a0fe6f5dea57c5749df8de58ad44

      SHA256

      727fa9d30ae7345449fd15483d24f643f00dfbda55b3cb7308e4ecc745f8302b

      SHA512

      8135289b044b0bf0a1514133ca2139cb62bfc130b3067cd9971d7aff849006fcd03140769d7ee02c7f867aedb993425019052435532ed59111dd65e2919f2676

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      7392bca03e7c672a5ee73855b8d13446

      SHA1

      1cfc96af4a68d5e9aa1313bf4be6c45444e46919

      SHA256

      960309cd112c35e15c892c033fdfb8b805ce52a92c038f3aba1b800ccd0cbaad

      SHA512

      1b1348455ab62d07cbff77318e87b4b4dfa17c790584f158f7ed45f33e3b8ce2b8bfcd4b79e9dd9e0bb5b3c2b529e51dd53242ac318b2103a3ac87f93c0d2741

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      e7c5b23bafa38dee3c0eafff007d9d7a

      SHA1

      3e4336e086ec2286ef54e57e420483587ae1ea4e

      SHA256

      cfff89e1640b37b1388f7f03b9d30aed76f1c0c2e3d70084cc85609cf4f56f2a

      SHA512

      66bbadcec59504c8de57e09aa42af8d537fe97d30bd2043543d48b889428766a492e64a14c85e993d08712ee23050b3d4593a6c416d2fad473c7b75dadebe66f

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d75880ff309fb390b273c9376cfc2256

      SHA1

      4dba0568f9f0410d96b9b2334ee46ec189ca0255

      SHA256

      a570226df719e1cab06a79347125fa6d2e5b7a1c2e0813aa2a011afe3913f529

      SHA512

      6c5f03aff7ef664ba11ce13c15ca4324819acbecd838a8f204df3588a7d5a3fa5fcb54feb2ca72b31afe1f43bfd40346f6adff4a1a5408585c535a4c0aae3897

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      482B

      MD5

      b7c7817617ab5d9acabb2684130a42c3

      SHA1

      e7d9f2a992b1d44d6d49c4ca9af92fc5529e750c

      SHA256

      31d3445f3a4592590c2f0ef56c468a93d52953ae8755d5a29c7429a59b61da25

      SHA512

      ad2b9b41e1635e36bd7ada08874d263291b3abd450d8335cd295aa2a4d7a88ddca10cf88ba0e0f3394940233ee5d5b2876416c10c873d96ad3d8a788a07c6bec

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      482B

      MD5

      0a47aeb2e93616f4ad2d4c9b6544e00e

      SHA1

      a6efb5c09378b776274ff4f2baa909af54f812c8

      SHA256

      107197b9e1bcf2348849374edaf9cd9297728cba49778e7fd487123593666f63

      SHA512

      a40e0ce92faf2ac1300e1e5aefa19854d41e10d7f0751155c94c5d13f4170d2bfb15db842199d193d17bc27e054c065b029e688e1a216dd7409283884b23ce9a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      400B

      MD5

      0c2d40e41c6ec52524ccd0845cf056f7

      SHA1

      c74709475c5db9bb92cc75c4b97768b344b762e5

      SHA256

      b92da3e6f6de5c87acd036a176f3c34f873fe741c03e7919c054bf2dd080ccf7

      SHA512

      99a2b2a0fc3adffee627be7b7978be54d7a6f66d7930b6b99fca719ba1e4b256b9291daf50e9ebce86b45d9d6dd12b6112848606d2615f8e4eae1a5190fe0b7d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
      Filesize

      458B

      MD5

      5b6f14b0a28a0ec50eef0410de003d47

      SHA1

      5fc8a38f5a55032d0bea3a861c3492a221698d83

      SHA256

      5bb736663955ccc01ee71bdf599d9362bcb65a6e47a09915bdee9e7c0c64d98e

      SHA512

      0686c6fb3512240b63add5a7f4c56006c9f5d1d3723661de131e5f239e10d998230fce613764c990c77e6bf17cd453554f0ba104bd08a41aebba346fb742bd1c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
      Filesize

      432B

      MD5

      3c3d9e62b1f50c3821f1d7073b620aea

      SHA1

      1316f4021b39f6af97fba54e3155bcd1cd3575ac

      SHA256

      2d96dac5971d6789e40f522ebf822f56cf19c7c01dab0390a34503172f5e85f0

      SHA512

      7959679304a7ad1b06c8107441f54dd5cf7ae5194bf2ddc6ce1b0820bf1b342c10592e99f2fcafdbcbe134db90a675fe1c092c0e227cf732fd045867df582fd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\WindowsPlayer[1].json
      Filesize

