Analysis Overview
SHA256
27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54
Threat Level: Known bad
The file krnl_bootstrapper.exe was found to be: Known bad.
Malicious Activity Summary
Lumma Stealer
Downloads MZ/PE file
Sets file execution options in registry
Reads user/profile data of web browsers
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of NtCreateThreadExHideFromDebugger
Drops file in Program Files directory
Loads dropped DLL
Checks system information in the registry
Checks installed software on the system
Registers COM server for autorun
Executes dropped EXE
Program crash
Enumerates physical storage devices
Modifies system certificate store
Modifies data under HKEY_USERS
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-04-29 20:08
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-04-29 20:08
Reported
2023-04-29 20:16
Platform
win7-20230220-en
Max time kernel
401s
Max time network
403s
Command Line
Signatures
Lumma Stealer
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Loads dropped DLL
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: 35 | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: 35 | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Users\Admin\Documents\krnl\krnlss.exe
"C:\Users\Admin\Documents\krnl\krnlss.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdn.krnl.place | udp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 8.8.8.8:53 | k-storage.com | udp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | sslcom.repository.certum.pl | udp |
| NL | 95.101.74.146:80 | sslcom.repository.certum.pl | tcp |
Files
memory/1956-54-0x0000000001000000-0x000000000112A000-memory.dmp
memory/1956-55-0x0000000000AF0000-0x0000000000B30000-memory.dmp
memory/1956-57-0x0000000000360000-0x000000000036A000-memory.dmp
memory/1956-56-0x0000000000360000-0x000000000036A000-memory.dmp
memory/1956-58-0x0000000000AF0000-0x0000000000B30000-memory.dmp
memory/1956-59-0x0000000000C50000-0x0000000000C5A000-memory.dmp
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\Monaco.zip
| MD5 | 1a19fd7c42169c76e75e685dca02c190 |
| SHA1 | f16b4697bcd348d44965bf9ded731523db9bd606 |
| SHA256 | d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331 |
| SHA512 | 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4 |
\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\src.7z
| MD5 | 7c380ecd5bc2cd51511d0ee5b58df745 |
| SHA1 | 615749979477621579dd9b04ada8d4dcd9430f1e |
| SHA256 | 38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07 |
| SHA512 | 110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de |
memory/1956-154-0x0000000000AF0000-0x0000000000B30000-memory.dmp
memory/1956-328-0x0000000000360000-0x000000000036A000-memory.dmp
memory/1956-327-0x0000000000360000-0x000000000036A000-memory.dmp
C:\Users\Admin\Documents\krnl\krnlss.exe.config
| MD5 | 0ed4b3831ff5e91dff636145f68aac4c |
| SHA1 | 2d1140812945dc1b9e400a88c911803639cb2e49 |
| SHA256 | 03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347 |
| SHA512 | 4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
memory/1820-575-0x0000000001260000-0x00000000013E4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab7929.tmp
| MD5 | fc4666cbca561e864e7fdf883a9e6661 |
| SHA1 | 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5 |
| SHA256 | 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b |
| SHA512 | c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d |
C:\Users\Admin\AppData\Local\Temp\Tar797A.tmp
| MD5 | 73b4b714b42fc9a6aaefd0ae59adb009 |
| SHA1 | efdaffd5b0ad21913d22001d91bf6c19ecb4ac41 |
| SHA256 | c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd |
| SHA512 | 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 3ac860860707baaf32469fa7cc7c0192 |
| SHA1 | c33c2acdaba0e6fa41fd2f00f186804722477639 |
| SHA256 | d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904 |
| SHA512 | d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c |
C:\Users\Admin\AppData\Local\Temp\Tar8055.tmp
| MD5 | 4ff65ad929cd9a367680e0e5b1c08166 |
| SHA1 | c0af0d4396bd1f15c45f39d3b849ba444233b3a2 |
| SHA256 | c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6 |
| SHA512 | f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/1820-761-0x0000000000670000-0x00000000006AE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/1820-764-0x0000000000670000-0x00000000006AE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/1820-765-0x0000000001080000-0x00000000010C0000-memory.dmp
memory/1820-766-0x0000000005770000-0x000000000582A000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
memory/1820-770-0x00000000068C0000-0x0000000006A0D000-memory.dmp
memory/1820-773-0x00000000068C0000-0x0000000006A0D000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
memory/1820-782-0x0000000001100000-0x000000000110E000-memory.dmp
memory/1820-785-0x0000000001100000-0x000000000110E000-memory.dmp
memory/1820-789-0x0000000001250000-0x000000000125E000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
memory/1820-792-0x0000000001250000-0x000000000125E000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
memory/1820-796-0x0000000005830000-0x0000000005872000-memory.dmp
\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
memory/1820-797-0x0000000001080000-0x00000000010C0000-memory.dmp
memory/1820-799-0x0000000001080000-0x00000000010C0000-memory.dmp
memory/1820-798-0x0000000001080000-0x00000000010C0000-memory.dmp
C:\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
memory/1820-803-0x0000000007C20000-0x0000000007D74000-memory.dmp
\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll
| MD5 | 2ff7acfa80647ee46cc3c0e446327108 |
| SHA1 | c994820d03af722c244b046d1ee0967f1b5bc478 |
| SHA256 | 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d |
| SHA512 | 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd |
memory/1820-807-0x0000000001080000-0x00000000010C0000-memory.dmp
memory/1820-808-0x0000000001080000-0x00000000010C0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-04-29 20:08
Reported
2023-04-29 20:15
Platform
win10v2004-20230220-en
Max time kernel
374s
Max time network
428s
Command Line
Signatures
Lumma Stealer
Downloads MZ/PE file
Sets file execution options in registry
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\CatRoot2\dberr.txt | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Checks system information in the registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-40b180a4-1.2.0\NetworkingGames\networkRequests\createGetExperiencesPlayabilityStatus.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Collections\InstanceOf.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\language\parser.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\RoduxFriends\Reducers\Friends\requests\byUserId.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.5\JestUtil\createProcessObject.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-d86ebb2a-ca453478\ReactReconciler\ReactPortal.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppHooks\RobloxAppHooks\useUiModeInfo.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Cryo\Cryo\List\map.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-4ad47a93-d2d12716\ExperienceChat\BubbleChat\ChatBubble\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\error\__tests__\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsTile\getFooterRelevanceInfo.test.