Overview

overview

8

Static

static

1

RobloxPlay...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    238s
  • max time network
    239s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 15:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerLauncher.exe
  • Size 786KB
  • Sample240302-st87tseh74
  • SHA256 c8a2c49d826240a651b2ea26eb496ea46fdfcaf2074cac88066e9b5852d0cea5
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 17 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Users\Admin\AppData\Local\Temp\RBX-E3B54CE9.tmp
      "C:\Users\Admin\AppData\Local\Temp\RBX-E3B54CE9.tmp"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Users\Admin\AppData\Local\Temp\RBX-E3B54CE9.tmp
        C:\Users\Admin\AppData\Local\Temp\RBX-E3B54CE9.tmp --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=fde48f439a9af7a7f1b323bea0e4a5d1febc3390 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x79c,0x7a0,0x7a4,0x798,0x7ac,0x1381330,0x1381340,0x1381350
        3⤵
        • Executes dropped EXE
        PID:1680
      • C:\Users\Admin\AppData\Local\Temp\RBX-CA47DD4A\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-CA47DD4A\RobloxPlayerLauncher.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4396
        • C:\Users\Admin\AppData\Local\Temp\RBX-CA47DD4A\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-CA47DD4A\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=87551316796ed7af4765b48a0c14179d51c2216e --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5e8,0x5ec,0x5f0,0x5e4,0x604,0x19b3148,0x19b3158,0x19b3168
          4⤵
          • Executes dropped EXE
          PID:4892
        • C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            5⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4992
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:4620
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3048
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3560
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:2452
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:2356
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTA0Q0JFNjktMTRDOS00QzdBLUE5RTYtQ0M4QTAyOTkxRTA5fSIgdXNlcmlkPSJ7RUU5OTZFMEYtMkQ0OS00MTE2LUJEQkYtMTVBRjRFREFDNEM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MzY0NkQ1Qy1DMjI4LTQzODctOEM0Mi02MDBFMUVENEQyNDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODUuMTciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODA3NDkyNzU3IiBpbnN0YWxsX3RpbWVfbXM9IjUwMCIvPjwvYXBwPjwvcmVxdWVzdD4
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              PID:4492
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{104CBE69-14C9-4C7A-A9E6-CC8A02991E09}" /silent
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2892
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTA0Q0JFNjktMTRDOS00QzdBLUE5RTYtQ0M4QTAyOTkxRTA5fSIgdXNlcmlkPSJ7RUU5OTZFMEYtMkQ0OS00MTE2LUJEQkYtMTVBRjRFREFDNEM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCMjY0MTg3MS0yNDQ3LTQ2NTgtQTdBMC1FNTc2NjBGRjE5NjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODExNTgyNzczIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:1452
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\MicrosoftEdge_X64_122.0.2365.66.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\MicrosoftEdge_X64_122.0.2365.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\EDGEMITMP_952E4.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\EDGEMITMP_952E4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\MicrosoftEdge_X64_122.0.2365.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\EDGEMITMP_952E4.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\EDGEMITMP_952E4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.95 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ABDE9919-BE43-4C95-95BB-97B999EAEAA5}\EDGEMITMP_952E4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.66 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff60b0c69a8,0x7ff60b0c69b4,0x7ff60b0c69c0
          4⤵
          • Executes dropped EXE
          PID:3140
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTA0Q0JFNjktMTRDOS00QzdBLUE5RTYtQ0M4QTAyOTkxRTA5fSIgdXNlcmlkPSJ7RUU5OTZFMEYtMkQ0OS00MTE2LUJEQkYtMTVBRjRFREFDNEM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntENkRCQUY0MS1CRDFGLTQzNTYtQjZEMi05NTdFOEU4REYwOUZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMi4wLjIzNjUuNjYiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4MjM1MTI4NjYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODIzNTYyOTY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3ODk1MjYyOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMGVmZDNiOGMtNzYyZi00MmE4LWI2MzUtMWU1ODMxZmMwN2MzP1AxPTE3MDk5OTgwNDImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9alhaQlZpSlJZZXpybU91cCUyYkN5TjZhS1lUUUVvNXp2YXpMRCUyYkRLMUN1YTVqcEhQREJhWHk1cHhoR2FVNE1SYVZBUUhNUmNhd1pwZ29ZJTJibGtqZTNkV2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzE2MjI5NjgiIHRvdGFsPSIxNzE2MjI5NjgiIGRvd25sb2FkX3RpbWVfbXM9IjU5MTA0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3OTA0MjYwNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0OTMwNDI2MTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMTgzNDI3MjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3MDYiIGRvd25sb2FkX3RpbWVfbXM9IjY1NTM3IiBkb3dubG9hZGVkPSIxNzE2MjI5NjgiIHRvdGFsPSIxNzE2MjI5NjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjUyNTE5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:4460
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
      PID:4844
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
        PID:1476
      • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
        "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" -ide
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
          "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=2e4960dba5b3e3c329015a3ccf7548c1cd4503a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x738,0x73c,0x740,0x69c,0x748,0xc3e048,0xc3e058,0xc3e068
          2⤵
          • Executes dropped EXE
          PID:532
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ShowUninstall.vbs"
        1⤵
          PID:2748
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\DismountStart.dib"
          1⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3224
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
          1⤵
            PID:1896
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ImportUnregister.png" /ForceBootstrapPaint3D
            1⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:5036
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
            1⤵
            • Drops file in System32 directory
            PID:3468
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:2760
          • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
            "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" -ide
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
              "C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=2e4960dba5b3e3c329015a3ccf7548c1cd4503a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x710,0x714,0x718,0x680,0x730,0xc3e048,0xc3e058,0xc3e068
              2⤵
              • Executes dropped EXE
              PID:3104
          • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
            "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\SaveEdit.pot"
            1⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:1712
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:632
            • C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe
              "C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerBeta.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              PID:1936
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch -contentTile -url 0 https://outlook.com
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffd6a8a46f8,0x7ffd6a8a4708,0x7ffd6a8a4718
                2⤵
                  PID:2144
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,16931335940702742664,9200880432613003840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
                  2⤵
                    PID:2960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,16931335940702742664,9200880432613003840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1984
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,16931335940702742664,9200880432613003840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
                    2⤵
                      PID:2612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,16931335940702742664,9200880432613003840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                      2⤵
                        PID:180
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,16931335940702742664,9200880432613003840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                        2⤵
                          PID:4604
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:940
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3532
                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                            1⤵
                            • Modifies system executable filetype association
                            • Registers COM server for autorun
                            • Checks processor information in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:5420
                            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                              2⤵
                                PID:5820

