Malware Analysis Report

2025-08-06 00:52

Sample ID 230429-ywmdqsdh7v
Target krnl_bootstrapper.exe
SHA256 27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54
Tags
lumma stealer discovery evasion persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

Threat Level: Known bad

The file krnl_bootstrapper.exe was found to be: Known bad.

Malicious Activity Summary

lumma stealer discovery evasion persistence spyware trojan

Lumma Stealer

Downloads MZ/PE file

Sets file execution options in registry

Reads user/profile data of web browsers

Adds Run key to start application

Checks whether UAC is enabled

Checks computer location settings

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Drops file in Program Files directory

Loads dropped DLL

Checks system information in the registry

Checks installed software on the system

Registers COM server for autorun

Executes dropped EXE

Program crash

Enumerates physical storage devices

Modifies system certificate store

Modifies data under HKEY_USERS

Modifies Internet Explorer settings

Suspicious use of UnmapMainImage

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-29 20:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-29 20:08

Reported

2023-04-29 20:16

Platform

win7-20230220-en

Max time kernel

401s

Max time network

403s

Command Line

"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"

Signatures

Lumma Stealer

stealer lumma

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1956 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 1956 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\krnlss.exe
PID 1956 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\krnlss.exe
PID 1956 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\krnlss.exe
PID 1956 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\krnlss.exe

Processes

C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe

"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"

C:\Users\Admin\Documents\krnl\7za.exe

"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1

C:\Users\Admin\Documents\krnl\7za.exe

"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1

C:\Users\Admin\Documents\krnl\krnlss.exe

"C:\Users\Admin\Documents\krnl\krnlss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.krnl.place udp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 66.228.51.170:443 cdn.krnl.place tcp
US 8.8.8.8:53 k-storage.com udp
US 188.114.96.0:443 k-storage.com tcp
US 188.114.96.0:443 k-storage.com tcp
US 8.8.8.8:53 sslcom.repository.certum.pl udp
NL 95.101.74.146:80 sslcom.repository.certum.pl tcp

Files

memory/1956-54-0x0000000001000000-0x000000000112A000-memory.dmp

memory/1956-55-0x0000000000AF0000-0x0000000000B30000-memory.dmp

memory/1956-57-0x0000000000360000-0x000000000036A000-memory.dmp

memory/1956-56-0x0000000000360000-0x000000000036A000-memory.dmp

memory/1956-58-0x0000000000AF0000-0x0000000000B30000-memory.dmp

memory/1956-59-0x0000000000C50000-0x0000000000C5A000-memory.dmp

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\bin\Monaco.zip

MD5 1a19fd7c42169c76e75e685dca02c190
SHA1 f16b4697bcd348d44965bf9ded731523db9bd606
SHA256 d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331
SHA512 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\bin\src.7z

MD5 7c380ecd5bc2cd51511d0ee5b58df745
SHA1 615749979477621579dd9b04ada8d4dcd9430f1e
SHA256 38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07
SHA512 110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

memory/1956-154-0x0000000000AF0000-0x0000000000B30000-memory.dmp

memory/1956-328-0x0000000000360000-0x000000000036A000-memory.dmp

memory/1956-327-0x0000000000360000-0x000000000036A000-memory.dmp

C:\Users\Admin\Documents\krnl\krnlss.exe.config

MD5 0ed4b3831ff5e91dff636145f68aac4c
SHA1 2d1140812945dc1b9e400a88c911803639cb2e49
SHA256 03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347
SHA512 4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c

C:\Users\Admin\Documents\krnl\krnlss.exe

MD5 4d7c519cc2127f785d13694d7a281f33
SHA1 6d5d49494ca03fb99f7124197296d43c68d0c027
SHA256 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5
SHA512 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

C:\Users\Admin\Documents\krnl\krnlss.exe

MD5 4d7c519cc2127f785d13694d7a281f33
SHA1 6d5d49494ca03fb99f7124197296d43c68d0c027
SHA256 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5
SHA512 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

memory/1820-575-0x0000000001260000-0x00000000013E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7929.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\Local\Temp\Tar797A.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\Tar8055.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

memory/1820-761-0x0000000000670000-0x00000000006AE000-memory.dmp

\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

memory/1820-764-0x0000000000670000-0x00000000006AE000-memory.dmp

\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

memory/1820-765-0x0000000001080000-0x00000000010C0000-memory.dmp

memory/1820-766-0x0000000005770000-0x000000000582A000-memory.dmp

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

memory/1820-770-0x00000000068C0000-0x0000000006A0D000-memory.dmp

memory/1820-773-0x00000000068C0000-0x0000000006A0D000-memory.dmp

\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

MD5 8c51876f1b5dfbf4964732a65c1f2724
SHA1 ed5653a3a5655ba65d6221285da93799bd2517f9
SHA256 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e
SHA512 a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

\Users\Admin\Documents\krnl\bin\src\libcef.dll

MD5 8c51876f1b5dfbf4964732a65c1f2724
SHA1 ed5653a3a5655ba65d6221285da93799bd2517f9
SHA256 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e
SHA512 a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

MD5 6499ea6b92ab4971886bd06c12625819
SHA1 5ebb75eeca7625b9511233158a02f50a92867a39
SHA256 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b
SHA512 e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

MD5 6499ea6b92ab4971886bd06c12625819
SHA1 5ebb75eeca7625b9511233158a02f50a92867a39
SHA256 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b
SHA512 e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

memory/1820-782-0x0000000001100000-0x000000000110E000-memory.dmp

memory/1820-785-0x0000000001100000-0x000000000110E000-memory.dmp

memory/1820-789-0x0000000001250000-0x000000000125E000-memory.dmp

\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

memory/1820-792-0x0000000001250000-0x000000000125E000-memory.dmp

\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

memory/1820-796-0x0000000005830000-0x0000000005872000-memory.dmp

\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

memory/1820-797-0x0000000001080000-0x00000000010C0000-memory.dmp

memory/1820-799-0x0000000001080000-0x00000000010C0000-memory.dmp

memory/1820-798-0x0000000001080000-0x00000000010C0000-memory.dmp

C:\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

memory/1820-803-0x0000000007C20000-0x0000000007D74000-memory.dmp

\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

MD5 2ff7acfa80647ee46cc3c0e446327108
SHA1 c994820d03af722c244b046d1ee0967f1b5bc478
SHA256 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
SHA512 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

memory/1820-807-0x0000000001080000-0x00000000010C0000-memory.dmp

memory/1820-808-0x0000000001080000-0x00000000010C0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-29 20:08

Reported

2023-04-29 20:15

Platform

win10v2004-20230220-en

Max time kernel

374s

Max time network

428s

Command Line

"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"