      119B

      MD5

      36f9d29123e6d3ba11fc0606e118b42e

      SHA1

      a01ab621c0a4ef112f3c8a22af45335377c6ea6b

      SHA256

      39b4d267880abe6cbbc9db4e89152a3faec2e1f0ea9f4ee208382326f5d1bdf2

      SHA512

      5c07a9b4abc9f9f5daddb3afad82d08f827375085cb17c645b6da321f1f27d406006ab76b47544978f9785ca195ad63cd3123ebf1ce5717adb64204a4aeda680

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\BatchIncrement[1].json
      Filesize

      163B

      MD5

      bedbf7d7d69748886e9b48f45c75fbbe

      SHA1

      aa0789d89bfbd44ca1bffe83851af95b6afb012c

      SHA256

      b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

      SHA512

      7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\version-70a2467227df4077-rbxBootstrapperPkgManifest[1].txt
      Filesize

      82B

      MD5

      0f98ef493a7b65cb2b6cb999e44226a9

      SHA1

      972bd99c5b75a45aaf5bd2c54281ee0b9baeefd1

      SHA256

      a700240448fb42106dc569cc786c0f4d8a83e2a4e8999802a4c32e5737c9f4c9

      SHA512

      f43f4b37158b4d1ae8bd57fd9b86f21d7d8f3e36734bca100670ec5e99b1794ce45ab5da282e44e72511d384ecce45954558e5aea1614d16513f1ee88f93d7d0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\version-70a2467227df4077-rbxPkgManifest[1].txt
      Filesize

      1KB

      MD5

      56391f65239bdb2eac877d841a63a964

      SHA1

      74956b20cd045ee4eb7bc07623eb43113d5afffa

      SHA256

      184f6d4cf6105a41c4b651c2f72d7134fe01c0e5824b489b869041f96325fabf

      SHA512

      351eec5e076340835cbe623610fe44a763071d381fb6aea07b02e7dc594c1a3f28c55afe08ffb156e03b001475049c024e390d22487d9d398094f33fa334d0be

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\PCClientBootstrapper[1].json
      Filesize

      5KB

      MD5

      b700df352d5763b27bf39a495ae842ee

      SHA1

      1e4e5dbd1a1fff0679ef278eda973df1931108ec

      SHA256

      c298f9618d15dd32ae9030e6b068a590ed3adc2091539bd84eef11d15f3bffec

      SHA512

      4469dc3b1adcf7a5dfaf752c7160cc769df1a53abcb9a6479070dc0b51c7a16f1c30a5930fb4b9897c094073285ff758da5b9c15201e7a106aaec2f3359db3e8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\version-70a2467227df4077-rbxInstallerPkgManifest[1].txt
      Filesize

      83B

      MD5

      a878b4db0816b20bee0302c919b78c7a

      SHA1

      bc56e5cc23baabb8b5d485fbad90112784088ec9

      SHA256

      43ea54ae7dd93e1c7c506b8a8cf28745364b482c1f8e31357a05debccc593766

      SHA512

      f43bde5f6c8a0812866003025920fcdb55ee7053cdcff500be90b106df3ff23b3eeb0514a6c9cab986a31d7d089a87222b7fe5af9d402bd41e1bb29aef03c4f0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab1C59.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar1D42.tmp
      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar1DF5.tmp
      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
      Filesize

      40B

      MD5

      16e8b732ae8ba5f4184ef0cb113dd297

      SHA1

      baba48298a8cc100c3f1c1c9f602d989f30553d0

      SHA256

      6e62cd8768bb36951cdf07f9dd72934d5ffcdcd65f4eb21fc24f3b4ac3905bda

      SHA512

      db03ef2e9c1597b6f294ab692695e17e52164e16b95de3afcabdea2be69fb1be19d6949672283217412cd42392a971e54330988e3c487e9d032c0631faeef9e4

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
      Filesize

      252B

      MD5

      278aac72379c94a588a897ced03e83b9

      SHA1

      b5a3af9d2e771082f0d0d397209403c9e6a647ad

      SHA256

      72c5e895f2e55ea2d1f008f403633f6f509e9e9531b776c525113ed03e62841d

      SHA512

      d3ae4cf81977bf77f385ba6694842eede501e3463806bc7bb918913abb88fff7056da23db4df1cc557106be1b61d711a97fd17d57f209beffe9e85f2ed60ebc8

