63513b47a5c5626533fb3ecba890902e1bd058b611b3983b723283b60a3db4cd

Analysis

user interaction
yes
max time kernel
188s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxPlayerInstaller-6DQ6VGM86R.exe
Size 7.8MB
Sample260421-22a5fagy7v
SHA256 63513b47a5c5626533fb3ecba890902e1bd058b611b3983b723283b60a3db4cd
MD5 985dbb0d588feb902cb2a83e6f95cd35
SHA1 29fb3dfb638ef3f4e279d8631ccfbcacf2a42c49
SHA512 2f72005f88a9e403089479085157e78804042b249ce7db24ea0ddca5a5092cb4ac65714fa58109356c9fc7d57292ba323780caa407d96f8ef7b18e0f54b0da2c
SSDEEP 196608:z49JwosVkx1My1dL3UMh9SGONIClABlD2AN:zz+My3LzLSGOiCluPN
TLSH
T17286BE12FD40C061F9D201B2A6BD6FB65D7D9A341B3954D36BC44CA88A709D3363EB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4696	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2064	RobloxPlayerInstaller.exe
2716	RobloxPlayerBeta.exe
3004	RobloxPlayerInstaller.exe
1064	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
3672	RobloxPlayerBeta.exe

Loads dropped DLL 11 IoCs

pid	Process
4696	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2716	RobloxPlayerBeta.exe
1064	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
3672	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs

pid	Process
4696	RobloxPlayerBeta.exe
4696	RobloxPlayerBeta.exe
4696	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2716	RobloxPlayerBeta.exe
2716	RobloxPlayerBeta.exe
2716	RobloxPlayerBeta.exe
1064	RobloxPlayerBeta.exe
1064	RobloxPlayerBeta.exe
1064	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
3672	RobloxPlayerBeta.exe
3672	RobloxPlayerBeta.exe
3672	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\NetworkPause\no [email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\TopBar\inventoryOff.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\Unmuted100.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\PressStart2P-Regular.ttf	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\compositing\CompositExtraSlot1.mesh	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\PlatformContent\pc\textures\water\normal_06.dds	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\Thumbstick1Vertical.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\MenuBarIcons\RecordTab.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\PlatformContent\pc\textures\sky\indoor512_bk.tex	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\models\Licenses\Licenses.rbxm	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundDarkTheme.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick2Vertical.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\configs\DateTimeLocaleConfigs\en-nz.json	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\ButtonL3.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\UnFriend.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\MenuBarAssets\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\Unmuted0.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerLight\Unmuted20.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\StudioSharedUI\ready.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\ErrorPrompt\ShimmerOverlay.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\TenFoot\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\Unmuted0.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\TopBottomBorder.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\Auth\classind_12.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\NotoSansDevanagariUI-Regular.ttf	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_11.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\ic-group-16x16.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\icon_follower-16.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\particles\fire_alpha.dds	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\StudioSharedUI\RoundedRightBorder.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\ic-more-help.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\btn_grey.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\ButtonRightDown.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\MenuBar\icon_leave.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\models\Thumbnails\MakeupEnvironmentST1.rbxl	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\PlatformContent\pc\textures\water\normal_07.dds	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\ic-viewdetails-20x20.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\Cursors\DragDetector\HoverCursor.png	RobloxPlayerInstaller-6DQ6VGM86R.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\MenuBar\icon_safety_on.png	RobloxPlayerInstaller-6DQ6VGM86R.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	2064	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-6DQ6VGM86R.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-6DQ6VGM86R.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4e426689616b482d"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-6DQ6VGM86R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-6DQ6VGM86R.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4696	RobloxPlayerBeta.exe
3676	RobloxPlayerBeta.exe
4584	RobloxPlayerBeta.exe
3720	RobloxPlayerBeta.exe
2716	RobloxPlayerBeta.exe
1064	RobloxPlayerBeta.exe
4640	RobloxPlayerBeta.exe
4088	RobloxPlayerBeta.exe
3092	RobloxPlayerBeta.exe
4140	RobloxPlayerBeta.exe
3004	RobloxPlayerInstaller.exe
3004	RobloxPlayerInstaller.exe
3672	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4696	768	RobloxPlayerInstaller-6DQ6VGM86R.exe	80
PID 2064 wrote to memory of 3004	2064	RobloxPlayerInstaller.exe	99
PID 3004 wrote to memory of 3672	3004	RobloxPlayerInstaller.exe	117