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\PremiumUpsellDeps.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Scheduler-a406e214-4230f473\Scheduler\TracingSubscriptions.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-948a3386-02a3ea83\RoduxFriends\Reducers\Friends\requests\receivedCount.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\Dev\TestUtils.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\content\textures\GameSettings\copy.png | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Rhodium\Rhodium\InputVisualizer.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\NetworkingPresence-1b011daa-31f6545b\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared-a406e214-4230f473\ReactDevtoolsShared\utils.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaApp\icons\[email protected] | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\ui\PlayerList\Report.png | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\UserCarousel\Components\UserCarouselContainer\init.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Squads\FloatingActionButton\init.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-42cf8478-4f9657ad\ExperienceChat\installReducer\ChatLayout\inputBarSettings.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-presence\lock.toml | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\UserSearch\jest.config.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\MaterialGenerator\Materials\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\particles\explosion01_core_main.dds | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-42cf8478-4f9657ad\ExperienceChat\installReducer\init.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.5\lock.toml | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Shared-d86ebb2a-ca453478\Shared\formatProdErrorMessage.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\tutils-aa9a0351-0.1.2\tutils\equalKey.spec.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\DiscoverabilityModal\Networking\FetchUserSettingsMetadata.test.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\installReducer\Friends.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\content\textures\StudioSharedUI\meshes.png | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RequestPipeline\Promise.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\StyleConsumer.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Style\Style\Themes\DarkTheme.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Style\Validator\validateThemedBackgroundImageInfo.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\JestCore\JestCore\lib\logDebugMessages.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageToast\MessageToast\MessageToast.storybook.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Localization\Localization\LocalizationContext.spec.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\msedgeupdateres_sr-Cyrl-RS.dll | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Template\DetailsPage\DetailsPageTemplate.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\Localization.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.64\Locales\az.pak | C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoactRodux\RoactRodux\connect.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\ui\Settings\Players\Blocked.png | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\QRCodeDisplay\QRCodeDisplay\DisplayQRCode\ecToNumber.test.lua | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-64af4154-868f23dc\RoduxAliases\Actions\init.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Shared-d86ebb2a-ca453478\Shared\PropMarkers\Tag.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Requests\ChatStartOneToOneConversation.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\PrettyFormat.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\getChildRouter.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\Enums\Pages.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\rules\custom\ | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoduxPresence.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateTextureSize.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaChat\icons\[email protected] | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| File created | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\jest.config.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\Navigation\BtnValues.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaChat\icons\ic-create-group.png | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-a406e214-4230f473\ReactRoblox\client\ReactRobloxComponent.lua | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WerFault.exe | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133272725575924778" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\roblox | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\roblox-player\ = "URL: Roblox Protocol" | C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe | N/A |
| Key deleted | \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\roblox-player | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol | C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" | C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df12000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb465b9758,0x7ffb465b9768,0x7ffb465b9778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3272 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Users\Admin\Documents\krnl\krnlss.exe
"C:\Users\Admin\Documents\krnl\krnlss.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7c29c7688,0x7ff7c29c7698,0x7ff7c29c76a8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4912 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4424 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4332 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2760 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2860 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4508 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3940 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7ac,0x7b0,0x7b4,0x6bc,0x7bc,0xd057bc,0xd057cc,0xd057dc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2
C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
MicrosoftEdgeWebview2Setup.exe /silent /install
C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOTExRDQ5QS1CNDFELTQ0MTktOTY0Ri00QjM2QzkxODQyNDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDE3NjEzMTc4IiBpbnN0YWxsX3RpbWVfbXM9IjE3NjciLz48L2FwcD48L3JlcXVlc3Q-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9CE99956-FD1E-4655-83CD-BB05D11E6986}" /silent
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RUVCODg2Ni03NTU2LTRBMjItQjEyNS0zODE1NzkyQ0ZFMTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDI4MzczNDQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQzM1QkIxNy1BNkM4LTQxRTgtQTNBMS04QjYyNERCRkRFOUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuNjQiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwNDQ0OTI2NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDQ0NjQzODIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM3MTcyMzExMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZTk0MzI4YmUtMzY3OC00ZDA3LWI4YjMtMmU3ZTA1MTFiYTMxP1AxPTE2ODM0MDM5MTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZVpzQWlPZjNPZTd5ZHpmbDloQm5FZEZFb3FjaG9nSE0lMmI2bjFvaTBLVjhOaHNMNjZ5ZVVNNjVuNG9Eem1TRkVQa3BWb1JkdGNFU3N4UHVRdnljQ01pUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgZG93bmxvYWRfdGltZV9tcz0iMjI4MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzcyMDQyNzQ3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM5NjQ2MzE2OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI0MDM4MzE4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk5OCIgZG93bmxvYWRfdGltZV9tcz0iMzI3MjkiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iODQzNDYiLz48L2FwcD48L3JlcXVlc3Q-