Signatures

Lumma Stealer

stealer lumma

Downloads MZ/PE file

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-40b180a4-1.2.0\NetworkingGames\networkRequests\createGetExperiencesPlayabilityStatus.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Collections\InstanceOf.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\language\parser.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-0ba25b72-b001fcbe\RoduxFriends\Reducers\Friends\requests\byUserId.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.5\JestUtil\createProcessObject.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-d86ebb2a-ca453478\ReactReconciler\ReactPortal.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppHooks\RobloxAppHooks\useUiModeInfo.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Cryo\Cryo\List\map.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-4ad47a93-d2d12716\ExperienceChat\BubbleChat\ChatBubble\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\error\__tests__\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsTile\getFooterRelevanceInfo.test.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\PremiumUpsellDeps.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\Scheduler-a406e214-4230f473\Scheduler\TracingSubscriptions.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-948a3386-02a3ea83\RoduxFriends\Reducers\Friends\requests\receivedCount.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\Dev\TestUtils.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\content\textures\GameSettings\copy.png C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Rhodium\Rhodium\InputVisualizer.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\NetworkingPresence-1b011daa-31f6545b\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared-a406e214-4230f473\ReactDevtoolsShared\utils.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaApp\icons\[email protected] C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\ui\PlayerList\Report.png C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\UserCarousel\Components\UserCarouselContainer\init.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Squads\FloatingActionButton\init.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-42cf8478-4f9657ad\ExperienceChat\installReducer\ChatLayout\inputBarSettings.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux-presence\lock.toml C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\UserSearch\jest.config.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\MaterialGenerator\Materials\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\particles\explosion01_core_main.dds C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-42cf8478-4f9657ad\ExperienceChat\installReducer\init.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.5\lock.toml C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Shared-d86ebb2a-ca453478\Shared\formatProdErrorMessage.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\tutils-aa9a0351-0.1.2\tutils\equalKey.spec.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoverabilityModal\DiscoverabilityModal\Networking\FetchUserSettingsMetadata.test.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\installReducer\Friends.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\content\textures\StudioSharedUI\meshes.png C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RequestPipeline\Promise.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\StyleConsumer.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Style\Style\Themes\DarkTheme.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Style\Validator\validateThemedBackgroundImageInfo.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\JestCore\JestCore\lib\logDebugMessages.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageToast\MessageToast\MessageToast.storybook.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Localization\Localization\LocalizationContext.spec.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\msedgeupdateres_sr-Cyrl-RS.dll C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Template\DetailsPage\DetailsPageTemplate.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\Localization.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.64\Locales\az.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoactRodux\RoactRodux\connect.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\content\textures\ui\Settings\Players\Blocked.png C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\QRCodeDisplay\QRCodeDisplay\DisplayQRCode\ecToNumber.test.lua C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-64af4154-868f23dc\RoduxAliases\Actions\init.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\Shared-d86ebb2a-ca453478\Shared\PropMarkers\Tag.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Requests\ChatStartOneToOneConversation.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\PrettyFormat.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\RoactNavigation\getChildRouter.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\Enums\Pages.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\rules\custom\ C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoduxPresence.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\UGCValidation\UGCValidation\validation\validateTextureSize.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaChat\icons\[email protected] C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
File created C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\jest.config.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialLuaAnalytics\SocialLuaAnalytics\Analytics\Navigation\BtnValues.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\textures\ui\LuaChat\icons\ic-create-group.png C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
File opened for modification C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\ExtraContent\LuaPackages\Packages\_Index\ReactRoblox-a406e214-4230f473\ReactRoblox\client\ReactRobloxComponent.lua C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133272725575924778" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\ = "PSFactoryBuffer" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\roblox-player\ = "URL: Roblox Protocol" C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\roblox-player C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df12000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\krnl\7za.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Documents\krnl\krnlss.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4948 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4948 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4948 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4948 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4948 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4948 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe C:\Users\Admin\Documents\krnl\7za.exe
PID 4360 wrote to memory of 2680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 3632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 4512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 4512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe

"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"

C:\Users\Admin\Documents\krnl\7za.exe

"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1

C:\Users\Admin\Documents\krnl\7za.exe

"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb465b9758,0x7ffb465b9768,0x7ffb465b9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3272 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Users\Admin\Documents\krnl\krnlss.exe

"C:\Users\Admin\Documents\krnl\krnlss.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7c29c7688,0x7ff7c29c7698,0x7ff7c29c76a8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4912 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4424 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4332 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2760 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2860 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4508 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3940 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7ac,0x7b0,0x7b4,0x6bc,0x7bc,0xd057bc,0xd057cc,0xd057dc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2

C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

MicrosoftEdgeWebview2Setup.exe /silent /install

C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOTExRDQ5QS1CNDFELTQ0MTktOTY0Ri00QjM2QzkxODQyNDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDE3NjEzMTc4IiBpbnN0YWxsX3RpbWVfbXM9IjE3NjciLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9CE99956-FD1E-4655-83CD-BB05D11E6986}" /silent

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RUVCODg2Ni03NTU2LTRBMjItQjEyNS0zODE1NzkyQ0ZFMTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDI4MzczNDQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQzM1QkIxNy1BNkM4LTQxRTgtQTNBMS04QjYyNERCRkRFOUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuNjQiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwNDQ0OTI2NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDQ0NjQzODIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM3MTcyMzExMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZTk0MzI4YmUtMzY3OC00ZDA3LWI4YjMtMmU3ZTA1MTFiYTMxP1AxPTE2ODM0MDM5MTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZVpzQWlPZjNPZTd5ZHpmbDloQm5FZEZFb3FjaG9nSE0lMmI2bjFvaTBLVjhOaHNMNjZ5ZVVNNjVuNG9Eem1TRkVQa3BWb1JkdGNFU3N4UHVRdnljQ01pUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgZG93bmxvYWRfdGltZV9tcz0iMjI4MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzcyMDQyNzQ3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM5NjQ2MzE2OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI0MDM4MzE4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk5OCIgZG93bmxvYWRfdGltZV9tcz0iMzI3MjkiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iODQzNDYiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5000 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8

C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac+launchtime:1682799245721+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D745e3621-7cc7-4b94-bd35-7e0512661c21%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp

C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x738,0x73c,0x740,0x70c,0x714,0x7457bc,0x7457cc,0x7457dc

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=745e3621-7cc7-4b94-bd35-7e0512661c21&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799245721 --rloc en_us --gloc en_us -channel zwinplayer64

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" -app

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x72c,0x730,0x734,0x69c,0x73c,0x10357bc,0x10357cc,0x10357dc

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -channel zwinplayer64

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 404 -p 4464 -ip 4464

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4464 -s 1992

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w+launchtime:1682799337223+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D01c43e03-df9a-43b5-9afc-6e49eac81d55%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x560,0x564,0x568,0x53c,0x570,0x10357bc,0x10357cc,0x10357dc

C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe

"C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=01c43e03-df9a-43b5-9afc-6e49eac81d55&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799337223 --rloc en_us --gloc en_us -channel zwinplayer64