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  setup.exe
                                  • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.66\Installer\setup.exe
                                  • Size 6.8MB
                                  • SHA256 1aa54fb27b21e6ec787ae3a41f20fbcdadc8fa8fa3be58526295a0ce0b504f89
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdge_X64_122.0.2365.66.exe
                                  • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.66\MicrosoftEdge_X64_122.0.2365.66.exe
                                  • Size 105.2MB
                                  • SHA256 b187ba75ec5e772ea6035e316fbb9ae2abbb1e431eebe8fee42b592591fa5a20
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  EdgeUpdate.dat
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\EdgeUpdate.dat
                                  • Size 12KB
                                  • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdgeComRegisterShellARM64.exe
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                  • Size 179KB
                                  • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdgeUpdate.exe
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeUpdate.exe
                                  • Size 201KB
                                  • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdgeUpdateComRegisterShell64.exe
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  • Size 212KB
                                  • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdgeUpdateCore.exe
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\MicrosoftEdgeUpdateCore.exe
                                  • Size 257KB
                                  • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  NOTICE.TXT
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\NOTICE.TXT
                                  • Size 4KB
                                  • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdate.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdate.dll
                                  • Size 2.0MB
                                  • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_af.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_af.dll
                                  • Size 28KB
                                  • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_am.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_am.dll
                                  • Size 24KB
                                  • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_ar.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_ar.dll
                                  • Size 26KB
                                  • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_as.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_as.dll
                                  • Size 28KB
                                  • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_az.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_az.dll
                                  • Size 29KB
                                  • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_bg.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_bg.dll
                                  • Size 29KB
                                  • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_bn-IN.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_bn-IN.dll
                                  • Size 29KB
                                  • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_bn.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_bn.dll
                                  • Size 29KB
                                  • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_bs.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_bs.dll
                                  • Size 28KB
                                  • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_ca-Es-VALENCIA.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                  • Size 29KB
                                  • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_ca.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_ca.dll
                                  • Size 30KB
                                  • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_cs.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_cs.dll
                                  • Size 28KB
                                  • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_cy.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_cy.dll
                                  • Size 28KB
                                  • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_da.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_da.dll
                                  • Size 28KB
                                  • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_de.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_de.dll
                                  • Size 30KB
                                  • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_el.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_el.dll
                                  • Size 30KB
                                  • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_en-GB.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_en-GB.dll
                                  • Size 27KB
                                  • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_en.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_en.dll
                                  • Size 27KB
                                  • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_es-419.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_es-419.dll
                                  • Size 29KB
                                  • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_es.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_es.dll
                                  • Size 28KB
                                  • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_et.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_et.dll
                                  • Size 28KB
                                  • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_eu.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_eu.dll
                                  • Size 28KB
                                  • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_fa.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_fa.dll
                                  • Size 27KB
                                  • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_fi.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_fi.dll
                                  • Size 28KB