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-6DQ6VGM86R.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-6DQ6VGM86R.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 768
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:460

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3720

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerInstaller.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxPlayerInstaller.exe
  C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxPlayerInstaller.exe -relaunch
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3004
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 812
  2⤵
  - Program crash
  PID:4328

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2064 -ip 2064
1⤵
PID:3208

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1064

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4088

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3092

C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.5MB
SHA256 bbf413a40c8aa3bfdf44167f12f40b12f7bf5428925ee5e628416601a4064ae4
MD5 d15b05f13cc22e65dff4ed6c0ea6a4f4
SHA1 7cb4025dbd9fa9dc229b1a327cde8a0c9ae27249
SHA512 1e82163e1603d93e9e2409432923043c329f653b36a12b284b8e1b5d6f92edad4022ace52315d85431e8d522db6e2a446cac1a8cfcde72cf0a158035d5c9ffe1
SSDEEP 196608:x4PQlojheOkR8jCp6VdGOEF6wIfE9nmRKa0BBsLQs:xwLkWGXF6VfE9nmRcBs
TLSH
T1F9A6CE12F940C031E9D202B2A6BDAFB65D7C99241B3944C767C45DBC4A705E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.dll
Size 15.5MB
SHA256 80e1c990de61dc21b61a9c3f978236bfe1266cd0cc09af4673f9d73d91b3d8c3
MD5 1cbd430b2924d0686d6dbbd0e3faf168
SHA1 08ea475fcdfc0463ddf3bf393c90d7081b6a1ec9
SHA512 5b8d3d1c8d8b370619b4719aa03efd17891cd647e2d595828c8e0a0830897eb72d5478641c792877973e86c2fbdc7add46167222eaae3ead55f31c6bc4e5de95
SSDEEP 98304:Kf/AG0tdGNAnLI7BPHfoR8pRLlXSyTN52m6iof2+5Q3NKGv4qyDDo7W7Pwi/qWND:Kw/WpnRLlJx+fL63Bz9i/qo
TLSH
T18CF6BE5EF4E249A8D0B24035E15F13D3EB12B0CC476C69F707AC51503AB369EAA19F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 2bd18237555d8203d4744e13321e6ee1d61792115dc3fc529f693215a2554ab1
MD5 1525de9c4708ad00d82a8e24c0ef29ec
SHA1 8bd916f2a987c64c8bd7c93b4a69d9d6a0cda392
SHA512 8ad4a158ce10ef703b516fba1e276402f1c1cd42c506f0a3be4c8e0373cb2408ca60afa085b2aa7463d9ef87a566f73eb91a47788f875e278d4b8b52968ce213
TLSH
T1D82197554FE71727F6A3DA3064F02A61FB73BD01FB682F2E048813891666105A678F3E
MD5 SHA1 SHA512 TLSH

Submit Download

02f51286ad7d2c206e063cd5dc4cd388

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\02f51286ad7d2c206e063cd5dc4cd388
Size 19.8MB
SHA256 6f6c60d1d93c9a6ca6ffad7effceca3963135c15c9d9b6a3da392d54855a6b0c
MD5 02f51286ad7d2c206e063cd5dc4cd388
SHA1 b1e434b5c9bfa782b8ab61e995c95e9f47654fd1
SHA512 e9698c802bf99cc168e4b32f9eb06936eb44e3962f308b3dc8f0e7d4912b04bffdf491028c326638d357f306262301715f43f8b4ec34672f5dc29b2a1c8b71b5
SSDEEP 393216:B4l6Gsr98NrKeU85S0oLkKs0AU30hBw1sUcexOW/kgbR0NqR9vV07mFML:Bc6Gsr9GrKP8rqvsZhBw1VkgbjR9vVN0
TLSH
T1D02733BA7B191BF699CFFCB45146C83883D54296D1B0B0EEB4149FC6BB547A83530E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