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 8.8.8.8:53 cdn.krnl.place udp
US 66.228.51.170:443 cdn.krnl.place tcp
US 8.8.8.8:53 k-storage.com udp
US 188.114.96.0:443 k-storage.com tcp
US 8.8.8.8:53 170.51.228.66.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 188.114.96.0:443 k-storage.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
DE 172.217.23.206:443 apis.google.com tcp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 crls.ssl.com udp
US 18.65.39.44:80 crls.ssl.com tcp
US 8.8.8.8:53 154.74.101.95.in-addr.arpa udp
US 8.8.8.8:53 165.184.237.34.in-addr.arpa udp
US 8.8.8.8:53 44.39.65.18.in-addr.arpa udp
US 40.125.122.176:443 tcp
N/A 224.0.0.251:5353 udp
US 20.189.173.1:443 tcp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 roblox.com udp
US 128.116.114.3:443 roblox.com tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 128.116.114.3:80 roblox.com tcp
US 128.116.114.3:80 roblox.com tcp
US 8.8.8.8:53 www.roblox.com udp
IN 128.116.104.3:443 www.roblox.com tcp
US 8.8.8.8:53 3.114.116.128.in-addr.arpa udp
US 8.8.8.8:53 3.104.116.128.in-addr.arpa udp
US 8.8.8.8:53 css.rbxcdn.com udp
NL 23.72.252.122:443 css.rbxcdn.com tcp
NL 23.72.252.122:443 css.rbxcdn.com tcp
NL 23.72.252.122:443 css.rbxcdn.com tcp
NL 23.72.252.122:443 css.rbxcdn.com tcp
NL 23.72.252.122:443 css.rbxcdn.com tcp
NL 23.72.252.122:443 css.rbxcdn.com tcp
US 8.8.8.8:53 static.rbxcdn.com udp
US 205.185.216.42:443 static.rbxcdn.com tcp
US 8.8.8.8:53 js.rbxcdn.com udp
NL 23.72.252.154:443 js.rbxcdn.com tcp
NL 23.72.252.154:443 js.rbxcdn.com tcp
NL 23.72.252.154:443 js.rbxcdn.com tcp
NL 23.72.252.154:443 js.rbxcdn.com tcp
NL 23.72.252.154:443 js.rbxcdn.com tcp
NL 23.72.252.154:443 js.rbxcdn.com tcp
US 8.8.8.8:53 122.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 42.216.185.205.in-addr.arpa udp
US 8.8.8.8:53 154.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 roblox-api.arkoselabs.com udp
US 104.18.42.229:443 roblox-api.arkoselabs.com tcp
US 8.8.8.8:53 200.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 229.42.18.104.in-addr.arpa udp
US 8.8.8.8:53 metrics.roblox.com udp
US 8.8.8.8:53 apis.rbxcdn.com udp
NL 23.72.252.177:443 apis.rbxcdn.com tcp
US 8.8.8.8:53 locale.roblox.com udp
US 8.8.8.8:53 apis.roblox.com udp
IN 128.116.104.4:443 apis.roblox.com tcp
US 8.8.8.8:53 images.rbxcdn.com udp
NL 23.72.252.145:443 images.rbxcdn.com tcp
NL 23.72.252.145:443 images.rbxcdn.com tcp
NL 23.72.252.145:443 images.rbxcdn.com tcp
NL 23.72.252.145:443 images.rbxcdn.com tcp
NL 23.72.252.145:443 images.rbxcdn.com tcp
NL 23.72.252.145:443 images.rbxcdn.com tcp
US 8.8.8.8:53 177.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 4.104.116.128.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 40.125.122.176:443 tcp
NL 142.250.179.138:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 ecsv2.roblox.com udp
NL 23.72.252.122:443 css.rbxcdn.com tcp
US 8.8.8.8:53 auth.roblox.com udp
IN 128.116.104.3:443 auth.roblox.com tcp
IN 128.116.104.4:443 ecsv2.roblox.com tcp
US 8.8.8.8:53 145.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 ssl.google-analytics.com udp
NL 142.250.179.168:443 ssl.google-analytics.com tcp
NL 142.250.179.138:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 168.179.250.142.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 assetgame.roblox.com udp
US 8.8.8.8:53 chat.roblox.com udp
US 8.8.8.8:53 contacts.roblox.com udp
US 8.8.8.8:53 notifications.roblox.com udp
US 8.8.8.8:53 economy.roblox.com udp
US 8.8.8.8:53 friends.roblox.com udp
US 8.8.8.8:53 privatemessages.roblox.com udp
US 8.8.8.8:53 lms.roblox.com udp
US 8.8.8.8:53 tr.rbxcdn.com udp
DE 23.32.238.91:443 tr.rbxcdn.com tcp
US 8.8.8.8:53 thumbnails.roblox.com udp
US 8.8.8.8:53 accountsettings.roblox.com udp
US 8.8.8.8:53 presence.roblox.com udp
US 205.185.216.42:443 static.rbxcdn.com tcp
US 8.8.8.8:53 iad4-128-116-102-3.roblox.com udp
US 8.8.8.8:53 c0hw.rbxcdn.com udp
US 8.8.8.8:53 aws-us-east-1b-lms.rbx.com udp
US 8.8.8.8:53 syd1-128-116-51-3.roblox.com udp
US 3.226.10.132:443 aws-us-east-1b-lms.rbx.com tcp
US 8.8.8.8:53 mia4-128-116-45-3.roblox.com udp
US 128.116.102.3:443 iad4-128-116-102-3.roblox.com tcp
US 8.8.8.8:53 aws-us-east-2b-lms.rbx.com udp
US 128.116.45.3:443 mia4-128-116-45-3.roblox.com tcp
AU 128.116.51.3:443 syd1-128-116-51-3.roblox.com tcp
US 3.22.16.252:443 aws-us-east-2b-lms.rbx.com tcp
US 8.8.8.8:53 realtime.roblox.com udp
US 8.8.8.8:53 91.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 3.102.116.128.in-addr.arpa udp
US 8.8.8.8:53 132.10.226.3.in-addr.arpa udp
US 8.8.8.8:53 252.16.22.3.in-addr.arpa udp
US 8.8.8.8:53 3.45.116.128.in-addr.arpa udp
AU 128.116.51.3:443 syd1-128-116-51-3.roblox.com tcp
US 8.8.8.8:53 trades.roblox.com udp
US 8.8.8.8:53 3.51.116.128.in-addr.arpa udp
US 8.8.8.8:53 17.211.227.13.in-addr.arpa udp
US 8.8.8.8:53 games.roblox.com udp
US 8.8.8.8:53 followings.roblox.com udp
US 8.8.8.8:53 badges.roblox.com udp
US 8.8.8.8:53 sin2-128-116-97-3.roblox.com udp
SG 128.116.97.3:443 sin2-128-116-97-3.roblox.com tcp
US 8.8.8.8:53 lhr2-128-116-119-3.roblox.com udp
US 8.8.8.8:53 aws-eu-central-1a-lms.rbx.com udp
US 8.8.8.8:53 nrt1-128-116-120-3.roblox.com udp
US 8.8.8.8:53 aws-eu-west-2c-lms.rbx.com udp
US 128.116.120.3:443 nrt1-128-116-120-3.roblox.com tcp
DE 3.123.122.247:443 aws-eu-central-1a-lms.rbx.com tcp
GB 128.116.119.3:443 lhr2-128-116-119-3.roblox.com tcp
GB 18.168.250.97:443 aws-eu-west-2c-lms.rbx.com tcp
SG 128.116.97.3:443 sin2-128-116-97-3.roblox.com tcp
US 8.8.8.8:53 voice.roblox.com udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 3.119.116.128.in-addr.arpa udp
US 8.8.8.8:53 247.122.123.3.in-addr.arpa udp
US 8.8.8.8:53 97.250.168.18.in-addr.arpa udp
US 8.8.8.8:53 3.120.116.128.in-addr.arpa udp
US 8.8.8.8:53 accountinformation.roblox.com udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
NL 216.58.214.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 3.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 setup.rbxcdn.com udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
US 8.8.8.8:53 64.19.222.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ephemeralcounters.api.roblox.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 setup.rbxcdn.qq.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.qq.com udp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
US 8.8.8.8:53 setup-ak.rbxcdn.com udp
US 8.8.8.8:53 setup-ll.rbxcdn.com udp
US 8.8.8.8:53 setup-cfly.rbxcdn.com udp
US 8.8.8.8:53 setup-hw.rbxcdn.com udp
US 8.8.8.8:53 www.roblox.com udp
IN 128.116.104.3:443 www.roblox.com tcp
US 8.8.8.8:53 68.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 188.155.64.172.in-addr.arpa udp
US 8.8.8.8:53 setup.rbxcdn.com udp
NL 23.72.252.138:443 setup.rbxcdn.com tcp
US 8.8.8.8:53 138.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 ncs.roblox.com udp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 20.114.58.89:443 msedge.api.cdp.microsoft.com tcp
NL 216.58.214.3:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 89.58.114.20.in-addr.arpa udp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
SG 8.241.152.126:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 126.152.241.8.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
IN 128.116.104.3:443 ncs.roblox.com tcp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
US 8.8.8.8:53 client-telemetry.roblox.com udp
IN 128.116.104.3:443 client-telemetry.roblox.com tcp
IN 128.116.104.4:443 ecsv2.roblox.com tcp
IN 128.116.104.4:443 ecsv2.roblox.com tcp
IN 128.116.104.4:443 ecsv2.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
IN 128.116.104.3:443 client-telemetry.roblox.com tcp
US 8.8.8.8:53 setup.rbxcdn.qq.com udp
IN 128.116.104.3:443 client-telemetry.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.qq.com udp
US 8.8.8.8:53 setup.rbxcdn.com udp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
US 8.8.8.8:53 setup-ak.rbxcdn.com udp
US 8.8.8.8:53 setup-ll.rbxcdn.com udp
US 8.8.8.8:53 setup-cfly.rbxcdn.com udp
US 8.8.8.8:53 setup-hw.rbxcdn.com udp
IN 128.116.104.3:443 client-telemetry.roblox.com tcp
US 8.8.8.8:53 setup.rbxcdn.com udp
NL 23.72.252.138:443 setup.rbxcdn.com tcp
IN 128.116.104.3:443 client-telemetry.roblox.com tcp
US 8.8.8.8:53 ephemeralcounters.api.roblox.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 apis.roblox.com udp
IN 128.116.104.4:443 apis.roblox.com tcp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
US 8.8.8.8:53 ephemeralcounters.api.roblox.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 setup.rbxcdn.qq.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.qq.com udp
US 8.8.8.8:53 setup.rbxcdn.com udp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
US 8.8.8.8:53 setup-ak.rbxcdn.com udp
US 8.8.8.8:53 setup-ll.rbxcdn.com udp
US 8.8.8.8:53 setup-cfly.rbxcdn.com udp
US 8.8.8.8:53 setup-hw.rbxcdn.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
US 8.8.8.8:53 clientsettingscdn.roblox.com udp
US 8.8.8.8:53 setup-ak.rbxcdn.com udp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
US 8.8.8.8:53 setup-ll.rbxcdn.com udp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
NL 23.222.19.64:443 clientsettingscdn.roblox.com tcp
IN 128.116.104.3:443 ephemeralcounters.api.roblox.com tcp
IN 128.116.104.4:443 apis.roblox.com tcp