                                  • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_fil.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_fil.dll
                                  • Size 29KB
                                  • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_fr-CA.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_fr-CA.dll
                                  • Size 30KB
                                  • SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  msedgeupdateres_fr.dll
                                  • Path C:\Program Files (x86)\Microsoft\Temp\EUA3F1.tmp\msedgeupdateres_fr.dll
                                  • Size 30KB
                                  • SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  RobloxStudioLauncherBeta.exe
                                  • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
                                  • Size 2.6MB
                                  • SHA256 961c981271fe8a7f1788009aac6a0cdf9d146db6960331dc66f066df196a1704
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  RobloxPlayerInstaller.exe
                                  • Path C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\RobloxPlayerInstaller.exe
                                  • Size 4.6MB
                                  • SHA256 59d38c97fc77419c8d944fda0185c145f3da9e83b30db423c6e5ca24991a69f5
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MicrosoftEdgeWebview2Setup.exe
                                  • Path C:\Program Files (x86)\Roblox\Versions\version-bca459bcd1854ce4\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                  • Size 1.5MB
                                  • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  settings.dat
                                  • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                                  • Size 280B
                                  • SHA256 31b92975997360df5fad8e75980699f3defebb9f0714d65c609f2b33613fc012
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MicrosoftEdgeUpdate.log
                                  • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                  • Size 100KB
                                  • SHA256 f5624beddb88ef8de28c6b69553a3777bba5224af5752988c827a0c5a0c81857
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  f6df454f0107a0f1da33315f80588f09.part
                                  • Path C:\ProgramData\Roblox\Downloads\roblox-player\f6df454f0107a0f1da33315f80588f09.part
                                  • Size 1.9MB
                                  • SHA256 fac697376162d21609b69a2d424513bf055f22c3b4155b366f8a42ab4a0e2181
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
                                  • Size 2KB
                                  • SHA256 06afcdd746b7d79c8929ae2f1dd7b5ce521bd7becd1fdfe221c9474627239c5f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
                                  • Size 472B
                                  • SHA256 4c9081bd74c03fbb94132be2cab99ddcdf7eac4f725ffca0410fb1f94d934818
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                  • Size 1KB
                                  • SHA256 3f879c752b2b6fd1780fff51751dd579b607e272b5e4146dcc62cb77f2d0d3ae
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                  • Size 1KB
                                  • SHA256 41f0a1b15dd35c2d25442b17bf16602cdaddbea176765b01e8633b20c7edd544
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                  • Size 471B
                                  • SHA256 eb4c7cd497cbca2d59d1c79c4f7118d7bd6c68d74784560869d4b06610015752
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                  • Size 2KB
                                  • SHA256 78fb1851962d25ea4783b7dc96a3413ea9b090a58c01c7e25974245a207ef345
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                  • Size 1KB
                                  • SHA256 b2e07ff5d35cce2844f3e9029b194cbfe22c5dfd715e9763c1416cdd106ddaaa
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
                                  • Size 488B
                                  • SHA256 f419111b51e5ae5f7067e74261074d10c355040c0ea90469febcfbaa08286f8a
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
                                  • Size 492B
                                  • SHA256 bf07eb4decf3899ef3865940d9ca3ce3bb40813a8ea0afc1d824fb2cc0d3376e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                  • Size 434B
                                  • SHA256 f371c669628284d8fc71fb3fe2bd674a3c94f55bb2d3869c08bceb918f3f8539
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                  • Size 482B
                                  • SHA256 48090094a775b9cda6e735dd2d765c1257afb19c3df3c63334370b97e19c4f88
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                  • Size 400B
                                  • SHA256 ba3cc3d683e58686500b679c985f11c7ba9e1ed9fbcdd5e1b1c89f52500a2bea
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                  • Size 458B
                                  • SHA256 71946c9dd460bd9cc7ad618e6317ae66dc6218ca560ab411a43fbf084ca18fe5
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                  • Size 432B
                                  • SHA256 bd22dfb1171d814c70d8d1abb49859be87600033cde54b45e57762ac035ad124
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  • Size 152B
                                  • SHA256 1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  • Size 152B
                                  • SHA256 05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                  • Size 522B
                                  • SHA256 8aef3cd354de2f95b74460488573ac49244e6149ab46f0a4bb3e779b7a5c64bc
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  • Size 6KB
                                  • SHA256 f88acddc0a2ba649f89d8284fa64b3893d4831c2092219fe816b93e5e9f2f132
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  • Size 6KB
                                  • SHA256 0329790eee7d715df8baabe69d474520eac34ddb70601a33d3ede8c269f0ec3b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  • Size 11KB
                                  • SHA256 747797bddfd8f0570f58d4fd860b4065ab66e2a189238ffc3637265f791ba550
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  OneDriveSetup.exe
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                  • Size 40.2MB
                                  • SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  PreSignInSettingsConfig.json
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                                  • Size 63KB
                                  • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  BatchIncrement[1].json
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\BatchIncrement[1].json
                                  • Size 163B