480479a41ac64f725d6c3415ae3b8116

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\480479a41ac64f725d6c3415ae3b8116
Size 775KB
SHA256 f42821a9b6647d7a185b12a9256931599a7986d1a54ba16437cff21235be2384
MD5 480479a41ac64f725d6c3415ae3b8116
SHA1 55af8193a5299b8916bbe21f9fb839eee89feb45
SHA512 5a8c7c9cd76e8f04da7e0fa7401a83176d4ac3c52580ff275ae28d61cda74c659521793c5d7abd252f0692ecebe664a87cf48c2fcd07469cc01edab3ad2b6a38
SSDEEP 24576:5GaCZAMrttFAmgH0ro5yOs2zfhPWqozMwd:qhtq+oDsuZPyp
TLSH
T119F4338323BA178DD4613F9A428498A351C1CFF9CB5DE5C7DE27A1C2222C1B4F59E45E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

558cc86017b96984705bf0afd6aae502

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\558cc86017b96984705bf0afd6aae502
Size 12.0MB
SHA256 afb42ea9b524fbb87fe9bf175d34652d0b9f099b64ff83010d2c4f1644538593
MD5 558cc86017b96984705bf0afd6aae502
SHA1 2a0a1ad92eda3c64c4bef70f81a66d8e8eccfa78
SHA512 86cfdb474187d2177801dbe4f10ef756f05c5bbee451697245ab0a560cfdd661a77408d7bd3b9c248267a2d6499ac32ebbb42bcba9a3c3d16d60b90dabe68e6b
SSDEEP 393216:FPthDcZegHBgwLGXpEQTG8P+2SwSgfWK/5KaK8f5:FVpcZew62gGel5SSnBKe
TLSH
T1BAD63386F360F8517435953BACD87878FB23FD2C44914A02DBCEEEEA7A760E4901DA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

568db50f7c97e2759a6501ae7dfc9fc9

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\568db50f7c97e2759a6501ae7dfc9fc9
Size 127KB
SHA256 c8b1b642274da2790a8c6c2d09361d17edb9701d30a54f429e275b8bb36f36f6
MD5 568db50f7c97e2759a6501ae7dfc9fc9
SHA1 6736cd9b9b10b54349375a052835ff3714a2d243
SHA512 e0e04751c3bf8670cb140ca3910dca2b497f68437b25713383702c49b045efd0214c392d2a551e5a434cfff25fb33bc237beaa420e4e5af98504c662595cd859
SSDEEP 3072:aV2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuGb:aYBqPRsnRq7Ybl+wX0k4
TLSH
T154D313783C789057E617E00621AF5273F53BC9D4A2B023D99A93D79721183F25773AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82bc6b24b20dc8539914bd2b6e4fc241

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\82bc6b24b20dc8539914bd2b6e4fc241
Size 273KB
SHA256 8e7e41ab1300471116fca3acd613297b9f5536498489166cb23082f94617f454
MD5 82bc6b24b20dc8539914bd2b6e4fc241
SHA1 1da8744b343f7d27deafa99e9daa87e4bf993efe
SHA512 f311672fcd93016574806df65d8ce28591f3141595d894e7685266ff58638291254b836e9158f110dfa2f88fdb05b14a53243fbba88923087b42ed0f532840e4
SSDEEP 6144:C7bhY6n1jjnGgBuN+NP+F/s7Caa8sjGOFisu:mxJGgBuRSTa3hFu
TLSH
T10A54233AE60619AFE609623AF4AA7033FEE807C30895900FF54790B5567F6CB5179EC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

890d44a898aceee375934726854337dc

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\890d44a898aceee375934726854337dc
Size 81KB
SHA256 ccbcd8c9d72282c9f447035310af151b4a4bf42dd93b6bb5f50b4f274a0e37cc
MD5 890d44a898aceee375934726854337dc
SHA1 6c809b39057cee3e7ef6b78fab029f5200f0140f
SHA512 ffbf3c310d3f743591703e4e77681e05658fb1179309eeaec1a9e35f6a17fef1458c96cb724b74d173951e51204ce36027dec1a5b2a9092d08a8e511a0aafe57
SSDEEP 1536:2vP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHh:8P9Z3Qb6+oj2oCv2UQ0e6DPh
TLSH
T1BC83125DF690E4BCE54759FA88208130C8DBDF9838DF51C0BBDA7685D9C4209F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cd0147e8c95ea0d033ee8753934b7e7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8cd0147e8c95ea0d033ee8753934b7e7
Size 352KB
SHA256 c95abab93d686533612248c9e1722d3e7a4973beb288656e64a4937bfe7aea44
MD5 8cd0147e8c95ea0d033ee8753934b7e7
SHA1 b4140ab2c2c48ac882b212f34fa6f0630345744e
SHA512 82a8f1bef6629727e3910021b466dc45549783b72774e44668b074147b506b6ef1e62772621c2e1bbd20561fe901bde7e094f4a221504043198b50cac672126b
SSDEEP 6144:KZ8Q4SITCxEKrNN5nwksyGwC2Sz8EBqvtKmAGdKQlkdGsAywKHWkkFBQs99:u8JSITGrndGyGkSzofADQqdG/SoEs99
TLSH
T1A274231497D18C8CA1CE797AC3FCD3B70168802E565AD5980D7C93FF83DE684A98E61D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97327884177381d0f42d428110b4c516