Files

memory/4948-133-0x0000000000ED0000-0x0000000000FFA000-memory.dmp

memory/4948-134-0x0000000005B20000-0x0000000005B30000-memory.dmp

memory/4948-135-0x0000000005B20000-0x0000000005B30000-memory.dmp

memory/4948-136-0x000000000A160000-0x000000000A168000-memory.dmp

memory/4948-137-0x000000000A450000-0x000000000A488000-memory.dmp

memory/4948-138-0x000000000A4A0000-0x000000000A4AE000-memory.dmp

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\bin\Monaco.zip

MD5 1a19fd7c42169c76e75e685dca02c190
SHA1 f16b4697bcd348d44965bf9ded731523db9bd606
SHA256 d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331
SHA512 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

C:\Users\Admin\Documents\krnl\7za.exe

MD5 ec79cabd55a14379e4d676bb17d9e3df
SHA1 15626d505da35bfdb33aea5c8f7831f616cabdba
SHA256 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA512 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

C:\Users\Admin\Documents\krnl\bin\src.7z

MD5 7c380ecd5bc2cd51511d0ee5b58df745
SHA1 615749979477621579dd9b04ada8d4dcd9430f1e
SHA256 38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07
SHA512 110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

memory/4948-233-0x0000000005B20000-0x0000000005B30000-memory.dmp

memory/4948-234-0x0000000005B20000-0x0000000005B30000-memory.dmp

\??\pipe\crashpad_4360_HNRXKCWXVOMKDOHR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Documents\krnl\krnlss.exe

MD5 4d7c519cc2127f785d13694d7a281f33
SHA1 6d5d49494ca03fb99f7124197296d43c68d0c027
SHA256 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5
SHA512 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

C:\Users\Admin\Documents\krnl\krnlss.exe

MD5 4d7c519cc2127f785d13694d7a281f33
SHA1 6d5d49494ca03fb99f7124197296d43c68d0c027
SHA256 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5
SHA512 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

C:\Users\Admin\Documents\krnl\krnlss.exe.config

MD5 0ed4b3831ff5e91dff636145f68aac4c
SHA1 2d1140812945dc1b9e400a88c911803639cb2e49
SHA256 03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347
SHA512 4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c

C:\Users\Admin\Documents\krnl\krnlss.exe

MD5 4d7c519cc2127f785d13694d7a281f33
SHA1 6d5d49494ca03fb99f7124197296d43c68d0c027
SHA256 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5
SHA512 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

memory/3788-664-0x00000000008F0000-0x0000000000A74000-memory.dmp

memory/3788-669-0x0000000005900000-0x0000000005EA4000-memory.dmp

memory/3788-672-0x0000000005350000-0x00000000053E2000-memory.dmp

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

memory/3788-685-0x0000000006AE0000-0x0000000006B1E000-memory.dmp

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

MD5 5f79e7737e5e8be2cf8711374c114e85
SHA1 86eabaa284074dd2f86f856cea043061091897ef
SHA256 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72
SHA512 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

memory/3788-688-0x0000000006B20000-0x0000000006B5C000-memory.dmp

memory/3788-689-0x0000000006AA0000-0x0000000006AB2000-memory.dmp

memory/3788-690-0x0000000007180000-0x0000000007798000-memory.dmp

memory/3788-691-0x0000000006E70000-0x0000000006F7A000-memory.dmp

memory/3788-692-0x0000000006D90000-0x0000000006DA2000-memory.dmp

memory/3788-693-0x00000000055D0000-0x00000000055E0000-memory.dmp

memory/3788-694-0x0000000006E00000-0x0000000006E50000-memory.dmp

memory/3788-695-0x0000000006FF0000-0x0000000007056000-memory.dmp

memory/3788-697-0x00000000077E0000-0x000000000781C000-memory.dmp

memory/3788-698-0x0000000007880000-0x00000000078D6000-memory.dmp

memory/3788-699-0x0000000007E10000-0x000000000833C000-memory.dmp

memory/3788-700-0x0000000007850000-0x0000000007872000-memory.dmp

memory/3788-701-0x0000000007820000-0x000000000783E000-memory.dmp

memory/3788-702-0x0000000007C40000-0x0000000007C5C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

memory/3788-708-0x0000000008810000-0x0000000008CDC000-memory.dmp

memory/3788-711-0x0000000007D00000-0x0000000007D0A000-memory.dmp

memory/3788-712-0x0000000007D30000-0x0000000007D50000-memory.dmp

memory/3788-713-0x0000000007D80000-0x0000000007DA2000-memory.dmp

memory/3788-715-0x0000000007D50000-0x0000000007D70000-memory.dmp

memory/3788-718-0x0000000008340000-0x0000000008372000-memory.dmp

memory/3788-720-0x0000000007DE0000-0x0000000007E02000-memory.dmp

memory/3788-722-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 68960caba526b3e93542e6d7d1ec2ca1
SHA1 403fd6904cf390c4ebd1b343baeb0caa581ce8ea
SHA256 ffdad0e8352853898b7877afc8d2c91fb42dc98f4fede58d4edcad582c591636
SHA512 869de8496f9451eac5d19b9bd50936345ed8e83b9947e70c5fb6fca3d17ac2c6498a5d09ecc201423c5c32c6f0ac7199f0d435a620323074183bb63f90f3bb4f

memory/3788-728-0x0000000008450000-0x000000000851E000-memory.dmp

memory/3788-729-0x00000000083D0000-0x0000000008414000-memory.dmp

memory/3788-730-0x00000000083A0000-0x00000000083BA000-memory.dmp

memory/3788-731-0x0000000008650000-0x0000000008772000-memory.dmp

memory/3788-732-0x0000000008580000-0x00000000085E0000-memory.dmp

memory/3788-733-0x0000000008520000-0x0000000008544000-memory.dmp

memory/3788-734-0x0000000008780000-0x00000000087C4000-memory.dmp

memory/3788-735-0x0000000008550000-0x000000000857A000-memory.dmp

memory/3788-736-0x00000000087D0000-0x0000000008802000-memory.dmp

memory/3788-737-0x0000000008D70000-0x0000000008DFC000-memory.dmp

memory/3788-738-0x0000000008F80000-0x00000000090F6000-memory.dmp

memory/3788-739-0x00000000093D0000-0x000000000946C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 db70e8b33a19030ee16166f08e245bad
SHA1 192d540079291a5efc6033d9ca5d7629334df321
SHA256 8bfece289710096698cea6dccafc4b924f0889f1eafff213fbd5a4523d404b24
SHA512 b0d3d5401047471524d77a8668d69a487b085aa95830a80f697233b9150765d3d8740dbec2517027c5b1e0b8faa77825f70784608888c463477f5547460b3335

memory/3788-745-0x0000000009600000-0x0000000009786000-memory.dmp

memory/3788-746-0x0000000008E00000-0x0000000008E66000-memory.dmp

memory/3788-747-0x0000000009530000-0x00000000095EA000-memory.dmp

memory/3788-748-0x0000000008CE0000-0x0000000008D02000-memory.dmp

memory/3788-749-0x0000000008630000-0x000000000863C000-memory.dmp

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

MD5 c7430597fb837d6bc7549b988bdc78a5
SHA1 447d90f6cad3afe3d2c47fd45f730c68d3201990
SHA256 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88
SHA512 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