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5000 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac+launchtime:1682799245721+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D745e3621-7cc7-4b94-bd35-7e0512661c21%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp
C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x738,0x73c,0x740,0x70c,0x714,0x7457bc,0x7457cc,0x7457dc
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=745e3621-7cc7-4b94-bd35-7e0512661c21&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799245721 --rloc en_us --gloc en_us -channel zwinplayer64
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" -app
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x72c,0x730,0x734,0x69c,0x73c,0x10357bc,0x10357cc,0x10357dc
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -channel zwinplayer64
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4464 -ip 4464
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4464 -s 1992
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w+launchtime:1682799337223+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D01c43e03-df9a-43b5-9afc-6e49eac81d55%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x560,0x564,0x568,0x53c,0x570,0x10357bc,0x10357cc,0x10357dc
C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=01c43e03-df9a-43b5-9afc-6e49eac81d55&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799337223 --rloc en_us --gloc en_us -channel zwinplayer64
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 117.18.237.29:80 | tcp | |
| US | 8.8.8.8:53 | cdn.krnl.place | udp |
| US | 66.228.51.170:443 | cdn.krnl.place | tcp |
| US | 8.8.8.8:53 | k-storage.com | udp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | 170.51.228.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| DE | 172.217.23.206:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | 206.23.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | crls.ssl.com | udp |
| US | 18.65.39.44:80 | crls.ssl.com | tcp |
| US | 8.8.8.8:53 | 154.74.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 165.184.237.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 44.39.65.18.in-addr.arpa | udp |
| US | 40.125.122.176:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 20.189.173.1:443 | tcp | |
| NL | 8.238.177.126:80 | tcp | |
| US | 8.8.8.8:53 | roblox.com | udp |
| US | 128.116.114.3:443 | roblox.com | tcp |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 128.116.114.3:80 | roblox.com | tcp |
| US | 128.116.114.3:80 | roblox.com | tcp |
| US | 8.8.8.8:53 | www.roblox.com | udp |
| IN | 128.116.104.3:443 | www.roblox.com | tcp |
| US | 8.8.8.8:53 | 3.114.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.104.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | css.rbxcdn.com | udp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | static.rbxcdn.com | udp |
| US | 205.185.216.42:443 | static.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | js.rbxcdn.com | udp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| NL | 23.72.252.154:443 | js.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | 122.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.216.185.205.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.13.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roblox-api.arkoselabs.com | udp |
| US | 104.18.42.229:443 | roblox-api.arkoselabs.com | tcp |
| US | 8.8.8.8:53 | 200.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.42.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | metrics.roblox.com | udp |
| US | 8.8.8.8:53 | apis.rbxcdn.com | udp |
| NL | 23.72.252.177:443 | apis.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | locale.roblox.com | udp |
| US | 8.8.8.8:53 | apis.roblox.com | udp |
| IN | 128.116.104.4:443 | apis.roblox.com | tcp |
| US | 8.8.8.8:53 | images.rbxcdn.com | udp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| NL | 23.72.252.145:443 | images.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | 177.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.104.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| US | 40.125.122.176:443 | tcp | |
| NL | 142.250.179.138:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | ecsv2.roblox.com | udp |
| NL | 23.72.252.122:443 | css.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | auth.roblox.com | udp |
| IN | 128.116.104.3:443 | auth.roblox.com | tcp |
| IN | 128.116.104.4:443 | ecsv2.roblox.com | tcp |
| US | 8.8.8.8:53 | 145.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.179.250.142.in-addr.arpa | udp |
| NL | 8.238.177.126:80 | tcp | |
| US | 8.8.8.8:53 | ssl.google-analytics.com | udp |
| NL | 142.250.179.168:443 | ssl.google-analytics.com | tcp |
| NL | 142.250.179.138:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | 168.179.250.142.in-addr.arpa | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | assetgame.roblox.com | udp |
| US | 8.8.8.8:53 | chat.roblox.com | udp |
| US | 8.8.8.8:53 | contacts.roblox.com | udp |
| US | 8.8.8.8:53 | notifications.roblox.com | udp |
| US | 8.8.8.8:53 | economy.roblox.com | udp |
| US | 8.8.8.8:53 | friends.roblox.com | udp |
| US | 8.8.8.8:53 | privatemessages.roblox.com | udp |
| US | 8.8.8.8:53 | lms.roblox.com | udp |
| US | 8.8.8.8:53 | tr.rbxcdn.com | udp |
| DE | 23.32.238.91:443 | tr.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | thumbnails.roblox.com | udp |
| US | 8.8.8.8:53 | accountsettings.roblox.com | udp |
| US | 8.8.8.8:53 | presence.roblox.com | udp |
| US | 205.185.216.42:443 | static.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | iad4-128-116-102-3.roblox.com | udp |
| US | 8.8.8.8:53 | c0hw.rbxcdn.com | udp |
| US | 8.8.8.8:53 | aws-us-east-1b-lms.rbx.com | udp |
| US | 8.8.8.8:53 | syd1-128-116-51-3.roblox.com | udp |
| US | 3.226.10.132:443 | aws-us-east-1b-lms.rbx.com | tcp |
| US | 8.8.8.8:53 | mia4-128-116-45-3.roblox.com | udp |
| US | 128.116.102.3:443 | iad4-128-116-102-3.roblox.com | tcp |
| US | 8.8.8.8:53 | aws-us-east-2b-lms.rbx.com | udp |
| US | 128.116.45.3:443 | mia4-128-116-45-3.roblox.com | tcp |
| AU | 128.116.51.3:443 | syd1-128-116-51-3.roblox.com | tcp |
| US | 3.22.16.252:443 | aws-us-east-2b-lms.rbx.com | tcp |
| US | 8.8.8.8:53 | realtime.roblox.com | udp |
| US | 8.8.8.8:53 | 91.238.32.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.102.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.10.226.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.16.22.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.45.116.128.in-addr.arpa | udp |
| AU | 128.116.51.3:443 | syd1-128-116-51-3.roblox.com | tcp |
| US | 8.8.8.8:53 | trades.roblox.com | udp |
| US | 8.8.8.8:53 | 3.51.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.211.227.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | games.roblox.com | udp |