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      8e205723425a51a838a9bcddbda7f7b9

      SHA1

      faca6e44aa95a52fc73d3066d15da15c322e08c8

      SHA256

      9bc06d383b31ba8b56a93485c4a3431f86365069b4e19def987bf6ee3fb6ffc5

      SHA512

      d49f67f1b183a6036509ef70314e9c7ee605e1fb7487a9bfb29be31ba094b4363e36d4627c6db91dfccc1500f9f491a6a7fcb4f7923479a28cf7a8496702f74a

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      ee9617db4c099a3ac5a7603fed873b79

      SHA1

      3053ae8ea465d86b3bb5aac072860237b2716362

      SHA256

      11ff7d0d1837ae4798e71a3b593321f7c0dedc6eeb79d4eb351e2404dc0b06a5

      SHA512

      1a2ffab6fe1aff3a6d2756c94f7099d9ad53ca4571cdfb530f5765f66292bdc6a5de7cd2c604c591aecb0eb201528c628f7ba249d8c249edff03dc58b09d2a3c

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      db485434769b316689c165827d322792

      SHA1

      75c6b693b3345fc85d352e844b17c6b15eff7844

      SHA256

      fcf6a86f26bc684ed80d403a1254f78a23478fc67d4a1d2cf6b28d0b7bf5122a

      SHA512

      094ef5e05df93a039324b8b288c8747a457993873aee7f76b9c8f9c64325b49900db87e82f2fdf3a7b5e32a5ec19f07e072895640b4e2f8917e7f600e739450a

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      efbf1946eb624ee877015601cf663366

      SHA1

      f28f2357ae8a452767f96cbf255bb3448693d217

      SHA256

      544054573d3f27f39723095360b8a6d16466233e32d14be9addc8bb96a69bee1

      SHA512

      7a92042b5babea2d7deca7457345cb08114ba3c9efffe1bf97b897b0b66d83dc23bad67ec79ba9df728eb1011e0fc3db0983065ab97ef2479abe0be727ad157c

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      f876911bb4379c997c39eaba2093b01e

      SHA1

      f04adc453bdcd19553d7dc055ac80404c1a77304

      SHA256

      4b6c3c9db9f10da0e0d359c2004ba87dde1e6b46f807281a1ef7bfad929ae57b

      SHA512

      f9dadd0d1c6813fd987363446386b704f0288e19c2bcef43bbd9f07809607edd1162949053c5d58c21eb7c22df713a4da5ceec10c4e95f36713c7effac6a7513

      Download Submit

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      242B

      MD5

      b8afe632286a6192417820b28bebb355

      SHA1

      0edebe1067874fd246c89d5595702d9094886b4e

      SHA256

      7807d608e0da0356912d489f20313ccd152ef5d468603c235ca48380c32c28cd

      SHA512

      ccee5b3e96a913f9f817fd89c40e395714a99c30cb1f812d3184268dfbe4e0bf9098689128b15e05472dc48efcb7d14051f2b0fa5d66f1d808f736a967006614

      Download Submit

    • \Program Files (x86)\Microsoft\Temp\EU8C48.tmp\MicrosoftEdgeUpdate.exe
      Filesize

      201KB

      MD5

      4dc57ab56e37cd05e81f0d8aaafc5179

      SHA1

      494a90728d7680f979b0ad87f09b5b58f16d1cd5

      SHA256

      87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

      SHA512

      320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

      Download Submit

    • \Program Files (x86)\Roblox\Versions\version-70a2467227df4077\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      Filesize

      1.5MB

      MD5

      610b1b60dc8729bad759c92f82ee2804

      SHA1

      9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

      SHA256

      921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

      SHA512

      0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

      Download Submit

    • \Users\Admin\AppData\Local\Temp\RBX-233A29AC\RobloxPlayerLauncher.exe
      Filesize

      5.0MB

      MD5

      e5d3b8a1a30406c5f0899e94020cc821

      SHA1

      37351bacdd4f8edee07dfecd1ed14fcfee18eb18

      SHA256

      2a5b535ccd9620aff782560722a034f5a2556a11df84e9bfe62c0b84fc86228d

      SHA512

      8003f619e281870ef33dfd775191dfd697deb7d2f0a4e0b4ce68a0b80514aa9ee6bdbae6eaaa1289030c31b2460d62b6091fb8f2cda18f41ffac6b7443d32955

      Download Submit

    • memory/1656-589-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

      Download