MD5 8c51876f1b5dfbf4964732a65c1f2724
SHA1 ed5653a3a5655ba65d6221285da93799bd2517f9
SHA256 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e
SHA512 a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

MD5 6499ea6b92ab4971886bd06c12625819
SHA1 5ebb75eeca7625b9511233158a02f50a92867a39
SHA256 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b
SHA512 e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

MD5 6499ea6b92ab4971886bd06c12625819
SHA1 5ebb75eeca7625b9511233158a02f50a92867a39
SHA256 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b
SHA512 e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

MD5 8c51876f1b5dfbf4964732a65c1f2724
SHA1 ed5653a3a5655ba65d6221285da93799bd2517f9
SHA256 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e
SHA512 a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

memory/3788-764-0x0000000008F60000-0x0000000008F6E000-memory.dmp

memory/3788-770-0x0000000008F70000-0x0000000008F7E000-memory.dmp

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

memory/3788-776-0x0000000009DA0000-0x0000000009DE2000-memory.dmp

C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

MD5 103d84c4a22967defcbedaea6e11720f
SHA1 f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2
SHA256 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2
SHA512 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

MD5 5e5fe029bff022007c27d024ae7cf262
SHA1 fb7250ec8ca1acd36023b966fae61e85fe2c8ab4
SHA256 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b
SHA512 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

memory/3788-777-0x00000000055D0000-0x00000000055E0000-memory.dmp

memory/3788-760-0x0000000009A30000-0x0000000009A7A000-memory.dmp

memory/3788-778-0x00000000055D0000-0x00000000055E0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 484b05819eeb000de58b456381b42072
SHA1 e559d19664c0d50d1b55a02d1c992175d4df7442
SHA256 bfdc093cffc163fcc7598d08c02951ef9a9cd8291e03b069d82795490ef8308a
SHA512 c5bdeff92d584d135a4982723447d0c81b46a7234088ac2bb015b9d2ae1322483de02d302d679f36e87dff0b28cc15d5663beee4f11d2aedbed3214cddc5838b

memory/3788-789-0x000000000C700000-0x000000000C800000-memory.dmp

C:\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

memory/3788-790-0x000000000C960000-0x000000000CAB4000-memory.dmp

C:\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

C:\Users\Admin\Documents\krnl\ScintillaNET.dll

MD5 9166536c31f4e725e6befe85e2889a4b
SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

MD5 2ff7acfa80647ee46cc3c0e446327108
SHA1 c994820d03af722c244b046d1ee0967f1b5bc478
SHA256 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
SHA512 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

memory/3788-807-0x000000000C8B0000-0x000000000C926000-memory.dmp

memory/3788-811-0x00000000055D0000-0x00000000055E0000-memory.dmp

memory/3788-850-0x000000000CAE0000-0x000000000CAFE000-memory.dmp

memory/3788-939-0x00000000055D0000-0x00000000055E0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 9b020fec1be1b52a015ebf72bf8eb239
SHA1 9db2ae296341ff4ab253453986bf2ad175a21661
SHA256 8a38a8f225dfec2abada16a2dc3a7107353672ebd8738e3c08c4cb320dfc77f4
SHA512 1ad212cbd9a97f6ecd766e0b9228424c7ab142674980b8aa517f6370e1241402bf2d0dc0622935ddc4cccf5622bda6f5b742d1b0469ab0987f39a820052fe74e

memory/3788-955-0x00000000055D0000-0x00000000055E0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f765110-dd2a-4f2b-81da-c805ccda5493.tmp

MD5 b349e14ce7e14447aab2be060b0562aa
SHA1 7fef61c36b1a641f340a7c9880909c5e6a4966fa
SHA256 4165dc396c234ed2e51d4707ee5493ff518c60ad6564f0af850f43ea134d0771
SHA512 b177e3771e6c57c87b25d5429430e9f47d48a49a0c581bdf4e8b5ed9aceaf411a076f30fb7465fc6acee33bd91ae871f3edeffb2db0093e73419120f71784ad2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c52fbd991d63b40b7c090a4a45e1a9ee
SHA1 6dfd1bb26c55de038f48c96d4340d4805caee9e1
SHA256 6fa7bae6058ecc607a3a0c642bd699380c8fde86a8d60c10035ecfe5e4959be2
SHA512 8e07b0d7a52309d4d3d3f5a120d9c9faf1eb5195cd88ace20345761b352a424b0d50bbe357f3fd5831cfb419f0314d3856abca0f0024f1fce451823174d7a643

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 cac33b802514f5c0a0db935041cff84b
SHA1 c09a109278a37251a4de145a88dff090c6cae7af
SHA256 af858897a7b5cb65a71512cf0594ebd72a45608df329c5076f454792c36d0a3d
SHA512 4e47caeb82393d68362c128f8efa93b14f10b00d7c819561e14652cb66be46ebfd0359b1baa9fb3c7ecd055d0dc4fa4995b4ade55d489eb2a4441657169fde5d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f624fb8-2bdf-4b25-bede-6fb8e36d3573.tmp

MD5 ede1f9ae6f6b66194a717c77820cd9fb
SHA1 c3e0fcdeca9c2739d9b138aadae083780b8297eb
SHA256 b9ec406fb04eb50ee181e9321530d3b2c5863e5f5dadecf40a8f56fe6401c797
SHA512 90d477d508aa709005b3c6f71e7e54394f47f516849439ec0a187ad4ca3fd88f36c8ff41f701ebca6abcf6ebd88518d23967cfb58e528cade5675c7735d04e11

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 34b97f8b9e4296af5238fc8f67586b72
SHA1 e6c4b92901c1a9d8aa6a7247143c2560a90efaba
SHA256 70c158c98bf7abf5e0bb3167edf6ed0d378f9380fabcf281cf0fe59623a0c774
SHA512 0df677459ce64c61aa109aeabcf8f91e5a19a98ddc3426818d5cb256e05abab604b2455296e83fd4687798f6f241d470af431ac9e153df95283186c28c3ab4d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5 9607b1f17ee9215cb98d30fadf7d8f07
SHA1 02f24d48c3b75b001c34b0bd447d3f48e27721fa
SHA256 ed1667af355f9c82290a4ea786ea0a4a96bda9a6730a0e81ed42bfdbc798f3ee
SHA512 c290ce91e1c03646b3f4ccdeb3b7e7f470d8e574925fd8a0b71d6dd58f29af3fd4eb6099f2bba921424ab8fd42d97430107f9944af4b7c53ce4f10caf94a0815

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

MD5 c12075d6afcfce79df001ecba960cc0a
SHA1 f11913a40353bc451298b24b47642c65d591c2b8
SHA256 3d738adbbd4904e038babeab34d1481963921df6d8e7fe721e84649f1518cf05
SHA512 b4732bb0b6c5edb0f9d42e1f3d3facb8752c81bb70c3c7982ab14d7380b2bac31c367b77a11163592a511ac13ef894009846760a0a1246eaeb9df11c6408132c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 77de238191b6471e1e61f2296d8ad069
SHA1 86bacc69b58a36eddd2c0e4735fbb59ace86a016
SHA256 c79f1a985f03ebeb6103a490c14e7cd30d68c5aa8eb610d211d5637237ece106
SHA512 c131e2da233421550559d103b75b6875380c6f137455b9724f4009bbd41f63d515b02c1550a7c5a9532faddc44a958728f551c5342deadd94434e7d7266fb34e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 99db85bdf43a99138d5a50a2fe2af148
SHA1 585fac72ef1803fec5b3d56891ba7df34790e54b
SHA256 3552f164eb60f8d901ad669283fb0015af59c8cf015f4e42237ff274f8dce7b1
SHA512 8e2e9a1dac6b9ffa1281a7691b0cbac05c8ea082c74c8d25851dd93b7bef545f57a663a83068f1307117f692dd9a701dc97fc45aa8953b3e9a7b0f9e8b75be02