| US | 8.8.8.8:53 | followings.roblox.com | udp |
| US | 8.8.8.8:53 | badges.roblox.com | udp |
| US | 8.8.8.8:53 | sin2-128-116-97-3.roblox.com | udp |
| SG | 128.116.97.3:443 | sin2-128-116-97-3.roblox.com | tcp |
| US | 8.8.8.8:53 | lhr2-128-116-119-3.roblox.com | udp |
| US | 8.8.8.8:53 | aws-eu-central-1a-lms.rbx.com | udp |
| US | 8.8.8.8:53 | nrt1-128-116-120-3.roblox.com | udp |
| US | 8.8.8.8:53 | aws-eu-west-2c-lms.rbx.com | udp |
| US | 128.116.120.3:443 | nrt1-128-116-120-3.roblox.com | tcp |
| DE | 3.123.122.247:443 | aws-eu-central-1a-lms.rbx.com | tcp |
| GB | 128.116.119.3:443 | lhr2-128-116-119-3.roblox.com | tcp |
| GB | 18.168.250.97:443 | aws-eu-west-2c-lms.rbx.com | tcp |
| SG | 128.116.97.3:443 | sin2-128-116-97-3.roblox.com | tcp |
| US | 8.8.8.8:53 | voice.roblox.com | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | 3.119.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.122.123.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.250.168.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.120.116.128.in-addr.arpa | udp |
| US | 8.8.8.8:53 | accountinformation.roblox.com | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| NL | 216.58.214.3:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | 3.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| US | 8.8.8.8:53 | 64.19.222.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ephemeralcounters.api.roblox.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | setup.rbxcdn.qq.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.qq.com | udp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| US | 8.8.8.8:53 | setup-ak.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-ll.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-cfly.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-hw.rbxcdn.com | udp |
| US | 8.8.8.8:53 | www.roblox.com | udp |
| IN | 128.116.104.3:443 | www.roblox.com | tcp |
| US | 8.8.8.8:53 | 68.32.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.155.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| NL | 23.72.252.138:443 | setup.rbxcdn.com | tcp |
| US | 8.8.8.8:53 | 138.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ncs.roblox.com | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | msedge.api.cdp.microsoft.com | udp |
| US | 20.114.58.89:443 | msedge.api.cdp.microsoft.com | tcp |
| NL | 216.58.214.3:443 | beacons.gcp.gvt2.com | udp |
| US | 8.8.8.8:53 | 89.58.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | msedge.f.tlu.dl.delivery.mp.microsoft.com | udp |
| SG | 8.241.152.126:80 | msedge.f.tlu.dl.delivery.mp.microsoft.com | tcp |
| US | 8.8.8.8:53 | 126.152.241.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
| IN | 128.116.104.3:443 | ncs.roblox.com | tcp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| US | 8.8.8.8:53 | client-telemetry.roblox.com | udp |
| IN | 128.116.104.3:443 | client-telemetry.roblox.com | tcp |
| IN | 128.116.104.4:443 | ecsv2.roblox.com | tcp |
| IN | 128.116.104.4:443 | ecsv2.roblox.com | tcp |
| IN | 128.116.104.4:443 | ecsv2.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| IN | 128.116.104.3:443 | client-telemetry.roblox.com | tcp |
| US | 8.8.8.8:53 | setup.rbxcdn.qq.com | udp |
| IN | 128.116.104.3:443 | client-telemetry.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.qq.com | udp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| US | 8.8.8.8:53 | setup-ak.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-ll.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-cfly.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-hw.rbxcdn.com | udp |
| IN | 128.116.104.3:443 | client-telemetry.roblox.com | tcp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| NL | 23.72.252.138:443 | setup.rbxcdn.com | tcp |
| IN | 128.116.104.3:443 | client-telemetry.roblox.com | tcp |
| US | 8.8.8.8:53 | ephemeralcounters.api.roblox.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | apis.roblox.com | udp |
| IN | 128.116.104.4:443 | apis.roblox.com | tcp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| US | 8.8.8.8:53 | ephemeralcounters.api.roblox.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | setup.rbxcdn.qq.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.qq.com | udp |
| US | 8.8.8.8:53 | setup.rbxcdn.com | udp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| US | 8.8.8.8:53 | setup-ak.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-ll.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-cfly.rbxcdn.com | udp |
| US | 8.8.8.8:53 | setup-hw.rbxcdn.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| US | 8.8.8.8:53 | clientsettingscdn.roblox.com | udp |
| US | 8.8.8.8:53 | setup-ak.rbxcdn.com | udp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| US | 8.8.8.8:53 | setup-ll.rbxcdn.com | udp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| NL | 23.222.19.64:443 | clientsettingscdn.roblox.com | tcp |
| IN | 128.116.104.3:443 | ephemeralcounters.api.roblox.com | tcp |
| IN | 128.116.104.4:443 | apis.roblox.com | tcp |
Files
memory/4948-133-0x0000000000ED0000-0x0000000000FFA000-memory.dmp
memory/4948-134-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/4948-135-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/4948-136-0x000000000A160000-0x000000000A168000-memory.dmp
memory/4948-137-0x000000000A450000-0x000000000A488000-memory.dmp
memory/4948-138-0x000000000A4A0000-0x000000000A4AE000-memory.dmp
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\Monaco.zip
| MD5 | 1a19fd7c42169c76e75e685dca02c190 |
| SHA1 | f16b4697bcd348d44965bf9ded731523db9bd606 |
| SHA256 | d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331 |
| SHA512 | 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\src.7z
| MD5 | 7c380ecd5bc2cd51511d0ee5b58df745 |
| SHA1 | 615749979477621579dd9b04ada8d4dcd9430f1e |
| SHA256 | 38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07 |
| SHA512 | 110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de |
memory/4948-233-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/4948-234-0x0000000005B20000-0x0000000005B30000-memory.dmp
\??\pipe\crashpad_4360_HNRXKCWXVOMKDOHR
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
C:\Users\Admin\Documents\krnl\krnlss.exe.config
| MD5 | 0ed4b3831ff5e91dff636145f68aac4c |
| SHA1 | 2d1140812945dc1b9e400a88c911803639cb2e49 |
| SHA256 | 03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347 |
| SHA512 | 4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
memory/3788-664-0x00000000008F0000-0x0000000000A74000-memory.dmp
memory/3788-669-0x0000000005900000-0x0000000005EA4000-memory.dmp
memory/3788-672-0x0000000005350000-0x00000000053E2000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/3788-685-0x0000000006AE0000-0x0000000006B1E000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/3788-688-0x0000000006B20000-0x0000000006B5C000-memory.dmp
memory/3788-689-0x0000000006AA0000-0x0000000006AB2000-memory.dmp
memory/3788-690-0x0000000007180000-0x0000000007798000-memory.dmp
memory/3788-691-0x0000000006E70000-0x0000000006F7A000-memory.dmp
memory/3788-692-0x0000000006D90000-0x0000000006DA2000-memory.dmp
memory/3788-693-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/3788-694-0x0000000006E00000-0x0000000006E50000-memory.dmp
memory/3788-695-0x0000000006FF0000-0x0000000007056000-memory.dmp
memory/3788-697-0x00000000077E0000-0x000000000781C000-memory.dmp