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
Size 3KB
SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
MD5 97327884177381d0f42d428110b4c516
SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
TLSH
T1CB616CDD8D95121BD31F963354055E668C7FAF2AC006224F30201C2ECC0AEDF9148B7E
MD5 SHA1 SHA512 TLSH

Submit Download

9fd48e078caade1dd3f491bfa6bf22cc

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\9fd48e078caade1dd3f491bfa6bf22cc
Size 3.0MB
SHA256 cd5b05c44a54d53e3af1bce00172a95dbf26102e2851caf16e5d6ba50dcdb19a
MD5 9fd48e078caade1dd3f491bfa6bf22cc
SHA1 ad88ea48efcbb94344fa14d89be94a5dc88af9fe
SHA512 aa575fd2c568c5ff0e39c53ff1c69d0903bf0bde80ccbc368056c64dacc1fc7ffb251acf1801069c05246d42f19722f1f5c22016046eac394e6da5f25946ac38
SSDEEP 49152:f7tugUPld/zOTf2DeICARo3VqeO4a1JPvxhZGc5jPqiaNpPMssONWP2vX:f7tu6f2z63VduJX0c5Dq/sOwc
TLSH
T1A8E53399E005314AE5277AB7A4B13E1098EA35A4FBB56F1FC6BDC2F058423DF1D262C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b64ef36b8ebc216e50a51a32b669f9cf

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b64ef36b8ebc216e50a51a32b669f9cf
Size 6.2MB
SHA256 a1176fe3fda96dd3aaa86ab5087fb6b950758f06cb0793e8fc5d9071ccea0b3d
MD5 b64ef36b8ebc216e50a51a32b669f9cf
SHA1 4df765ec55a5102fa05b4c4d4d14eec9d775c0c4
SHA512 e17b543b198ccacf40721248980c476df5985eb0fdfcba7e6bf321e9ea282e3c9d0ee9fe839152de580b80638367808752766c7995ad7393bcccefa472902f2d
SSDEEP 196608:XRZ7Rvm4Y1p/NK3KqufSicEsnWJ9Int84ZCVXl:BZ7Ru71prqJE9Cpq
TLSH
T1086633FAFE74093AD237AF3A3401A4526C258F5ADA14511F652A64B4EEC33879F032D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8276fda63ae903c0ce46407e88feaf7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c8276fda63ae903c0ce46407e88feaf7
Size 287KB
SHA256 65d5fcd279cfe17f1deb4c0a5a3354cfdf9eade28e37307617b751c945bfb955
MD5 c8276fda63ae903c0ce46407e88feaf7
SHA1 f8d989373324652fd1d3248ced791f9380b4c180
SHA512 7afbb225c7df2906b4034a1c107c5ee924ddf988a5bfb2e7e5d27c77e1b32e96e4c92407a197b9ddb7add5e0ed247d22a458c3b76a1e81a7813c93d1c096ba89
SSDEEP 6144:6vzbeEkFlF8j41G+uvUrx2lDiDWVVNys6OlgMyRWf2/1r:6vHQz8ZvSyVLQMyRWQ
TLSH
T1125412EBC40644BEC263E77B72FC7821824C68764206C85F6F6522B82F5B0D7571B2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9337cd8b2ac38fc3c0d4df61a357ce0