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

MD5 01d5892e6e243b52998310c2925b9f3a
SHA1 58180151b6a6ee4af73583a214b68efb9e8844d4
SHA256 7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d
SHA512 de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f343325dff5e63c0fe34bc3bf2c91ef4
SHA1 3d433dc78cf8eef3474761e8140d500e75ea52de
SHA256 b8e5e328f5d2ce87abe2b7bf2ae518f5b1033e064c2b83cf03535447535456b8
SHA512 bfb3385f6dc937a418aa6705bcab565676eafa96ad95c37d274159f11eef26523e555ce398e665b59991a045a222289852002dfc08ca7a1fb3b297d75727584d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 a652635ac4b368f74e8f8995db8ca632
SHA1 fc35b20b082f8927bf88815505a26f698609b070
SHA256 3eaf7717f1321500a397c5f04f48045410912bd5b3dbf1ce2700694f380fffda
SHA512 19023ae364d78e3a23231d9e9ba0bbcabe22c373f0331bf71d5cd0e62a7732db6238ef43c99e48ad1169f4ad87806283d04d0cbf4221a588ec11fca818e8053c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582054.TMP

MD5 adb0e6874083b5271ff04ed2c2f392a0
SHA1 d3f72ba64d7cb9bf92d1460258580b690eaf915b
SHA256 eb74a522eceddd34d43a6ea18ea091022f8b1d9dbf572dcd9da861ba1e6a3fa9
SHA512 b31cd8387054e725987857801f22558c11b7bf0d20a73a911ddd2edb57d2992a134ec895d6fe84aa491d33550251263744044ce817db318a7c68a95242855182

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 575d707c3776c167a259891f3e5419ae
SHA1 6f43b2c16fcec7e9f9b4be14e64efa4823ae46f4
SHA256 9cd86e57b5ce4af0fab011a8176189fbe9351646c947407c7a012f42c92e6952
SHA512 3653401d7a4b657bce84038f159d172b1e6bd0dcd39fcb95afd02e4bee48797a5efb00c9ed2b3ebc8e6bc0414b60b3ddec81442b48bd3090e518b3b64e8726f8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 34bf4cc5a498295c7739db9b1cb7c2e0
SHA1 565dd62bdad19f15b2d7b025dfedb1a6f2baceb8
SHA256 fbdfa12b684460113787be26a705fe5751b3c275260ca9bb83981de7655d5af2
SHA512 b1a8e3aeb4e84c64c3728f8991428386e12c9eb84f9d6364be2ddb6897344af049aeacd220aaa20b87753fbb2302ba1fb73cdebc472b1084c8a5849221b526fc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7525fc346f07f54107a82e5607a81de5
SHA1 c8bb8b4f7b8e079bfc2442f926e5614cf05739a2
SHA256 94eb1ffd3312040dc73ffb3aab104b190a3b44375cc9ab696c7c80458207d361
SHA512 289fde686b8f04ca2608c963c1cf5f88ea89a8b32e31b582a621b0e6de8f83dabc52db00eb38cb6453518a82f1b56425ae11794f50d5fd39c0c6839589a58bec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 adb18cb531c8ed9ba1468aaecb2a7851
SHA1 4c50f057528b16dd6a021e3b4ed6e97efe15de89
SHA256 3c7a47d98976e793683e2560c8e2eede52460c362fcbfd328eefdbd148f4d48f
SHA512 dfc8749272424f766d23a0a49e5600f690244e6a852e6a574a4f5e4cd6e6d9a816f4c117f304a253afefcbde9f928b58cabe5a57f1882c1244f9fdbccffa0a28

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 fd013531c8c3a230e061c5cf1c62dfe5
SHA1 7e430c9eca4debe6e579bf1da616e9a220959b7d
SHA256 4cb75365faef44cb49afee32c1c1ec52f1323265ffe650c58d8c55c6cc57a53f
SHA512 67e154c60d3f8ffce29b32ada03c8eba8c151ce7ef09bc0b45f4c5d779f19898dcef4b2289f28f59f573831c9ded2b3a403b9deb5ead0be8ea965a2156f7c4e3

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

MD5 623cd7b48f9b5f0bfd233ebb930cff82
SHA1 ec32d6a43eac16209aafae6cb3912c398e9b80c0
SHA256 e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0
SHA512 107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

MD5 623cd7b48f9b5f0bfd233ebb930cff82
SHA1 ec32d6a43eac16209aafae6cb3912c398e9b80c0
SHA256 e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0
SHA512 107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 1a3025e0cf2cc86be5d8806bcec52ddd
SHA1 0ce2b0e9a25768f155fea1b4441d99a221409b8f
SHA256 7dba031b209366d6de98fa77486b40eae05ca205366cd4b712cc4c115abe3bb9
SHA512 7b4d76d6c236f1c3f98b32992564deb892f9aa42b02d1f13425674d5ee3eee27baba72ab32fccdf3c47cbcfd2f9a13c7731c742c23f057619221cd6e89c23289

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\BatchIncrement[1].json

MD5 bedbf7d7d69748886e9b48f45c75fbbe
SHA1 aa0789d89bfbd44ca1bffe83851af95b6afb012c
SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
SHA512 7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 abd3f419f55fbc5d34d66b8ff1c8d996
SHA1 166616e826c5212c3f916cc4987d1d7121212833
SHA256 12179d3ba822a4663234a5876012dfd3605ded1c471248909c9e39d9b84a65b8
SHA512 fb87e2f24c52bdde7e8133f1b64540ce0b99921d8a9c48983e24b8213b3042b9328da78201b2ba7921337c6dab4b5234928d20d288686299e7825194497461da

C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

MD5 3bf891bf24d2216d1f799334d88a14ec
SHA1 0962cdfcac41c498ea9469df19c4f6e069be04af
SHA256 bea0ba994ac766b5956695f0520fb9dfb2c6a73f4e9fff349d29efd39163bf94
SHA512 7d6ba4776c4916729018cf3c486095e9f57d2e1b2954a576efb00931f1d8e3fa989e9a7e3a05a36bcd1bea5a30112abf5999e1ed0e90045ab64b9af6d2f2c48c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 b3469483234412c8be7809ee38d7bce9
SHA1 35318fab62bcba91cb7a8c8e309bccde7178e57a
SHA256 35c7f29e318e6d92dc666ef9f472af82da610ddd4177f6ebbc1debd7de01611b
SHA512 9f4b13019048c15608b8748f28d7fbc9044b5da286f3a7183461b460d8a2381aa42546713bcd6a6cc9a84c0ecdbcdba4c0c1aa3d963c942777fbb43d0c7538f5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ff60bef30d3a32ece074258a0c1fc77f
SHA1 367ac44a2a8b2503fc60cb08c84e5837e769a27f
SHA256 d0b997652ee911d21593bd7284e1605461adf3d54252d7b532d9b7e08e54a46e
SHA512 1cfc47aa01f8f56b40ca70dfd8d16a7ee65dd4ba7e0efc13f489e55604e42249acfb9b7395091768c03b36611e0f634841238bb714aa649c343c69f7376be037

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 09bcbc21ddde0355274fc76294a40c1a
SHA1 b8da5c10199161d5cbc968ca6242958466437dee
SHA256 b2383ca375efdf79b8589df52e8f14a7385b9ce67f857c44ca81b9eb8ed1fdff
SHA512 8b02ccbb98930c69bb565511230cb258c5f5e0ac6da7c8e2c05e822f4087b8626b19e7022d5f7724f4576514a3db6662dfb6e1dc48be710817d4f7d0350a2621

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ac6347fe8fed0d4777c68127260b56aa
SHA1 de4b284bfa3234a60b0dde5a171189fdd8c9f973
SHA256 64f479329d07c56b4276c102f5543451007d479668f80506962defdf69bae85c
SHA512 7905247fd976d4022e2a4b8ddbe5f5f44e6f80ad929262185aa892456310d941a8d1e3257ac6dc6edfac3665bbaf98271e416b27535968ad9e704b22586474a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 9ddb0fc333ca0f4067844bc55e01542f
SHA1 3acfd1cfa60e15bd70905461a5b7984e0bd066c3
SHA256 fddb14e0327a5339d7821ba7695abc4d7ecc8c226a78ec610e23bdc6264d797b
SHA512 efd9b2bf36d4f0e472256d063aea448d6ae14fc4b5a75fe081553e0f32a2a280a792847c943b4100ee67cb50591e2be4c37e68d7570a00b5903b629c043016de