memory/3788-698-0x0000000007880000-0x00000000078D6000-memory.dmp
memory/3788-699-0x0000000007E10000-0x000000000833C000-memory.dmp
memory/3788-700-0x0000000007850000-0x0000000007872000-memory.dmp
memory/3788-701-0x0000000007820000-0x000000000783E000-memory.dmp
memory/3788-702-0x0000000007C40000-0x0000000007C5C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
memory/3788-708-0x0000000008810000-0x0000000008CDC000-memory.dmp
memory/3788-711-0x0000000007D00000-0x0000000007D0A000-memory.dmp
memory/3788-712-0x0000000007D30000-0x0000000007D50000-memory.dmp
memory/3788-713-0x0000000007D80000-0x0000000007DA2000-memory.dmp
memory/3788-715-0x0000000007D50000-0x0000000007D70000-memory.dmp
memory/3788-718-0x0000000008340000-0x0000000008372000-memory.dmp
memory/3788-720-0x0000000007DE0000-0x0000000007E02000-memory.dmp
memory/3788-722-0x0000000007DB0000-0x0000000007DCA000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 68960caba526b3e93542e6d7d1ec2ca1 |
| SHA1 | 403fd6904cf390c4ebd1b343baeb0caa581ce8ea |
| SHA256 | ffdad0e8352853898b7877afc8d2c91fb42dc98f4fede58d4edcad582c591636 |
| SHA512 | 869de8496f9451eac5d19b9bd50936345ed8e83b9947e70c5fb6fca3d17ac2c6498a5d09ecc201423c5c32c6f0ac7199f0d435a620323074183bb63f90f3bb4f |
memory/3788-728-0x0000000008450000-0x000000000851E000-memory.dmp
memory/3788-729-0x00000000083D0000-0x0000000008414000-memory.dmp
memory/3788-730-0x00000000083A0000-0x00000000083BA000-memory.dmp
memory/3788-731-0x0000000008650000-0x0000000008772000-memory.dmp
memory/3788-732-0x0000000008580000-0x00000000085E0000-memory.dmp
memory/3788-733-0x0000000008520000-0x0000000008544000-memory.dmp
memory/3788-734-0x0000000008780000-0x00000000087C4000-memory.dmp
memory/3788-735-0x0000000008550000-0x000000000857A000-memory.dmp
memory/3788-736-0x00000000087D0000-0x0000000008802000-memory.dmp
memory/3788-737-0x0000000008D70000-0x0000000008DFC000-memory.dmp
memory/3788-738-0x0000000008F80000-0x00000000090F6000-memory.dmp
memory/3788-739-0x00000000093D0000-0x000000000946C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | db70e8b33a19030ee16166f08e245bad |
| SHA1 | 192d540079291a5efc6033d9ca5d7629334df321 |
| SHA256 | 8bfece289710096698cea6dccafc4b924f0889f1eafff213fbd5a4523d404b24 |
| SHA512 | b0d3d5401047471524d77a8668d69a487b085aa95830a80f697233b9150765d3d8740dbec2517027c5b1e0b8faa77825f70784608888c463477f5547460b3335 |
memory/3788-745-0x0000000009600000-0x0000000009786000-memory.dmp
memory/3788-746-0x0000000008E00000-0x0000000008E66000-memory.dmp
memory/3788-747-0x0000000009530000-0x00000000095EA000-memory.dmp
memory/3788-748-0x0000000008CE0000-0x0000000008D02000-memory.dmp
memory/3788-749-0x0000000008630000-0x000000000863C000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
C:\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
memory/3788-764-0x0000000008F60000-0x0000000008F6E000-memory.dmp
memory/3788-770-0x0000000008F70000-0x0000000008F7E000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
memory/3788-776-0x0000000009DA0000-0x0000000009DE2000-memory.dmp
C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
memory/3788-777-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/3788-760-0x0000000009A30000-0x0000000009A7A000-memory.dmp
memory/3788-778-0x00000000055D0000-0x00000000055E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 484b05819eeb000de58b456381b42072 |
| SHA1 | e559d19664c0d50d1b55a02d1c992175d4df7442 |
| SHA256 | bfdc093cffc163fcc7598d08c02951ef9a9cd8291e03b069d82795490ef8308a |
| SHA512 | c5bdeff92d584d135a4982723447d0c81b46a7234088ac2bb015b9d2ae1322483de02d302d679f36e87dff0b28cc15d5663beee4f11d2aedbed3214cddc5838b |
memory/3788-789-0x000000000C700000-0x000000000C800000-memory.dmp
C:\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
memory/3788-790-0x000000000C960000-0x000000000CAB4000-memory.dmp
C:\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
C:\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll
| MD5 | 2ff7acfa80647ee46cc3c0e446327108 |
| SHA1 | c994820d03af722c244b046d1ee0967f1b5bc478 |
| SHA256 | 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d |
| SHA512 | 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd |
memory/3788-807-0x000000000C8B0000-0x000000000C926000-memory.dmp
memory/3788-811-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/3788-850-0x000000000CAE0000-0x000000000CAFE000-memory.dmp
memory/3788-939-0x00000000055D0000-0x00000000055E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 9b020fec1be1b52a015ebf72bf8eb239 |
| SHA1 | 9db2ae296341ff4ab253453986bf2ad175a21661 |
| SHA256 | 8a38a8f225dfec2abada16a2dc3a7107353672ebd8738e3c08c4cb320dfc77f4 |
| SHA512 | 1ad212cbd9a97f6ecd766e0b9228424c7ab142674980b8aa517f6370e1241402bf2d0dc0622935ddc4cccf5622bda6f5b742d1b0469ab0987f39a820052fe74e |
memory/3788-955-0x00000000055D0000-0x00000000055E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f765110-dd2a-4f2b-81da-c805ccda5493.tmp
| MD5 | b349e14ce7e14447aab2be060b0562aa |
| SHA1 | 7fef61c36b1a641f340a7c9880909c5e6a4966fa |
| SHA256 | 4165dc396c234ed2e51d4707ee5493ff518c60ad6564f0af850f43ea134d0771 |
| SHA512 | b177e3771e6c57c87b25d5429430e9f47d48a49a0c581bdf4e8b5ed9aceaf411a076f30fb7465fc6acee33bd91ae871f3edeffb2db0093e73419120f71784ad2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | c52fbd991d63b40b7c090a4a45e1a9ee |
| SHA1 | 6dfd1bb26c55de038f48c96d4340d4805caee9e1 |
| SHA256 | 6fa7bae6058ecc607a3a0c642bd699380c8fde86a8d60c10035ecfe5e4959be2 |
| SHA512 | 8e07b0d7a52309d4d3d3f5a120d9c9faf1eb5195cd88ace20345761b352a424b0d50bbe357f3fd5831cfb419f0314d3856abca0f0024f1fce451823174d7a643 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | cac33b802514f5c0a0db935041cff84b |
| SHA1 | c09a109278a37251a4de145a88dff090c6cae7af |
| SHA256 | af858897a7b5cb65a71512cf0594ebd72a45608df329c5076f454792c36d0a3d |
| SHA512 | 4e47caeb82393d68362c128f8efa93b14f10b00d7c819561e14652cb66be46ebfd0359b1baa9fb3c7ecd055d0dc4fa4995b4ade55d489eb2a4441657169fde5d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f624fb8-2bdf-4b25-bede-6fb8e36d3573.tmp
| MD5 | ede1f9ae6f6b66194a717c77820cd9fb |
| SHA1 | c3e0fcdeca9c2739d9b138aadae083780b8297eb |
| SHA256 | b9ec406fb04eb50ee181e9321530d3b2c5863e5f5dadecf40a8f56fe6401c797 |
| SHA512 | 90d477d508aa709005b3c6f71e7e54394f47f516849439ec0a187ad4ca3fd88f36c8ff41f701ebca6abcf6ebd88518d23967cfb58e528cade5675c7735d04e11 |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
| MD5 | 34b97f8b9e4296af5238fc8f67586b72 |
| SHA1 | e6c4b92901c1a9d8aa6a7247143c2560a90efaba |
| SHA256 | 70c158c98bf7abf5e0bb3167edf6ed0d378f9380fabcf281cf0fe59623a0c774 |
| SHA512 | 0df677459ce64c61aa109aeabcf8f91e5a19a98ddc3426818d5cb256e05abab604b2455296e83fd4687798f6f241d470af431ac9e153df95283186c28c3ab4d3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
| MD5 | 9607b1f17ee9215cb98d30fadf7d8f07 |
| SHA1 | 02f24d48c3b75b001c34b0bd447d3f48e27721fa |
| SHA256 | ed1667af355f9c82290a4ea786ea0a4a96bda9a6730a0e81ed42bfdbc798f3ee |
| SHA512 | c290ce91e1c03646b3f4ccdeb3b7e7f470d8e574925fd8a0b71d6dd58f29af3fd4eb6099f2bba921424ab8fd42d97430107f9944af4b7c53ce4f10caf94a0815 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
| MD5 | c12075d6afcfce79df001ecba960cc0a |
| SHA1 | f11913a40353bc451298b24b47642c65d591c2b8 |
| SHA256 | 3d738adbbd4904e038babeab34d1481963921df6d8e7fe721e84649f1518cf05 |
