Resubmissions

17-06-2024 18:20

240617-wyp7asshqq 8

17-06-2024 18:15

240617-wv4khssgrq 8

17-06-2024 17:50

240617-weqzgsxhna 4

Analysis

  • max time kernel
    124s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 18:20

General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • MD5

    88e64ec3895db7e1dadeb7e28a149642

  • SHA1

    b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c

  • SHA256

    6408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26

  • SHA512

    f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb

  • SSDEEP

    49152:GrihbF2YzW7juDDUrEC19YTl10auIyhhTxHMOPMQ3d2y7TMb64:84bF2P7jukrEWo1fbB

Malware Config

Signatures

  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers COM server for autorun 1 TTPs 31 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=142432bbee131ec1e680ff4280b83f65c7d4b91b --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5e4,0x5e8,0x5ec,0x5c0,0x5f4,0x6c0af4,0x6c0b04,0x6c0b14
      2⤵
      • Modifies system certificate store
      PID:2620
    • C:\Users\Admin\AppData\Local\Temp\RBX-7EA08C19\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RBX-7EA08C19\RobloxPlayerLauncher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Users\Admin\AppData\Local\Temp\RBX-7EA08C19\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RBX-7EA08C19\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=77fd10a5666de7b3dc8645f83badf8f3caf91a16 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c0,0x5c4,0x5c8,0x59c,0x5d0,0x1acc644,0x1acc654,0x1acc664
        3⤵
        • Executes dropped EXE
        PID:1612
      • C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        MicrosoftEdgeWebview2Setup.exe /silent /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Sets file execution options in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:800
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1868
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2996
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:912
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2312
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUIzQTBGRjMtMDk0Ni00OEFGLUE4OTgtM0VDQjYxN0U3RTcxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRjUwQzJDQy01MzMwLTQ0N0ItQjczNC1BRTM0RThFOTcxNTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjYyMTM5ODAwMCIgaW5zdGFsbF90aW1lX21zPSIxNzE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Modifies system certificate store
            PID:1532
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{EB3A0FF3-0946-48AF-A898-3ECB617E7E71}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:676
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    PID:1092
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUIzQTBGRjMtMDk0Ni00OEFGLUE4OTgtM0VDQjYxN0U3RTcxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RkMzRTEwRC04MDlELTQxQzAtQjg2NS1GNjJDNEYwMUEwNTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI2MjQ2NzgwMDAiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:2280
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2C7C471-5D70-4C09-9224-9BDE82A440C0}\MicrosoftEdge_X64_109.0.1518.140.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2C7C471-5D70-4C09-9224-9BDE82A440C0}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2168
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2C7C471-5D70-4C09-9224-9BDE82A440C0}\EDGEMITMP_2CEB2.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2C7C471-5D70-4C09-9224-9BDE82A440C0}\EDGEMITMP_2CEB2.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2C7C471-5D70-4C09-9224-9BDE82A440C0}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        PID:1028
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUIzQTBGRjMtMDk0Ni00OEFGLUE4OTgtM0VDQjYxN0U3RTcxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NUMwRjUxRS1CNzE3LTRERTktQjYwQi1FRERERTBEM0Y5RUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuMTUxOC4xNDAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI5NzYwNDgwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyOTc2MTQ4MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzE4MTA0ODAwMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMGM0MDg0ZjMtMWJlZC00MjQ2LWI4ZWQtMjA2Y2NiZTYwZTNjP1AxPTE3MTkyNTMzMDYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VFclMmI3Q2FxTSUyZkZIZGhVdXlYWkslMmZIOXFwSTZzJTJmWXRqeWdJVTI5NFR4U04lMmYyWCUyZkQ4SjNMUHRsSXF0WDVyZ05SRDNOeEJkY0Z5dm5qcFkzMHBmNENxUnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNDA2OTYwMDgiIHRvdGFsPSIxNDA2OTYwMDgiIGRvd25sb2FkX3RpbWVfbXM9IjE3MzYzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzE4MTI4ODAwMCIgc291cmNlX3VybF9pbmRleD0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxOTcyNzgwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MDkiIHN5c3RlbV91cHRpbWVfdGlja3M9IjM0MDM4ODgwMDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1ODYwIiBkb3dubG9hZF90aW1lX21zPSIyMDUwMiIgZG93bmxvYWRlZD0iMTQwNjk2MDA4IiB0b3RhbD0iMTQwNjk2MDA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIyMDY1MSIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source1028_1720057240\109.0.1518.140\Installer\msedge_7z.data