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c9337cd8b2ac38fc3c0d4df61a357ce0
Size 5.7MB
SHA256 1fdcfb4be1954900413226e59344bd316c509c8e81cb71af2c32bf019520a051
MD5 c9337cd8b2ac38fc3c0d4df61a357ce0
SHA1 5ec80f7d099e0a4441653826a9b54a4d6fe78e10
SHA512 0513369c5667e117ced40579c808c71a7230283db6bbff395292e8a5d9e0b2900f3ad099b1827c78754fbdfaa36d9adebeba7cffd01996dd448e703044adef66
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA1owp7PcA1VyzKSpPd7ibGGg5caGctpTR:Mg94jwoalYarlrG9P3VEmx7PcHf5xia/
TLSH
T1175633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D35D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3176abd001161c78b80319a08ab2d64

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d3176abd001161c78b80319a08ab2d64
Size 4.9MB
SHA256 4219391c7be1ff8731f901b808a606fbdf6fdf1be8d97595d793de231e1d2369
MD5 d3176abd001161c78b80319a08ab2d64
SHA1 5765571261906e871ade09aadc3f51c58f157e74
SHA512 17ad99d6ebaae8cc0239c02f243ed14f5471b31218de7484e51b3f6525ed968f55694117644740d6967c240f4c0acfff7a5a78daa3a86a12a282dda77337c0f2
SSDEEP 98304:CITdulYTFdExsVBJc5fqP6PP58ynUTufWGAtUcXoY4zx8g:DglYRYSitU6PB8iUT1vUT
TLSH
T1163612FAFF7D493DC177973D92029811AD68641A9A2CA50F0829AC71D9C36C3DB423F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f14a117a6724a150578518e88062eda7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f14a117a6724a150578518e88062eda7
Size 596KB
SHA256 bbe3617d0cad50797dc4524b4d8331a81bb27fe7ed781f3d10ebf2122dfdfda5
MD5 f14a117a6724a150578518e88062eda7
SHA1 d7b83c0b2d294a24b0a0a96228063308e852a927
SHA512 5fc02432e374ef983c1c4f104d87ae62c24ecbb44412f020507c3f9a49d42a63fb4f8fc3b5182fc17e5c1c465d7d04a56eb2bdeac509173e7044412bcbb948ca
SSDEEP 12288:YBEwJacdQk452gpGB7d1dYPfCfBT5/Y5/ZUxZ1nHPPbbEwq06P7w2PV8:YqwUcZ45DwaATNY5xUF7bfqrPx8
TLSH
T192D423270D4E7D5C6B3B2D9BF78944C3427097E121EBCBAA7B66354083287904F29DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f76b3613ebb7b9e0224e2d37c8519214

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f76b3613ebb7b9e0224e2d37c8519214
Size 9.5MB
SHA256 2979db026346f0652c943e169ab0b944829a3cf2311b97456f3a15a2d6b7e402
MD5 f76b3613ebb7b9e0224e2d37c8519214
SHA1 d6a1e838221862e5d1156db53d95b8d2c5103de6
SHA512 3ff2c9f26ef85e4122c3a09d8cb99e5bd7fc6d9e6c8afc7624a8d6413090741e7319f5df2e63d6bd45cc78961eef47f75f5454c54795fc040ef4f8d9d0ec8540
SSDEEP 196608:aYEq/UhCY/Kp567NdzDvIDrfyrgcErNYBElBcEFdCK:avVU+Dvarfy0cErNYyr1
TLSH
T154A6CF22F941C031E9D202B2A6BD6FB65D7C9A341B3948C767C45DB845305E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbb0ce7a795cad22ef0c116ae89f13d4