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

MD5 4dc57ab56e37cd05e81f0d8aaafc5179
SHA1 494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 6b05382235bc0418a5da0051530ce873
SHA1 d31b0d0a6ae6de908ef3bb3ab169a16f3d82eceb
SHA256 0747310a01030b2c88ba9f1063932eb24814651c34a39254071dcd00dd7a812f
SHA512 c49d19639e84124b43fcf5cc4f3c993ead41c3fe56c21b01266e5b1845f77b3a62bc36f93d2eeb9c2d2da313f9eaa69d427201c5cfbc0c105e072804ee2ffd34

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ac6ce51052fc6c86a49489c82fc658fb
SHA1 67ef6cacc86b0b5e8a26080f1dc6f86618daff2a
SHA256 75a8d2e5b455e0908ea5fb4098b0b2b893113c40c4828bc1ef215d1cc3118039
SHA512 ea43816a1267ca3d4696003805ad68ac9237b5f59100b0ecf5e1b3c2e86ad6e49d21f4703dff847618ffa000be54b6806c55879a2ae654a0415d6f1687d35d5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 55c96751eda5a24324c2fa0498877bb5
SHA1 53cfb2f1a5ba7353124044836890e305b1044124
SHA256 229683735f98a2ed80ae0c594f77f8c5ea9a4c2288c9ddc9065b487ff7adf328
SHA512 2332f14508bda0737f08afaa7428f042fa0c4c1354b69da71a58e9e2215b9bc49f45a30fccc0b93dace8fe58565ea5c812d9ef0c90613460f14c7e013ec815da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c069834d056b8049130823ac0c4101c9
SHA1 0e3c1bac428402693f533b6caa59c5e0126eed5c
SHA256 0b1e480a9ca07e801360d893c10fd31e5a30a27d6d82149e9559d82ff1ef94ea
SHA512 a1f26a43df0605451bd3480a8ea7ed34eedc309884ffe7366d811fd5a2f847c0135c06ff8ef21a3c7b98dc902167af84e799706adb4bbac49aa3d6bfa9ed580a

C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\112.0.1722.64\MicrosoftEdge_X64_112.0.1722.64.exe

MD5 b389a801f3373bc45a2b85335da47aac
SHA1 ee244117aa01a2009112ab5d4e8d562fa665de85
SHA256 4ad07fd7bcf2326f110b1902942c884ae0e2b67ca0e48e010b6be4ee11d1fd2c
SHA512 4015dada1088fd6179ec8fac0288e7454125bf3159e1d666301e48873d17efdf77d2a79492a2623047a246fb4648382cf01b667095b4beb5ccf3087366051639

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b804b80b2f8dc684e1e3490bb93aecb1
SHA1 5b01be9e1a490e162add7018c622f56e267257c8
SHA256 3ec33946939114598f33ac297542d8c67693395d6d2d16def2c2b0f4957306d9
SHA512 5d1904d79bdf1aa55a1131984b6ffc734c5d0285177b326e910a18708edb6c64c1a273e8c4a51186bce8df986d0daa10133f76e6719a7d69e18359c3f836e453

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b3fa13fa1493d979f87dad1d5ff87ef7
SHA1 0370383e1eb27f7120bfb3ccc7e2d0b04fd5d7d9
SHA256 41e3d024793199e228176c480d5c2c48e3ff7e77a1d77f8235d19c1ad60381a6
SHA512 8eaa8642e834db583bc87663fa0f12269eab07f90a3e76785464d669246163d7ef805507493b938a1de50a0232e36587e906f488c9da3a0fe5bf062fdcad78a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4f34519b7e5669fb4b8f6830ab7e74aa
SHA1 347d27b6b5f41336adb4ce9a7acafac2ff24be72
SHA256 65bbe81656adbbdfd81a55f9a072110d1444a49dbde34951d148a2992feab8e4
SHA512 60ff4eefe147cc8d44c11871274abf978df16f3004b202a3ce86404c50699db1e03c5f10c23a569fa28f0dc5691e4ce3801f58e9242943d6d93c30ee6fd05bca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d7ef0a5d8d4b606d0f84de4293917dda
SHA1 a2e2cfbc6f16f7dd11a46c2c240103dcc23b23a3
SHA256 fc1152dbfc557de59a7902d13c90a17101a581af6f71f1620de3f8f1c31c5bc0
SHA512 1fb2b1c02b804094d03ccb242a54e99933430d188230c70bc03a71791b1e683efe3c4afdb592dff72797a260cbe02d601ad6d399080876a5f507755b90d83551

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dfbcd0672dd375750eae47d367782b93
SHA1 de1aa0cf0df8d83f5fec2e8e61b9d7daabea37ec
SHA256 83267f7929f73bfcbbfea963214303c691a47eb37dac63e9d71ce3a27e5f2f80
SHA512 cd33b4c15e44f0c44f78b48782bc5d420dc9d78c75c724a2af5c6e7d5eaf5d084193f19cd4396e0774831af5cf41b3f4ef9e536847c19e8f21822fd746c63ba8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 02f2b2866b21720c4742e3a172a94098
SHA1 adca9b9c46144725c9a88f42e6a3869beaec85f0
SHA256 0464d390837fce2b5082bb1d29d238c538401b0363a710e8194f55ec248f8ebe
SHA512 4946d48b17911899614365094ec051d710c8dd9a7adaeccb5c052143acc60bd801bc36c7526cf393d3ea5a2b405921654bbbe41b0a45ad9bc3ec8d45b461abc4

C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.64\Installer\setup.exe

MD5 55dbfedec31ce800442d30f4e65c9ec2
SHA1 2ebc1bac365e2e1ae73089bebdeaabef6c8ebd7b
SHA256 69afeb4fd99981b52d947c2b0255bcef3768bfe1e2643e14971e2d5916749c94
SHA512 af87bfd9dd0f4375a551829a3d711bfb32c4c02225cb30246d0e19cfa5d7f4b288c95567dd6d442db18ede124ade12e03211a374c73736670c9f6daf0c8204af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 c1b0f01e2e2873fefc14f86fce44c501
SHA1 37b39894b93934fc9ec2e4f3e8b07c2daf4cdecf
SHA256 f90f963623511ce269557a5b224e6549da9666d0cce6d33bf0f10dcc49c836cc
SHA512 08fcac239d5a313685c0a2ec0943ace51b4314c7d682c8107a51bdad1beb6ef17296d91a957610c37d1b619ee19a511d38c22bc3923052c90cab247aba7721ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 9882d33cbd24d6e2e096177d77cb4c5e
SHA1 8f72ab5324729fbcc75140e947b6869f245b5c67
SHA256 caac4aafbd52f7087a92a4cec0622b66ff888a28596b40b1230611a263d1de48
SHA512 760162a384236130ea3977bc207adc63a7e3ec5fb394835a3a86404eeff643052d02e2e73fba081ef24a88988ec71ee8af47b1a07415fb96de33378bc84a7d3a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 77ffbe34383883903365d18af90fb15b
SHA1 77559a822c5b37dce464e0ba39b47e9aa8b87406
SHA256 e5e40778c56813b5c52ac6e2f3d65bd9be4cf4c8a42b09ad3c811c786564513a
SHA512 2b4f139e3e715cac04e9b4e8cca9fe84e1553fa94015988fa7c95a0e8fb1e3c2b0d4f0f73c018673cbf39261827970fe12a74d41752a630ec7467be1432dbbcc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 838b037908bdda4d960a887bc30b7ebe
SHA1 b2d514bfefce15453293c8db2a0b2ed7b0e85f30
SHA256 7bc2b54511fc1be68c7d7a18056ffc97d2cbe220122b768593c8f9ac6f9f462a
SHA512 5b9d6c3fb238a5f241ce0a5ad64e5b2ba5d8afbb46ec6bc045ff024dc4c3bbfd37dfed97626634191dd0db2b8cf9340329799f0a0fed482a95d742c99d7fb9b9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 9b8b8cd035497752639c9cf02e375090
SHA1 a4ecb2a76e0887a6fed3f9f0b52cd86f35917552
SHA256 d972936544fea74e0e1ff78535cc0e04a1c908c0fb178681a4a820fc933a11a5
SHA512 07f0200853e6b6882f4d3a3cfcd3211120db52fade1d15df1d94781479274d67a9a42b8b5a65d8ffa931bbab5a513bf0656d46ff3e01d1331a731f9233615909