    Filesize

    3KB

    MD5

    bd70ed26e6e6f3193043ac09c58c6a1c

    SHA1

    d733a65e17f2851d5116598dd80533efc1656468

    SHA256

    7a474217d20b9a6fe3c3a46c0d6d5b2d2040fa790663f6da9202ee7cb07bb448

    SHA512

    3e2ecade6d687b0736d5eafd7527b24095b9c51f0c8ba99398b23da2d8843c49fc8c1fa37190d385b504d8224c8c517d78d44ae32e10e45d54b19477a6970756

  • C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source1028_1720057240\109.0.1518.140\Installer\setup.exe

    Filesize

    3.8MB

    MD5

    3a92a61a6e01c80ecc7d9499abb901b7

    SHA1

    d89d05802d937f9c71ced14282b8a19623fca7c8

    SHA256

    b70b2ed82c7afde8003983992b74f8182f55080b43da3d96dd29e8c0c7e8b47e

    SHA512

    3867efbd984ddd1eec084c70a42104cbc0057c3bed222af8963051779b612b46bf4cea3311452f6564513d7558d49a1e66a9473ad53f1b2fb4c43a9d7d0fb47d

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\EdgeUpdate.dat

    Filesize

    12KB

    MD5

    369bbc37cff290adb8963dc5e518b9b8

    SHA1

    de0ef569f7ef55032e4b18d3a03542cc2bbac191

    SHA256

    3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

    SHA512

    4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeComRegisterShellARM64.exe

    Filesize

    179KB

    MD5

    7a160c6016922713345454265807f08d

    SHA1

    e36ee184edd449252eb2dfd3016d5b0d2edad3c6

    SHA256

    35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

    SHA512

    c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeUpdate.exe

    Filesize

    201KB

    MD5

    4dc57ab56e37cd05e81f0d8aaafc5179

    SHA1

    494a90728d7680f979b0ad87f09b5b58f16d1cd5

    SHA256

    87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

    SHA512

    320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

    Filesize

    212KB

    MD5

    60dba9b06b56e58f5aea1a4149c743d2

    SHA1

    a7e456acf64dd99ca30259cf45b88cf2515a69b3

    SHA256

    4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

    SHA512

    e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\MicrosoftEdgeUpdateCore.exe