                                  • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-configs[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\version-31b6bb6f63a8412c-content-configs[1].zip
                                  • Size 44KB
                                  • SHA256 dfd9028a64d441debc9b4b77c67b8679098de33f93db34136767a31e09a56038
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-fonts[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\version-31b6bb6f63a8412c-content-fonts[1].zip
                                  • Size 5.8MB
                                  • SHA256 0ff1251fc69cbc49b43b26b68762f021403bce80be7777bb02e1ca4903c8aaee
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-textures3[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\version-31b6bb6f63a8412c-content-textures3[1].zip
                                  • Size 12.6MB
                                  • SHA256 6955aaf07a6579c106b0e89574bec6b5c755a7bd30eaab76943824597bb1ceae
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-bca459bcd1854ce4-rbxPkgManifest[1].txt
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\version-bca459bcd1854ce4-rbxPkgManifest[1].txt
                                  • Size 1KB
                                  • SHA256 06a58dd97b13a8c5be129e14afadec374ec8e95a7762257abaa36383d71ec3f2
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  WindowsStudio64[1].json
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2ZG7H8ZF\WindowsStudio64[1].json
                                  • Size 119B
                                  • SHA256 3512f87352efaa8413dddc90334a534c2a9ee82cd32f09c9bae8f572865d97b0
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-models[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2ZG7H8ZF\version-31b6bb6f63a8412c-content-models[1].zip
                                  • Size 477KB
                                  • SHA256 62aa5700df088d8850c4055313ad87e59f8c68cb354b5266f9877e13fd0f68ef
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-bca459bcd1854ce4-rbxBootstrapperPkgManifest[1].txt
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2ZG7H8ZF\version-bca459bcd1854ce4-rbxBootstrapperPkgManifest[1].txt
                                  • Size 82B
                                  • SHA256 310cbca9c0772d8e4960f8f0be76c9753e59092113e75d83ca30ae295f0d6c8e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  RobloxPlayerLauncher[1].exe
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GP57WU1M\RobloxPlayerLauncher[1].exe
                                  • Size 4.2MB
                                  • SHA256 8a3c947289f5178a746979376d32f4488bb94c572ae22badcbf638bf618b4d32
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  WindowsPlayer[1].json
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GP57WU1M\WindowsPlayer[1].json
                                  • Size 119B
                                  • SHA256 8139227d376232bff9c51aad37468a378b576a0552b0038d410da017e88a5532
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-avatar[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GP57WU1M\version-31b6bb6f63a8412c-content-avatar[1].zip
                                  • Size 493KB
                                  • SHA256 73362c8c6d138714e684d7364967220cdc0e9e2b060781870ef1b95b3f00edcd
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-terrain[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GP57WU1M\version-31b6bb6f63a8412c-content-terrain[1].zip
                                  • Size 1024KB
                                  • SHA256 fa1ac381d5dceaa02de72850f24b41bfa9638c225db05d4ee93bb3e4280249c6
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-textures2[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GP57WU1M\version-31b6bb6f63a8412c-content-textures2[1].zip
                                  • Size 2.5MB
                                  • SHA256 57a596895812443e1b34b976b627b3097d3e820cf9850e300fa769e82cabbcee
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  PCClientBootstrapper[1].json
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y4F2DR2Q\PCClientBootstrapper[1].json
                                  • Size 5KB
                                  • SHA256 ce12303bb66935b3430add332c70de588ecdbe5fe8cab295eb35942095e1a6dd
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  update100[1].xml
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y4F2DR2Q\update100[1].xml
                                  • Size 726B
                                  • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-sky[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y4F2DR2Q\version-31b6bb6f63a8412c-content-sky[1].zip
                                  • Size 2.3MB
                                  • SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-31b6bb6f63a8412c-content-sounds[1].zip
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y4F2DR2Q\version-31b6bb6f63a8412c-content-sounds[1].zip
                                  • Size 364KB
                                  • SHA256 c21c2ef75edef71ea53dd1fed5470cfa3d513d22f8cdfdf2431e43fe8ff4c95a
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  version-bca459bcd1854ce4-rbxInstallerPkgManifest[1].txt
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y4F2DR2Q\version-bca459bcd1854ce4-rbxInstallerPkgManifest[1].txt
                                  • Size 83B
                                  • SHA256 1d3f36d77620e403f30e5ac619b882e4a02f0be48276f0b48e9b3e986f2ed2ed
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  RobloxPlayerLauncher.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\RBX-CA47DD4A\RobloxPlayerLauncher.exe
                                  • Size 5.0MB
                                  • SHA256 f1c39623997dc5dc06d24f83e4accc4a36995b18c6ba7b9622b2bd07f3f2dbc4
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  RBX-E3B54CE9.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RBX-E3B54CE9.tmp
                                  • Size 4.7MB
                                  • SHA256 e1752d7e4eafc3170c97548b6d2b6f7362db91e490e6076eae76a303582b452c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
                                  • Size 40B
                                  • SHA256 98c5d0fce407b0dec0634276e8cbb552cbf3c3ada1542148cad74208f51200b1
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  memory/1712-541-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-542-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-552-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-553-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-554-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-548-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-558-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-559-0x00007FFD46340000-0x00007FFD46350000-memory.dmp
                                  Download