| SHA512 | b4732bb0b6c5edb0f9d42e1f3d3facb8752c81bb70c3c7982ab14d7380b2bac31c367b77a11163592a511ac13ef894009846760a0a1246eaeb9df11c6408132c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 77de238191b6471e1e61f2296d8ad069 |
| SHA1 | 86bacc69b58a36eddd2c0e4735fbb59ace86a016 |
| SHA256 | c79f1a985f03ebeb6103a490c14e7cd30d68c5aa8eb610d211d5637237ece106 |
| SHA512 | c131e2da233421550559d103b75b6875380c6f137455b9724f4009bbd41f63d515b02c1550a7c5a9532faddc44a958728f551c5342deadd94434e7d7266fb34e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 99db85bdf43a99138d5a50a2fe2af148 |
| SHA1 | 585fac72ef1803fec5b3d56891ba7df34790e54b |
| SHA256 | 3552f164eb60f8d901ad669283fb0015af59c8cf015f4e42237ff274f8dce7b1 |
| SHA512 | 8e2e9a1dac6b9ffa1281a7691b0cbac05c8ea082c74c8d25851dd93b7bef545f57a663a83068f1307117f692dd9a701dc97fc45aa8953b3e9a7b0f9e8b75be02 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
| MD5 | 01d5892e6e243b52998310c2925b9f3a |
| SHA1 | 58180151b6a6ee4af73583a214b68efb9e8844d4 |
| SHA256 | 7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d |
| SHA512 | de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | f343325dff5e63c0fe34bc3bf2c91ef4 |
| SHA1 | 3d433dc78cf8eef3474761e8140d500e75ea52de |
| SHA256 | b8e5e328f5d2ce87abe2b7bf2ae518f5b1033e064c2b83cf03535447535456b8 |
| SHA512 | bfb3385f6dc937a418aa6705bcab565676eafa96ad95c37d274159f11eef26523e555ce398e665b59991a045a222289852002dfc08ca7a1fb3b297d75727584d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | a652635ac4b368f74e8f8995db8ca632 |
| SHA1 | fc35b20b082f8927bf88815505a26f698609b070 |
| SHA256 | 3eaf7717f1321500a397c5f04f48045410912bd5b3dbf1ce2700694f380fffda |
| SHA512 | 19023ae364d78e3a23231d9e9ba0bbcabe22c373f0331bf71d5cd0e62a7732db6238ef43c99e48ad1169f4ad87806283d04d0cbf4221a588ec11fca818e8053c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582054.TMP
| MD5 | adb0e6874083b5271ff04ed2c2f392a0 |
| SHA1 | d3f72ba64d7cb9bf92d1460258580b690eaf915b |
| SHA256 | eb74a522eceddd34d43a6ea18ea091022f8b1d9dbf572dcd9da861ba1e6a3fa9 |
| SHA512 | b31cd8387054e725987857801f22558c11b7bf0d20a73a911ddd2edb57d2992a134ec895d6fe84aa491d33550251263744044ce817db318a7c68a95242855182 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 575d707c3776c167a259891f3e5419ae |
| SHA1 | 6f43b2c16fcec7e9f9b4be14e64efa4823ae46f4 |
| SHA256 | 9cd86e57b5ce4af0fab011a8176189fbe9351646c947407c7a012f42c92e6952 |
| SHA512 | 3653401d7a4b657bce84038f159d172b1e6bd0dcd39fcb95afd02e4bee48797a5efb00c9ed2b3ebc8e6bc0414b60b3ddec81442b48bd3090e518b3b64e8726f8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 34bf4cc5a498295c7739db9b1cb7c2e0 |
| SHA1 | 565dd62bdad19f15b2d7b025dfedb1a6f2baceb8 |
| SHA256 | fbdfa12b684460113787be26a705fe5751b3c275260ca9bb83981de7655d5af2 |
| SHA512 | b1a8e3aeb4e84c64c3728f8991428386e12c9eb84f9d6364be2ddb6897344af049aeacd220aaa20b87753fbb2302ba1fb73cdebc472b1084c8a5849221b526fc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 7525fc346f07f54107a82e5607a81de5 |
| SHA1 | c8bb8b4f7b8e079bfc2442f926e5614cf05739a2 |
| SHA256 | 94eb1ffd3312040dc73ffb3aab104b190a3b44375cc9ab696c7c80458207d361 |
| SHA512 | 289fde686b8f04ca2608c963c1cf5f88ea89a8b32e31b582a621b0e6de8f83dabc52db00eb38cb6453518a82f1b56425ae11794f50d5fd39c0c6839589a58bec |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | adb18cb531c8ed9ba1468aaecb2a7851 |
| SHA1 | 4c50f057528b16dd6a021e3b4ed6e97efe15de89 |
| SHA256 | 3c7a47d98976e793683e2560c8e2eede52460c362fcbfd328eefdbd148f4d48f |
| SHA512 | dfc8749272424f766d23a0a49e5600f690244e6a852e6a574a4f5e4cd6e6d9a816f4c117f304a253afefcbde9f928b58cabe5a57f1882c1244f9fdbccffa0a28 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | fd013531c8c3a230e061c5cf1c62dfe5 |
| SHA1 | 7e430c9eca4debe6e579bf1da616e9a220959b7d |
| SHA256 | 4cb75365faef44cb49afee32c1c1ec52f1323265ffe650c58d8c55c6cc57a53f |
| SHA512 | 67e154c60d3f8ffce29b32ada03c8eba8c151ce7ef09bc0b45f4c5d779f19898dcef4b2289f28f59f573831c9ded2b3a403b9deb5ead0be8ea965a2156f7c4e3 |
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
| MD5 | 623cd7b48f9b5f0bfd233ebb930cff82 |
| SHA1 | ec32d6a43eac16209aafae6cb3912c398e9b80c0 |
| SHA256 | e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0 |
| SHA512 | 107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3 |
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
| MD5 | 623cd7b48f9b5f0bfd233ebb930cff82 |
| SHA1 | ec32d6a43eac16209aafae6cb3912c398e9b80c0 |
| SHA256 | e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0 |
| SHA512 | 107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1a3025e0cf2cc86be5d8806bcec52ddd |
| SHA1 | 0ce2b0e9a25768f155fea1b4441d99a221409b8f |
| SHA256 | 7dba031b209366d6de98fa77486b40eae05ca205366cd4b712cc4c115abe3bb9 |
| SHA512 | 7b4d76d6c236f1c3f98b32992564deb892f9aa42b02d1f13425674d5ee3eee27baba72ab32fccdf3c47cbcfd2f9a13c7731c742c23f057619221cd6e89c23289 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\BatchIncrement[1].json
| MD5 | bedbf7d7d69748886e9b48f45c75fbbe |
| SHA1 | aa0789d89bfbd44ca1bffe83851af95b6afb012c |
| SHA256 | b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61 |
| SHA512 | 7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | abd3f419f55fbc5d34d66b8ff1c8d996 |
| SHA1 | 166616e826c5212c3f916cc4987d1d7121212833 |
| SHA256 | 12179d3ba822a4663234a5876012dfd3605ded1c471248909c9e39d9b84a65b8 |
| SHA512 | fb87e2f24c52bdde7e8133f1b64540ce0b99921d8a9c48983e24b8213b3042b9328da78201b2ba7921337c6dab4b5234928d20d288686299e7825194497461da |
C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
| MD5 | 3bf891bf24d2216d1f799334d88a14ec |
| SHA1 | 0962cdfcac41c498ea9469df19c4f6e069be04af |
| SHA256 | bea0ba994ac766b5956695f0520fb9dfb2c6a73f4e9fff349d29efd39163bf94 |
| SHA512 | 7d6ba4776c4916729018cf3c486095e9f57d2e1b2954a576efb00931f1d8e3fa989e9a7e3a05a36bcd1bea5a30112abf5999e1ed0e90045ab64b9af6d2f2c48c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | b3469483234412c8be7809ee38d7bce9 |
| SHA1 | 35318fab62bcba91cb7a8c8e309bccde7178e57a |
| SHA256 | 35c7f29e318e6d92dc666ef9f472af82da610ddd4177f6ebbc1debd7de01611b |
| SHA512 | 9f4b13019048c15608b8748f28d7fbc9044b5da286f3a7183461b460d8a2381aa42546713bcd6a6cc9a84c0ecdbcdba4c0c1aa3d963c942777fbb43d0c7538f5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ff60bef30d3a32ece074258a0c1fc77f |
| SHA1 | 367ac44a2a8b2503fc60cb08c84e5837e769a27f |
| SHA256 | d0b997652ee911d21593bd7284e1605461adf3d54252d7b532d9b7e08e54a46e |
| SHA512 | 1cfc47aa01f8f56b40ca70dfd8d16a7ee65dd4ba7e0efc13f489e55604e42249acfb9b7395091768c03b36611e0f634841238bb714aa649c343c69f7376be037 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 09bcbc21ddde0355274fc76294a40c1a |
| SHA1 | b8da5c10199161d5cbc968ca6242958466437dee |
| SHA256 | b2383ca375efdf79b8589df52e8f14a7385b9ce67f857c44ca81b9eb8ed1fdff |
| SHA512 | 8b02ccbb98930c69bb565511230cb258c5f5e0ac6da7c8e2c05e822f4087b8626b19e7022d5f7724f4576514a3db6662dfb6e1dc48be710817d4f7d0350a2621 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ac6347fe8fed0d4777c68127260b56aa |
| SHA1 | de4b284bfa3234a60b0dde5a171189fdd8c9f973 |
| SHA256 | 64f479329d07c56b4276c102f5543451007d479668f80506962defdf69bae85c |
| SHA512 | 7905247fd976d4022e2a4b8ddbe5f5f44e6f80ad929262185aa892456310d941a8d1e3257ac6dc6edfac3665bbaf98271e416b27535968ad9e704b22586474a0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 9ddb0fc333ca0f4067844bc55e01542f |
| SHA1 | 3acfd1cfa60e15bd70905461a5b7984e0bd066c3 |