    Filesize

    257KB

    MD5

    c044dcfa4d518df8fc9d4a161d49cece

    SHA1

    91bd4e933b22c010454fd6d3e3b042ab6e8b2149

    SHA256

    9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

    SHA512

    f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\NOTICE.TXT

    Filesize

    4KB

    MD5

    6dd5bf0743f2366a0bdd37e302783bcd

    SHA1

    e5ff6e044c40c02b1fc78304804fe1f993fed2e6

    SHA256

    91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

    SHA512

    f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdate.dll

    Filesize

    2.0MB

    MD5

    965b3af7886e7bf6584488658c050ca2

    SHA1

    72daabdde7cd500c483d0eeecb1bd19708f8e4a5

    SHA256

    d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

    SHA512

    1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_af.dll

    Filesize

    28KB

    MD5

    567aec2d42d02675eb515bbd852be7db

    SHA1

    66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

    SHA256

    a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

    SHA512

    3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_am.dll

    Filesize

    24KB

    MD5

    f6c1324070b6c4e2a8f8921652bfbdfa

    SHA1

    988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

    SHA256

    986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

    SHA512

    63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_ar.dll

    Filesize

    26KB

    MD5

    570efe7aa117a1f98c7a682f8112cb6d

    SHA1

    536e7c49e24e9aa068a021a8f258e3e4e69fa64f

    SHA256

    e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

    SHA512

    5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_as.dll

    Filesize

    28KB

    MD5

    a8d3210e34bf6f63a35590245c16bc1b

    SHA1

    f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

    SHA256

    3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

    SHA512

    6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_az.dll

    Filesize

    29KB

    MD5

    7937c407ebe21170daf0975779f1aa49

    SHA1

    4c2a40e76209abd2492dfaaf65ef24de72291346

    SHA256

    5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

    SHA512

    8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_bg.dll

    Filesize

    29KB

    MD5

    8375b1b756b2a74a12def575351e6bbd

    SHA1

    802ec096425dc1cab723d4cf2fd1a868315d3727

    SHA256

    a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

    SHA512

    aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_bn-IN.dll

    Filesize

    29KB

    MD5

    a94cf5e8b1708a43393263a33e739edd

    SHA1

    1068868bdc271a52aaae6f749028ed3170b09cce

    SHA256

    5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

    SHA512

    920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_bn.dll

    Filesize

    29KB

    MD5

    7dc58c4e27eaf84ae9984cff2cc16235

    SHA1

    3f53499ddc487658932a8c2bcf562ba32afd3bda

    SHA256

    e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

    SHA512

    bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_bs.dll

    Filesize

    28KB

    MD5

    e338dccaa43962697db9f67e0265a3fc

    SHA1

    4c6c327efc12d21c4299df7b97bf2c45840e0d83

    SHA256

    99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

    SHA512

    e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

    Filesize

    29KB

    MD5

    2929e8d496d95739f207b9f59b13f925

    SHA1

    7c1c574194d9e31ca91e2a21a5c671e5e95c734c

    SHA256

    2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

    SHA512

    ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_ca.dll

    Filesize

    30KB

    MD5

    39551d8d284c108a17dc5f74a7084bb5

    SHA1

    6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

    SHA256

    8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

    SHA512

    6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_cs.dll

    Filesize

    28KB

    MD5

    16c84ad1222284f40968a851f541d6bb

    SHA1

    bc26d50e15ccaed6a5fbe801943117269b3b8e6b

    SHA256

    e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

    SHA512

    d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_cy.dll

    Filesize

    28KB

    MD5

    34d991980016595b803d212dc356d765

    SHA1

    e3a35df6488c3463c2a7adf89029e1dd8308f816

    SHA256

    252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

    SHA512

    8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_da.dll

    Filesize

    28KB

    MD5

    d34380d302b16eab40d5b63cfb4ed0fe

    SHA1

    1d3047119e353a55dc215666f2b7b69f0ede775b

    SHA256

    fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

    SHA512

    45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_de.dll

    Filesize

    30KB

    MD5

    aab01f0d7bdc51b190f27ce58701c1da

    SHA1

    1a21aabab0875651efd974100a81cda52c462997

    SHA256

    061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

    SHA512

    5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_el.dll

    Filesize

    30KB

    MD5

    ac275b6e825c3bd87d96b52eac36c0f6

    SHA1

    29e537d81f5d997285b62cd2efea088c3284d18f

    SHA256

    223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

    SHA512

    bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_en-GB.dll

    Filesize

    27KB

    MD5

    d749e093f263244d276b6ffcf4ef4b42

    SHA1

    69f024c769632cdbb019943552bac5281d4cbe05

    SHA256

    fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

    SHA512

    48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_es-419.dll

    Filesize

    29KB

    MD5

    28fefc59008ef0325682a0611f8dba70

    SHA1

    f528803c731c11d8d92c5660cb4125c26bb75265

    SHA256

    55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

    SHA512

    2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

  • C:\Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_es.dll

    Filesize

    28KB

    MD5

    9db7f66f9dc417ebba021bc45af5d34b

    SHA1

    6815318b05019f521d65f6046cf340ad88e40971

    SHA256

    e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

    SHA512

    943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

  • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

    Filesize

    5.7MB

    MD5

    3a1c8c167b820634f3bbc4f96fae1104

    SHA1

    486464c390105479c2fde43beeded6065008d2de

    SHA256

    24e52a3052fa8a75d93761062d5713e33b7597f1d843fb6246e21d3551319686

    SHA512

    8fe439587f5bf8e9fa17d7f9f4abe9bebd7a966843ec2bfcff215c30f9eff5c532e737b142763eef2ae19b70dd7a6c59ffe11483b289dfbd551f194522081109