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fbb0ce7a795cad22ef0c116ae89f13d4
Size 433KB
SHA256 7041752f10d5275ef1021afa12523aa9f5e534c0a2ff87d6921c1f70cc68b534
MD5 fbb0ce7a795cad22ef0c116ae89f13d4
SHA1 de628b71de98250fff03f7ad881f476bd9304200
SHA512 d9a6243de237597a6e017cb22c6250cb9245a566f8479e1446c909f86d8e5d2725599b73c535dfd4415b797ec051792572909f32c0cfcbfacd0aba1ddb9345de
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglTCKmWTXU48aUB0o5Lw:kWajwpnZfyoJMCgl2Kmev8aUBz8
TLSH
T11C94234C5DB1ACABF415D3F98E709F8885007A4A8F5DBE4F147AB1EFA7012B05B9C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 84B
SHA256 a7d62d3f203e58020accb490b3dbfdb2b54ce13f942eab99867c03b1f0c67cec
MD5 c7119c9a5b718d25c509eeb04354a786
SHA1 619fb55c717dc5ac2c089baa2162f9db9d50a216
SHA512 9978abc046c5f912081d9eae135ff1c78572c7c88305434b4688a3de8a8df00494fdef81453aad8783f6f3d1d7b043f1d101644ad6e799d3f0b8b06f3a99970e
TLSH
T1A4A011C80B8000A8AA0B008BE83A0E33A30B2080A08203C2ECCA08CE28202030CC28CA
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 8b42b592b717977a17f3f6ee4eb4177a287f2ba2fc4d2032131f652154a73316
MD5 31703fcd3c09090fbc1c7ba58de03cf7
SHA1 7a873277f8d34dd49af4dd3d916497a67aedff43
SHA512 69f01bb41f08853d7b5661996cf46ba66304c74cbd78f90184c769ce9c9c9e289c7cd26840c6b55dff077ba910b22268a4107b5b3f7f417349546f04dab3f34d
TLSH
T1A7A0220023AB8830C8020020000208FC08328F028230000FA3A2C282AB202A02008283
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 d36bff26d1b7ec781ae2b509220e2dd045bd83999a0a12ea596c88c3a60b3aa5
MD5 7b449ddf2d867aaa21ff37732c438957
SHA1 234a4ee697bac89a9266a8f807c13db34169da7b
SHA512 f46ec15a4a169eaf34ff40a40a2edcff00753fcfd15652079dfaafccfd0bba5428c663d366ece027157ccb85858d21c08bc43805cf812c5baa21cd9271c8fb75
TLSH
T11D21CB514FE74627F5E3DA3064F02691FB33BD01BB282E2E048813495666109A67CF3E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-88-0x0000023164A10000-0x0000023164A41000-memory.dmp

Download

memory/768-33-0x0000000001E90000-0x0000000001EB5000-memory.dmp

Download

memory/768-79-0x0000000001E90000-0x0000000001EB5000-memory.dmp

Download

memory/1064-116-0x00000181081C0000-0x00000181081F1000-memory.dmp

Download

memory/1064-117-0x00000181097E0000-0x00000181097EC000-memory.dmp

Download

memory/2716-100-0x00000254E96E0000-0x00000254E96EC000-memory.dmp

Download

memory/2716-99-0x00000254E96A0000-0x00000254E96D1000-memory.dmp

Download

memory/3092-128-0x000001DD09150000-0x000001DD09181000-memory.dmp

Download

memory/3092-129-0x000001DD09190000-0x000001DD0919C000-memory.dmp

Download

memory/3672-176-0x000002AFB42F0000-0x000002AFB4321000-memory.dmp

Download

memory/3672-177-0x000002AFB5CE0000-0x000002AFB5CEC000-memory.dmp

Download

memory/3676-82-0x0000023007150000-0x0000023007181000-memory.dmp

Download

memory/3676-83-0x0000023007190000-0x000002300719C000-memory.dmp

Download

memory/3720-92-0x0000019DA51E0000-0x0000019DA51EC000-memory.dmp

Download

memory/3720-91-0x0000019DA3BC0000-0x0000019DA3BF1000-memory.dmp

Download

memory/4088-125-0x0000020060650000-0x000002006065C000-memory.dmp

Download

memory/4088-124-0x0000020060610000-0x0000020060641000-memory.dmp

Download

memory/4140-132-0x000001B257AC0000-0x000001B257AF1000-memory.dmp

Download

memory/4140-133-0x000001B2576E0000-0x000001B2576EC000-memory.dmp

Download

memory/4584-86-0x0000020B6A8C0000-0x0000020B6A8F1000-memory.dmp

Download

memory/4584-87-0x0000020B6BEE0000-0x0000020B6BEEC000-memory.dmp

Download

memory/4640-120-0x000002DB54EA0000-0x000002DB54ED1000-memory.dmp

Download

memory/4640-121-0x000002DB56480000-0x000002DB5648C000-memory.dmp

Download

memory/4696-75-0x000001C6BE600000-0x000001C6BE60C000-memory.dmp

Download

memory/4696-74-0x000001C6BD020000-0x000001C6BD051000-memory.dmp

Download