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 25ccf9e312ae31df927fe60c3814ed7a
SHA1 d822b6371ec0003dc37c7204d2f64ff4b330a25b
SHA256 961d1b2a1bfd827dc73f459a0419a10aed994b10e7b7106873bd053a0b4b2f65
SHA512 c559e43da7cd0fe87837a9294c67d03f373f8a2072f98b48472585366d6cb282b38e82bc372d05fd458a437cdff5bc302a7da03e33b4409191b058ef17648684

C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

MD5 869a00ad6525080f22e06f0a8b5a8fd0
SHA1 053085ba1ef8264f2c030fae52ad7c8fa541bb08
SHA256 b6744e15755e1b1e8ef266aade9330dc61961344e4e1db2cd2041ee81cbe00c0
SHA512 9dffbfc8769581d0d92bf7ede1fbb0d564305360bf73b70c177f101c85708d4ad591235257fb63ba43ea5270f08a2268f89cf81b3d1e7673d9618563299977ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 747bb5bce5ed36e7248b43859edfc3a2
SHA1 7f34798e150ecbcfff01ad5d1a3490c7be4fc40e
SHA256 fa5f2502564f1f90930c4e0c775d06a22cd64408e051a05cfb4d088c76ca08b3
SHA512 6295e81763666f8e769d5ef0f63ca373f64bc35823bff1d86cde5c0617e3dd8bd37d8dcbb9bb04395f7d1e3598c2ac87ac4ef8225a5985989030a8d698da47b7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 57b083c0b43f959df1a03e097bbdd7ba
SHA1 1c951bf3f5cc660ecc219ec8c553cb924bcf9451
SHA256 190bcc68f99f38b6fafead62249ed06b2767c342d26a348d4d1de6fe29d06bab
SHA512 404397212c455bff4a996ba515a83bdf914f07d5388930f58675c9047cd8a775b9d7223f7ad7671e0c0e34fc075c9d4423c6d3ba2729eb13ba8be33556be4fa4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3a9463011fe8ef70a78773bc60df7e8e
SHA1 dff2d5dc57325ab9d40a3a387ea89e4d711b9caf
SHA256 533c6adf56694ae5f63ccba54fef8216d92098f9daa740f49669447d478d4847
SHA512 89d52328a081d8c262ee5bded772a2f60d1a1f7108e096192ba90b89664efede0d711fae893f6b9d8bb05cddce885a24cd99e8b57688f96e31a47bbb7bde1276

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\zwinplayer64[2].json

MD5 4b9a858432b8e5f49839c29d35d6575b
SHA1 77b0c9e67ec6b41f865f5c1dac5ee926825d6f8f
SHA256 f2f8ca31507bc3c4e1d4218a115751fb7445ac0ad5b8effc21c6d6f85487f8d6
SHA512 c2d1cc468a0da6dc9d9f83af77b482b806d31ba678db4fd9dedaff7a3e2d197518d68067089927ef6d5cbc256f0541f0717c9e3d9a6e10365ce74d1f729fa0dd

memory/4464-2341-0x00007FFB64240000-0x00007FFB64241000-memory.dmp

memory/4464-2342-0x00007FFB641B0000-0x00007FFB641B1000-memory.dmp

memory/4464-2343-0x00007FFB64230000-0x00007FFB64231000-memory.dmp

memory/4464-2344-0x00007FFB641A0000-0x00007FFB641A1000-memory.dmp

memory/4464-2346-0x00007FFB64190000-0x00007FFB64191000-memory.dmp

memory/4464-2345-0x00007FFB64220000-0x00007FFB64221000-memory.dmp

memory/4464-2347-0x00007FFB64210000-0x00007FFB64211000-memory.dmp

memory/4464-2348-0x00007FFB641D0000-0x00007FFB641D1000-memory.dmp

memory/4464-2349-0x00007FFB64250000-0x00007FFB64260000-memory.dmp

memory/4464-2350-0x00007FFB64250000-0x00007FFB64260000-memory.dmp

memory/4464-2351-0x00007FFB64360000-0x00007FFB64370000-memory.dmp

memory/4464-2352-0x00007FFB64360000-0x00007FFB64370000-memory.dmp

memory/4464-2353-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

memory/4464-2354-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

memory/4464-2355-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

memory/4464-2356-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

memory/4464-2357-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

memory/4464-2358-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp

memory/4464-2359-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp

memory/4464-2360-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp

memory/4464-2361-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp

memory/4464-2362-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

memory/4464-2363-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

memory/4464-2364-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

memory/4464-2365-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

memory/4464-2366-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

memory/4464-2367-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp

memory/4464-2368-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp

memory/4464-2369-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp

memory/4464-2370-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp

memory/4464-2371-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

memory/4464-2372-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

memory/4464-2373-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

memory/4464-2374-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

memory/4464-2377-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

memory/4464-2375-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp

memory/4464-2378-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

memory/4464-2379-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

memory/4464-2380-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

memory/4464-2381-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

memory/4464-2376-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp

memory/4464-2382-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp

memory/4464-2383-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp

memory/4464-2384-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

memory/4464-2385-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

memory/4464-2386-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

memory/4464-2387-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

memory/4464-2388-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

memory/4464-2389-0x00007FFB62140000-0x00007FFB62150000-memory.dmp

memory/4464-2390-0x00007FFB62140000-0x00007FFB62150000-memory.dmp

memory/4464-2391-0x00007FFB62240000-0x00007FFB62250000-memory.dmp

memory/4464-2392-0x00007FFB62240000-0x00007FFB62250000-memory.dmp

memory/4464-2394-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

memory/4464-2393-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

memory/4464-2395-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

memory/4464-2396-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

memory/4464-2397-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

memory/4464-2398-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2399-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2400-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2401-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2403-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2402-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

memory/4464-2404-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4558403d3468fed3481569657e3221a8
SHA1 7db0428d0b1e5018e793c85660a8e5ad3cf5a82d
SHA256 518addb71ac01eb7f75ca2c6a263c31904edb9fcc9acfaee5af7be6ebc242909
SHA512 06eaaf41d6508dc99354e04a43c1a5bb427a09dbe208e8a40b79b06240e0b9edcc0d2d00aa2d22349fc93ec9df2830a88e0aac12e036d376c86db6ba7c99f839

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 2678681b4a6b32f4331a83af1c3de6d7
SHA1 a8652d54f85bd84604d1633063ca9ad620212b96
SHA256 87f58a14cc74afffe86e71c9c8556b670f7a4f8b1f7d112bc00b211d97393335
SHA512 8ffa79ed5cacbc44c7a1f2d83a05537f1ec253509a7aea04b1c42ac17caf889b7326c223818d3695dfcc5c5becf79817bdfada06d075c5adb2bc287e370334ea

C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

MD5 4b5ad874c09b3ffcaea4aa89ced6fc05
SHA1 9faedfbfd6186a1909af132857fd65fd12ddef17
SHA256 1fd516ec4bb4e116152c90f717d5ce956daab8a4bf1a554e64cb76a6ba4e27a7
SHA512 0a29790c432637cb647f982fb0fc7f2e33e6d2fbfd552e169635b63552a27e3391f0fe9851b12ad33138e2ae1778ad93f2491f1bffa6335546d5c6a155a278bf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 413ac7a8173bd40768b103c9138bef2f
SHA1 3b7f5c98977af53c3e318566c48dafabefa19adf
SHA256 08b90a1cc797705f4d243c1af62421a480898093bf1ab7072f0fbad64b1d5c6e
SHA512 d2ab080c1855ce083ea728bd7e9437623c5b85adbf341c4bd888081bc9d7a7a2d7bd80e6b15ce02f6bcc44582e469210c44de7b56c36ebb293e098c72d168746