  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

    Filesize

    14KB

    MD5

    c220f707c52be29259d73a4769c97f4f

    SHA1

    89a043643b2cc850967c15a4ab76e1a95884b427

    SHA256

    749a502d976f7ef997aee272e744e3dee267ed2f236a1f490c1b8e0a6579438f

    SHA512

    3abee8e00c76d2b7cc0a2c94df4268c99c04e44bc9896d64687b74556870f1a45cba3ecfecf0a5fb10415a4dcccca2bf01612461de14fd5f669ec5c9e1445711

  • C:\ProgramData\Roblox\Downloads\roblox-player\a0396f9bb5e0144808cc7c7fda47e682

    Filesize

    5.4MB

    MD5

    a0396f9bb5e0144808cc7c7fda47e682

    SHA1

    76bef1c55c6f288ca5988d344c4e92ee8f3a6329

    SHA256

    b5d35eaf2ca4befb5ac6de8680609c9a86fdc257b49d21ce4c8d17eddaa1b51a

    SHA512

    dd49140d4661d813501d67c44d5fedd6bdc7ce731242fb33973b0b7a5b603344682fe1bc393fcf9fe3f5ad10ed9f1de7dbc42c66ec16b84063fe535f288ab7e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

    Filesize

    2KB

    MD5

    818482961d2547a8bf3c30df557b1a7b

    SHA1

    84e5750a0fc823a8b8cd5d1869a5e706320cc6dd

    SHA256

    ed4decaeffe67498d499b84626466b2d981fc40311bd9cfa05b24ced28ebb7fb

    SHA512

    c499070ed48a80a3453a40aabaf08624a28f24ac4a97bdc99d499c80b4d24f818407d7e639a977187e53aa592f18de7d692710b822fde9adbafa72c4e8003924

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    ff67864dc6b74ccc0f26c0cb9dc6a7ea

    SHA1

    614159d21a6ffc589ec143ff2dd0ab091b35a697

    SHA256

    1fc41bcc619d5eac3b14f336d4f2f38a317685d292a73d6e7ff578ab3b3fd38e

    SHA512

    54103c0988b3d144f3b702fbf6cebd666eccf3fd4d359b9a757ae1d9d60146b98c7ec17280e28fb58a4a76adaf2ed75dafc20d4d01af38d7c0031b5d9dc77bf1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

    Filesize

    471B

    MD5

    b6d92cfcbc099f7156ef20e95a7da287

    SHA1

    f9c069f655bbe98434a102f4b55cc4c15e6f130a

    SHA256

    fdcbbaece93aa7c03134c24e24ff67d3670b5ba1274e3136bd1acd6a72e4355d

    SHA512

    08de310e3f6539c26f428c227a854752999df5547cb4bc70fcda0a96090bfbcb2f468b9ab90e42635252bad14c436ceb589c7148e488741a6150be5a53e1666a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

    Filesize

    488B

    MD5

    355ffbd9476076b579aa615bc516f5be

    SHA1

    5e4067906d891c15cacb343622aa86fc11d2f521

    SHA256

    5287c9c014a66560c67673199a2145cd864004dab02fc6a74bc3ea097a8e7bbc

    SHA512

    80930f92d4b968b668ee070b1cd5298f9c1c17a72ef475eff88fb9f56a723cc15d2436623a13936e834c15a8991e43316d325cc7b81458e6f622b7e76670b4c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80f9f74bce7302751d43f566d0d150fc

    SHA1

    068d0013782facc0ea005b0308d1573628300878

    SHA256

    528f50377f59851c6697cd6d9fc7165cee7f6db2d43d4da25f8e69ba3527d933

    SHA512

    c8dc1d8c6b606ef4835026428f9ccf2f370aa20001d8cadf056d5356210499426d12b7861277eb81a97e6b0419d4e0ed4e0b32afae0cf659d6b848c603182fbf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8cf65bb087d5a13101f2c68b850f1268

    SHA1

    dc1d61930df87cb4b972f1bdf7e451d602e9af8d

    SHA256

    2e01f0ccaf323a691fedf0fd833c90c5885b003aee1fef93e2511e1bb22d417c

    SHA512

    4403feed52fd1e229d9dc384585adc551788d6bb9ac351e80086aa7227ce318a6d5fc883f0ebd5967d8152631d2e297fbccc2c80ef8c4fac68a231c85b87a9a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    62e0b15576cd5f091510884b188957fd