                                  memory/1712-560-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-564-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-549-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-565-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-570-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-576-0x00007FFD46340000-0x00007FFD46350000-memory.dmp
                                  Download

                                  memory/1712-575-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-579-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-544-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-580-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-581-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-584-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-545-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-588-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-589-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-543-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1712-613-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-614-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-615-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-616-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
                                  Download

                                  memory/1712-617-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1936-629-0x000001CAB96D0000-0x000001CAB96D1000-memory.dmp
                                  Download

                                  memory/1936-630-0x00007FFD88430000-0x00007FFD88440000-memory.dmp
                                  Download

                                  memory/1936-631-0x00007FFD88430000-0x00007FFD88440000-memory.dmp
                                  Download

                                  memory/1936-632-0x00007FFD88540000-0x00007FFD88550000-memory.dmp
                                  Download

                                  memory/1936-633-0x00007FFD88540000-0x00007FFD88550000-memory.dmp
                                  Download

                                  memory/1936-634-0x00007FFD88590000-0x00007FFD885C0000-memory.dmp
                                  Download

                                  memory/1936-636-0x00007FFD88590000-0x00007FFD885C0000-memory.dmp
                                  Download

                                  memory/1936-637-0x00007FFD88590000-0x00007FFD885C0000-memory.dmp
                                  Download

                                  memory/1936-635-0x00007FFD88590000-0x00007FFD885C0000-memory.dmp
                                  Download

                                  memory/1936-638-0x00007FFD88590000-0x00007FFD885C0000-memory.dmp
                                  Download

                                  memory/1936-639-0x00007FFD88620000-0x00007FFD88625000-memory.dmp
                                  Download

                                  memory/1936-640-0x00007FFD87C30000-0x00007FFD87C40000-memory.dmp
                                  Download