| SHA256 | fddb14e0327a5339d7821ba7695abc4d7ecc8c226a78ec610e23bdc6264d797b |
| SHA512 | efd9b2bf36d4f0e472256d063aea448d6ae14fc4b5a75fe081553e0f32a2a280a792847c943b4100ee67cb50591e2be4c37e68d7570a00b5903b629c043016de |
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
| MD5 | 4dc57ab56e37cd05e81f0d8aaafc5179 |
| SHA1 | 494a90728d7680f979b0ad87f09b5b58f16d1cd5 |
| SHA256 | 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718 |
| SHA512 | 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b |
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
| MD5 | 6b05382235bc0418a5da0051530ce873 |
| SHA1 | d31b0d0a6ae6de908ef3bb3ab169a16f3d82eceb |
| SHA256 | 0747310a01030b2c88ba9f1063932eb24814651c34a39254071dcd00dd7a812f |
| SHA512 | c49d19639e84124b43fcf5cc4f3c993ead41c3fe56c21b01266e5b1845f77b3a62bc36f93d2eeb9c2d2da313f9eaa69d427201c5cfbc0c105e072804ee2ffd34 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ac6ce51052fc6c86a49489c82fc658fb |
| SHA1 | 67ef6cacc86b0b5e8a26080f1dc6f86618daff2a |
| SHA256 | 75a8d2e5b455e0908ea5fb4098b0b2b893113c40c4828bc1ef215d1cc3118039 |
| SHA512 | ea43816a1267ca3d4696003805ad68ac9237b5f59100b0ecf5e1b3c2e86ad6e49d21f4703dff847618ffa000be54b6806c55879a2ae654a0415d6f1687d35d5c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 55c96751eda5a24324c2fa0498877bb5 |
| SHA1 | 53cfb2f1a5ba7353124044836890e305b1044124 |
| SHA256 | 229683735f98a2ed80ae0c594f77f8c5ea9a4c2288c9ddc9065b487ff7adf328 |
| SHA512 | 2332f14508bda0737f08afaa7428f042fa0c4c1354b69da71a58e9e2215b9bc49f45a30fccc0b93dace8fe58565ea5c812d9ef0c90613460f14c7e013ec815da |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | c069834d056b8049130823ac0c4101c9 |
| SHA1 | 0e3c1bac428402693f533b6caa59c5e0126eed5c |
| SHA256 | 0b1e480a9ca07e801360d893c10fd31e5a30a27d6d82149e9559d82ff1ef94ea |
| SHA512 | a1f26a43df0605451bd3480a8ea7ed34eedc309884ffe7366d811fd5a2f847c0135c06ff8ef21a3c7b98dc902167af84e799706adb4bbac49aa3d6bfa9ed580a |
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\112.0.1722.64\MicrosoftEdge_X64_112.0.1722.64.exe
| MD5 | b389a801f3373bc45a2b85335da47aac |
| SHA1 | ee244117aa01a2009112ab5d4e8d562fa665de85 |
| SHA256 | 4ad07fd7bcf2326f110b1902942c884ae0e2b67ca0e48e010b6be4ee11d1fd2c |
| SHA512 | 4015dada1088fd6179ec8fac0288e7454125bf3159e1d666301e48873d17efdf77d2a79492a2623047a246fb4648382cf01b667095b4beb5ccf3087366051639 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | b804b80b2f8dc684e1e3490bb93aecb1 |
| SHA1 | 5b01be9e1a490e162add7018c622f56e267257c8 |
| SHA256 | 3ec33946939114598f33ac297542d8c67693395d6d2d16def2c2b0f4957306d9 |
| SHA512 | 5d1904d79bdf1aa55a1131984b6ffc734c5d0285177b326e910a18708edb6c64c1a273e8c4a51186bce8df986d0daa10133f76e6719a7d69e18359c3f836e453 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | b3fa13fa1493d979f87dad1d5ff87ef7 |
| SHA1 | 0370383e1eb27f7120bfb3ccc7e2d0b04fd5d7d9 |
| SHA256 | 41e3d024793199e228176c480d5c2c48e3ff7e77a1d77f8235d19c1ad60381a6 |
| SHA512 | 8eaa8642e834db583bc87663fa0f12269eab07f90a3e76785464d669246163d7ef805507493b938a1de50a0232e36587e906f488c9da3a0fe5bf062fdcad78a9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 4f34519b7e5669fb4b8f6830ab7e74aa |
| SHA1 | 347d27b6b5f41336adb4ce9a7acafac2ff24be72 |
| SHA256 | 65bbe81656adbbdfd81a55f9a072110d1444a49dbde34951d148a2992feab8e4 |
| SHA512 | 60ff4eefe147cc8d44c11871274abf978df16f3004b202a3ce86404c50699db1e03c5f10c23a569fa28f0dc5691e4ce3801f58e9242943d6d93c30ee6fd05bca |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | d7ef0a5d8d4b606d0f84de4293917dda |
| SHA1 | a2e2cfbc6f16f7dd11a46c2c240103dcc23b23a3 |
| SHA256 | fc1152dbfc557de59a7902d13c90a17101a581af6f71f1620de3f8f1c31c5bc0 |
| SHA512 | 1fb2b1c02b804094d03ccb242a54e99933430d188230c70bc03a71791b1e683efe3c4afdb592dff72797a260cbe02d601ad6d399080876a5f507755b90d83551 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | dfbcd0672dd375750eae47d367782b93 |
| SHA1 | de1aa0cf0df8d83f5fec2e8e61b9d7daabea37ec |
| SHA256 | 83267f7929f73bfcbbfea963214303c691a47eb37dac63e9d71ce3a27e5f2f80 |
| SHA512 | cd33b4c15e44f0c44f78b48782bc5d420dc9d78c75c724a2af5c6e7d5eaf5d084193f19cd4396e0774831af5cf41b3f4ef9e536847c19e8f21822fd746c63ba8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 02f2b2866b21720c4742e3a172a94098 |
| SHA1 | adca9b9c46144725c9a88f42e6a3869beaec85f0 |
| SHA256 | 0464d390837fce2b5082bb1d29d238c538401b0363a710e8194f55ec248f8ebe |
| SHA512 | 4946d48b17911899614365094ec051d710c8dd9a7adaeccb5c052143acc60bd801bc36c7526cf393d3ea5a2b405921654bbbe41b0a45ad9bc3ec8d45b461abc4 |
C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.64\Installer\setup.exe
| MD5 | 55dbfedec31ce800442d30f4e65c9ec2 |
| SHA1 | 2ebc1bac365e2e1ae73089bebdeaabef6c8ebd7b |
| SHA256 | 69afeb4fd99981b52d947c2b0255bcef3768bfe1e2643e14971e2d5916749c94 |
| SHA512 | af87bfd9dd0f4375a551829a3d711bfb32c4c02225cb30246d0e19cfa5d7f4b288c95567dd6d442db18ede124ade12e03211a374c73736670c9f6daf0c8204af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | c1b0f01e2e2873fefc14f86fce44c501 |
| SHA1 | 37b39894b93934fc9ec2e4f3e8b07c2daf4cdecf |
| SHA256 | f90f963623511ce269557a5b224e6549da9666d0cce6d33bf0f10dcc49c836cc |
| SHA512 | 08fcac239d5a313685c0a2ec0943ace51b4314c7d682c8107a51bdad1beb6ef17296d91a957610c37d1b619ee19a511d38c22bc3923052c90cab247aba7721ff |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 9882d33cbd24d6e2e096177d77cb4c5e |
| SHA1 | 8f72ab5324729fbcc75140e947b6869f245b5c67 |
| SHA256 | caac4aafbd52f7087a92a4cec0622b66ff888a28596b40b1230611a263d1de48 |
| SHA512 | 760162a384236130ea3977bc207adc63a7e3ec5fb394835a3a86404eeff643052d02e2e73fba081ef24a88988ec71ee8af47b1a07415fb96de33378bc84a7d3a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 77ffbe34383883903365d18af90fb15b |
| SHA1 | 77559a822c5b37dce464e0ba39b47e9aa8b87406 |
| SHA256 | e5e40778c56813b5c52ac6e2f3d65bd9be4cf4c8a42b09ad3c811c786564513a |
| SHA512 | 2b4f139e3e715cac04e9b4e8cca9fe84e1553fa94015988fa7c95a0e8fb1e3c2b0d4f0f73c018673cbf39261827970fe12a74d41752a630ec7467be1432dbbcc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 838b037908bdda4d960a887bc30b7ebe |
| SHA1 | b2d514bfefce15453293c8db2a0b2ed7b0e85f30 |
| SHA256 | 7bc2b54511fc1be68c7d7a18056ffc97d2cbe220122b768593c8f9ac6f9f462a |
| SHA512 | 5b9d6c3fb238a5f241ce0a5ad64e5b2ba5d8afbb46ec6bc045ff024dc4c3bbfd37dfed97626634191dd0db2b8cf9340329799f0a0fed482a95d742c99d7fb9b9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 9b8b8cd035497752639c9cf02e375090 |
| SHA1 | a4ecb2a76e0887a6fed3f9f0b52cd86f35917552 |
| SHA256 | d972936544fea74e0e1ff78535cc0e04a1c908c0fb178681a4a820fc933a11a5 |
| SHA512 | 07f0200853e6b6882f4d3a3cfcd3211120db52fade1d15df1d94781479274d67a9a42b8b5a65d8ffa931bbab5a513bf0656d46ff3e01d1331a731f9233615909 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 25ccf9e312ae31df927fe60c3814ed7a |
| SHA1 | d822b6371ec0003dc37c7204d2f64ff4b330a25b |
| SHA256 | 961d1b2a1bfd827dc73f459a0419a10aed994b10e7b7106873bd053a0b4b2f65 |
| SHA512 | c559e43da7cd0fe87837a9294c67d03f373f8a2072f98b48472585366d6cb282b38e82bc372d05fd458a437cdff5bc302a7da03e33b4409191b058ef17648684 |
C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
| MD5 | 869a00ad6525080f22e06f0a8b5a8fd0 |
| SHA1 | 053085ba1ef8264f2c030fae52ad7c8fa541bb08 |
| SHA256 | b6744e15755e1b1e8ef266aade9330dc61961344e4e1db2cd2041ee81cbe00c0 |