    SHA1

    be2d6c148fa22ab06f6c7a4465474904c6592be6

    SHA256

    9ca8a85bd00f8e3759fe544b6ace5010ed816da339547da48ac2f39a89b6ab6d

    SHA512

    cfcecde4483a2d49ed6cde1825efa1218ba9ea669b1a794443a0c3a6ef60ba1467aaa9b146e0243bab1e7ba6af02e7ad933d73b8e1f39705a2915e40f131fda3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8ed5313c0e14056faae339b89ede4d93

    SHA1

    98666413fb49362a042ef49ac245bd7295d01fc3

    SHA256

    f2ae580d4f73b5bf691281a7e4afc6b380c9a11042e9c464fd191f36f8e2d3b2

    SHA512

    f19c0d64089074441214ea109dd6f06c1bd0c1ca6bdfd148344b219053c16a999fa297b77ce5c79f819249f4f6c711f719c852a77f382202556871fa770719a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f809d23b7aa2267d6ca8d46858da2076

    SHA1

    1ccb7a32ff874aa0a3a416c1bfc63cd3ebfd5999

    SHA256

    d8f81836f82b0577677f4ba0d37e368b116aa8485e752f10b4f1b2e441aa71b3

    SHA512

    887f9c7e9bd5ee9908cddbb271cdf0d2a811e60d8c5609e5955e480d2f843aa229f5a0dae1d9aea69e1b607554976c36eea212fce5ecf82f29fe090b003c1c0a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    2b6f320937f4e79ce70ec51ac983dcf5

    SHA1

    dd90bf55d9370a4455c4f6a7428d93d61fe7bb57

    SHA256

    e1701cb1986fbcc2e3335435299214c54bedf48ee2ed41adf6f9635d22f31bd0

    SHA512

    7e7ea2a1835d701e7565cc9cd848e04037b9a93acd6233169fc8bc97627431360179164538bc0ba515cad89cf127b5630a31c65bdde1d6284b767d6cb53c55d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

    Filesize

    400B

    MD5

    97bc1678112031eb7bfea12121998c5a

    SHA1

    ee60f9ef84d3fd9fef0874a8c2af3476a857e0ff

    SHA256

    9dc71d65e6742cdd87a04c4b75dd4913ce10779d0b9623fa1a7735093f10ca90

    SHA512

    b3a39ae3dd089af15928adfaf319d3fcc2ba3da1024cb56417ad9145aef4bca106884ee99f1c76f976d3573ce8718e503df8396393c6f29733a02c968906bde7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\PCClientBootstrapper[1].json

    Filesize

    7KB

    MD5

    8ad2367b2f98b68146460c5304708ce3

    SHA1

    85648bcfad18b7d588d007e2484d057fdd407cda

    SHA256

    b667158b9023cc6bc07eeb02bd7424da403d6b275ca74e2a7a5dab91690156ab

    SHA512

    329b75e591a9ae956d7be79a6cd5624424889b92af1892ce8681b3322c202a0ad6cc76e5d38eeb2ab2f3eaa0dd7cadaf26e353b91bc1acc27019a790bae9e968

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\BatchIncrement[1].json

    Filesize

    163B

    MD5

    bedbf7d7d69748886e9b48f45c75fbbe

    SHA1

    aa0789d89bfbd44ca1bffe83851af95b6afb012c

    SHA256

    b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

    SHA512

    7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\version-2cca5ed32b534b2a-rbxPkgManifest[1].txt

    Filesize

    1KB

    MD5

    d08bb2d668ca0f2c621396cac03abb8c

    SHA1

    fbb8a0f0379aa5769ba2cf8f76022712afbdb9d8

    SHA256

    c197bfed0103be1a957019bc5c7da9e7164afc35d23a369a20aa2bed97df3f6c

    SHA512

    003244713faffb4d92c9e99e14b17d1fbcbb70c564a85d8dda16098682b47f1ba8e138f4901c820d432dec1b577f14c806b7be2cf5278e71ad38ffb0d4648d8e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\WindowsPlayer[1].json