                                  memory/1936-641-0x00007FFD87C30000-0x00007FFD87C40000-memory.dmp
                                  Download

                                  memory/1936-642-0x00007FFD87CC0000-0x00007FFD87CD0000-memory.dmp
                                  Download

                                  memory/1936-643-0x00007FFD87CC0000-0x00007FFD87CD0000-memory.dmp
                                  Download

                                  memory/1936-645-0x00007FFD87CE0000-0x00007FFD87CF0000-memory.dmp
                                  Download

                                  memory/1936-646-0x00007FFD87CE0000-0x00007FFD87CF0000-memory.dmp
                                  Download

                                  memory/1936-647-0x00007FFD87CE0000-0x00007FFD87CF0000-memory.dmp
                                  Download

                                  memory/1936-644-0x00007FFD87CE0000-0x00007FFD87CF0000-memory.dmp
                                  Download

                                  memory/1936-648-0x00007FFD87CE0000-0x00007FFD87CF0000-memory.dmp
                                  Download

                                  memory/1936-650-0x00007FFD85F70000-0x00007FFD85F80000-memory.dmp
                                  Download

                                  memory/1936-651-0x00007FFD86080000-0x00007FFD86090000-memory.dmp
                                  Download

                                  memory/1936-652-0x00007FFD86080000-0x00007FFD86090000-memory.dmp
                                  Download

                                  memory/1936-649-0x00007FFD85F70000-0x00007FFD85F80000-memory.dmp
                                  Download

                                  memory/1936-654-0x00007FFD88420000-0x00007FFD88421000-memory.dmp
                                  Download

                                  memory/1936-655-0x00007FFD861F0000-0x00007FFD86220000-memory.dmp
                                  Download

                                  memory/1936-653-0x00007FFD861F0000-0x00007FFD86220000-memory.dmp
                                  Download

                                  memory/1936-656-0x00007FFD861F0000-0x00007FFD86220000-memory.dmp
                                  Download

                                  memory/1936-657-0x00007FFD861F0000-0x00007FFD86220000-memory.dmp
                                  Download

                                  memory/1936-658-0x00007FFD861F0000-0x00007FFD86220000-memory.dmp
                                  Download

                                  memory/1936-660-0x00007FFD88290000-0x00007FFD882A0000-memory.dmp
                                  Download

                                  memory/1936-662-0x00007FFD88340000-0x00007FFD8834E000-memory.dmp
                                  Download

                                  memory/1936-661-0x00007FFD88340000-0x00007FFD8834E000-memory.dmp
                                  Download

                                  memory/1936-663-0x00007FFD88340000-0x00007FFD8834E000-memory.dmp
                                  Download

                                  memory/1936-659-0x00007FFD88290000-0x00007FFD882A0000-memory.dmp
                                  Download

                                  memory/1936-665-0x00007FFD88340000-0x00007FFD8834E000-memory.dmp
                                  Download

                                  memory/1936-664-0x00007FFD88340000-0x00007FFD8834E000-memory.dmp
                                  Download

                                  memory/1936-667-0x00007FFD876C0000-0x00007FFD876D0000-memory.dmp
                                  Download

                                  memory/1936-666-0x00007FFD876C0000-0x00007FFD876D0000-memory.dmp
                                  Download

                                  memory/1936-710-0x000001CAB96D0000-0x000001CAB96D1000-memory.dmp
                                  Download

                                  memory/3468-506-0x000001779FE80000-0x000001779FE81000-memory.dmp
                                  Download

                                  memory/3468-505-0x000001779FE80000-0x000001779FE81000-memory.dmp
                                  Download

                                  memory/3468-504-0x000001779FE70000-0x000001779FE71000-memory.dmp
                                  Download

                                  memory/3468-503-0x000001779FE70000-0x000001779FE71000-memory.dmp
                                  Download

                                  memory/3468-502-0x000001779FDE0000-0x000001779FDE1000-memory.dmp
                                  Download

                                  memory/3468-500-0x000001779FDE0000-0x000001779FDE1000-memory.dmp
                                  Download

                                  memory/3468-498-0x000001779FD60000-0x000001779FD61000-memory.dmp
                                  Download

                                  memory/3468-491-0x0000017797AA0000-0x0000017797AB0000-memory.dmp
                                  Download

                                  memory/3468-487-0x0000017797A60000-0x0000017797A70000-memory.dmp
                                  Download