| SHA512 | 9dffbfc8769581d0d92bf7ede1fbb0d564305360bf73b70c177f101c85708d4ad591235257fb63ba43ea5270f08a2268f89cf81b3d1e7673d9618563299977ce |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | 747bb5bce5ed36e7248b43859edfc3a2 |
| SHA1 | 7f34798e150ecbcfff01ad5d1a3490c7be4fc40e |
| SHA256 | fa5f2502564f1f90930c4e0c775d06a22cd64408e051a05cfb4d088c76ca08b3 |
| SHA512 | 6295e81763666f8e769d5ef0f63ca373f64bc35823bff1d86cde5c0617e3dd8bd37d8dcbb9bb04395f7d1e3598c2ac87ac4ef8225a5985989030a8d698da47b7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 57b083c0b43f959df1a03e097bbdd7ba |
| SHA1 | 1c951bf3f5cc660ecc219ec8c553cb924bcf9451 |
| SHA256 | 190bcc68f99f38b6fafead62249ed06b2767c342d26a348d4d1de6fe29d06bab |
| SHA512 | 404397212c455bff4a996ba515a83bdf914f07d5388930f58675c9047cd8a775b9d7223f7ad7671e0c0e34fc075c9d4423c6d3ba2729eb13ba8be33556be4fa4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 3a9463011fe8ef70a78773bc60df7e8e |
| SHA1 | dff2d5dc57325ab9d40a3a387ea89e4d711b9caf |
| SHA256 | 533c6adf56694ae5f63ccba54fef8216d92098f9daa740f49669447d478d4847 |
| SHA512 | 89d52328a081d8c262ee5bded772a2f60d1a1f7108e096192ba90b89664efede0d711fae893f6b9d8bb05cddce885a24cd99e8b57688f96e31a47bbb7bde1276 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\zwinplayer64[2].json
| MD5 | 4b9a858432b8e5f49839c29d35d6575b |
| SHA1 | 77b0c9e67ec6b41f865f5c1dac5ee926825d6f8f |
| SHA256 | f2f8ca31507bc3c4e1d4218a115751fb7445ac0ad5b8effc21c6d6f85487f8d6 |
| SHA512 | c2d1cc468a0da6dc9d9f83af77b482b806d31ba678db4fd9dedaff7a3e2d197518d68067089927ef6d5cbc256f0541f0717c9e3d9a6e10365ce74d1f729fa0dd |
memory/4464-2341-0x00007FFB64240000-0x00007FFB64241000-memory.dmp
memory/4464-2342-0x00007FFB641B0000-0x00007FFB641B1000-memory.dmp
memory/4464-2343-0x00007FFB64230000-0x00007FFB64231000-memory.dmp
memory/4464-2344-0x00007FFB641A0000-0x00007FFB641A1000-memory.dmp
memory/4464-2346-0x00007FFB64190000-0x00007FFB64191000-memory.dmp
memory/4464-2345-0x00007FFB64220000-0x00007FFB64221000-memory.dmp
memory/4464-2347-0x00007FFB64210000-0x00007FFB64211000-memory.dmp
memory/4464-2348-0x00007FFB641D0000-0x00007FFB641D1000-memory.dmp
memory/4464-2349-0x00007FFB64250000-0x00007FFB64260000-memory.dmp
memory/4464-2350-0x00007FFB64250000-0x00007FFB64260000-memory.dmp
memory/4464-2351-0x00007FFB64360000-0x00007FFB64370000-memory.dmp
memory/4464-2352-0x00007FFB64360000-0x00007FFB64370000-memory.dmp
memory/4464-2353-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp
memory/4464-2354-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp
memory/4464-2355-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp
memory/4464-2356-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp
memory/4464-2357-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp
memory/4464-2358-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp
memory/4464-2359-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp
memory/4464-2360-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp
memory/4464-2361-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp
memory/4464-2362-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp
memory/4464-2363-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp
memory/4464-2364-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp
memory/4464-2365-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp
memory/4464-2366-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp
memory/4464-2367-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp
memory/4464-2368-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp
memory/4464-2369-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp
memory/4464-2370-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp
memory/4464-2371-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp
memory/4464-2372-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp
memory/4464-2373-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp
memory/4464-2374-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp
memory/4464-2377-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp
memory/4464-2375-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp
memory/4464-2378-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp
memory/4464-2379-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp
memory/4464-2380-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp
memory/4464-2381-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp
memory/4464-2376-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp
memory/4464-2382-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp
memory/4464-2383-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp
memory/4464-2384-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp
memory/4464-2385-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp
memory/4464-2386-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp
memory/4464-2387-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp
memory/4464-2388-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp
memory/4464-2389-0x00007FFB62140000-0x00007FFB62150000-memory.dmp
memory/4464-2390-0x00007FFB62140000-0x00007FFB62150000-memory.dmp
memory/4464-2391-0x00007FFB62240000-0x00007FFB62250000-memory.dmp
memory/4464-2392-0x00007FFB62240000-0x00007FFB62250000-memory.dmp
memory/4464-2394-0x00007FFB62270000-0x00007FFB62294000-memory.dmp
memory/4464-2393-0x00007FFB62270000-0x00007FFB62294000-memory.dmp
memory/4464-2395-0x00007FFB62270000-0x00007FFB62294000-memory.dmp
memory/4464-2396-0x00007FFB62270000-0x00007FFB62294000-memory.dmp
memory/4464-2397-0x00007FFB62270000-0x00007FFB62294000-memory.dmp
memory/4464-2398-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2399-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2400-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2401-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2403-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2402-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
memory/4464-2404-0x00007FFB61970000-0x00007FFB61996000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 4558403d3468fed3481569657e3221a8 |
| SHA1 | 7db0428d0b1e5018e793c85660a8e5ad3cf5a82d |
| SHA256 | 518addb71ac01eb7f75ca2c6a263c31904edb9fcc9acfaee5af7be6ebc242909 |
| SHA512 | 06eaaf41d6508dc99354e04a43c1a5bb427a09dbe208e8a40b79b06240e0b9edcc0d2d00aa2d22349fc93ec9df2830a88e0aac12e036d376c86db6ba7c99f839 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 2678681b4a6b32f4331a83af1c3de6d7 |
| SHA1 | a8652d54f85bd84604d1633063ca9ad620212b96 |
| SHA256 | 87f58a14cc74afffe86e71c9c8556b670f7a4f8b1f7d112bc00b211d97393335 |
| SHA512 | 8ffa79ed5cacbc44c7a1f2d83a05537f1ec253509a7aea04b1c42ac17caf889b7326c223818d3695dfcc5c5becf79817bdfada06d075c5adb2bc287e370334ea |
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
| MD5 | 4b5ad874c09b3ffcaea4aa89ced6fc05 |
| SHA1 | 9faedfbfd6186a1909af132857fd65fd12ddef17 |
| SHA256 | 1fd516ec4bb4e116152c90f717d5ce956daab8a4bf1a554e64cb76a6ba4e27a7 |
| SHA512 | 0a29790c432637cb647f982fb0fc7f2e33e6d2fbfd552e169635b63552a27e3391f0fe9851b12ad33138e2ae1778ad93f2491f1bffa6335546d5c6a155a278bf |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 413ac7a8173bd40768b103c9138bef2f |
| SHA1 | 3b7f5c98977af53c3e318566c48dafabefa19adf |
| SHA256 | 08b90a1cc797705f4d243c1af62421a480898093bf1ab7072f0fbad64b1d5c6e |
| SHA512 | d2ab080c1855ce083ea728bd7e9437623c5b85adbf341c4bd888081bc9d7a7a2d7bd80e6b15ce02f6bcc44582e469210c44de7b56c36ebb293e098c72d168746 |