    Filesize

    119B

    MD5

    cd11b8912e30f083e6bcb6315215e4d8

    SHA1

    c336c4fcd380e54ae3c6c4642cb4bd5808db7ab7

    SHA256

    746ab1343ffb6ffe4e659d1191708845f3b055b68870e6faa0c9b131ef352c02

    SHA512

    f8a49dc9c95b8af253f921134d46a64f5e9c580bc2e63c0260a752243609076a5a827550797e9e29967141b067d980c83dab54c76f2ddf910e1f635e31bd09a6

  • C:\Users\Admin\AppData\Local\Temp\Cab7CDF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar7DC8.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

    Filesize

    40B

    MD5

    5aabedf3d18f06f577d9b00b3ef4c489

    SHA1

    e18cacd2f7961a4fc0f5bf4341b4a62fea64e947

    SHA256

    810205580ad8d738a5cb0e303f2410666a8669df49319a4614dab25bfa5ff0eb

    SHA512

    507eeac8271bd7167a9af947e88e15ae05ce718d4be83a247aa3c5b478df5bf3789883ba93da00f617dac99f7e5c25a593791a738dfb4eab42673ec394d7315a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\40L0YCSC.txt

    Filesize

    154B

    MD5

    1ea54bd1c9a10a8b6de877ff4e3a7453

    SHA1

    1a30e0b15d9b25515172b21cbb6e98d6f582870e

    SHA256

    07d4bb321ea6d8a70540e36255af682727fbba70d76ac32a4211180df52f99fd

    SHA512

    bdf241653d6e938762255d9eb9d7a2e80c091b686bd73147bddd9d236e4f36d8e724bbfb33c06d65d2a1e48a1dc0b2be171e7559a1c4f19231ae53f410097855

  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    af5d1d15e4f7ee76d6552c88919d60ee

    SHA1

    14bc03d92484672eaea5ac124295ec3c41ef1c0e

    SHA256

    2f331a4b308d4cedefdc291cc0d2f953cc6a1e95c52ab6939eab59530d86f9cb

    SHA512

    8d82a4baa17ed38342ef605f64a84a000ba0a256d6fdba3d473b4f99799bb31958b05638f8deaa61bedf6d567346f9e963a3f217a4fbc31fc572780b58722904

  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    216d8e1c830c744827952fb58ce925de

    SHA1

    025d02ad9b23b343a2be9a01cdba05cbbc6dc132

    SHA256

    6fe059fe7afa93c7632f8474d1242c69c2c27f2bbbcd0850b52424826e96dd38

    SHA512

    d0b11c68f3a13211b353e1702b848aee00ff23f08fa596fa20af1742526b270426aa52d53643dd299968391bb70f6a679a06add1bb5c417d67308e9e6bc3fa91

  • \Program Files (x86)\Microsoft\Temp\EUADA.tmp\msedgeupdateres_en.dll

    Filesize

    27KB

    MD5

    4a1e3cf488e998ef4d22ac25ccc520a5

    SHA1

    dc568a6e3c9465474ef0d761581c733b3371b1cd

    SHA256

    9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

    SHA512

    ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

  • \Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

    Filesize

    1.5MB

    MD5

    610b1b60dc8729bad759c92f82ee2804

    SHA1

    9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

    SHA256

    921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

    SHA512

    0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

  • \Users\Admin\AppData\Local\Temp\RBX-7EA08C19\RobloxPlayerLauncher.exe

    Filesize

    5.8MB

    MD5

    e602387055ae7b12c23fbeefeb417682

    SHA1

    4efa866cca9693eafb65a6babfebd64bf99037da

    SHA256

    8df68686863894e7f47069b854d07d6eb449269f527c09433495efb130f33dde

    SHA512

    87ee31aaf7929c3ef6ddad322727185efe0702f239d81eeda85ff0bc5c873316a660129aecc3bde5809de1449efd5de0f458db27610d126a69dddf35d38c27f3

  • memory/540-1008-0x0000000000C90000-0x0000000000CC5000-memory.dmp

    Filesize

    212KB

  • memory/540-2079-0x0000000000C90000-0x0000000000CC5000-memory.dmp

    Filesize

    212KB