Resubmissions

29/04/2023, 20:08

230429-ywmdqsdh7v 10

29/04/2023, 20:02

230429-yshldabh89 10

Analysis

  • max time kernel
    374s
  • max time network
    428s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2023, 20:08

General

  • Target

    krnl_bootstrapper.exe

  • Size

    1.2MB

  • MD5

    f14153bbd95fc26d9ccea77c49cf09b9

  • SHA1

    cb59f900711ea751c4322b4dab50fa2c0ee70b33

  • SHA256

    27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

  • SHA512

    7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0

  • SSDEEP

    12288:aBVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzho:SU7ecSgL6y+gk+rnxdarFu

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 29 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 42 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Users\Admin\Documents\krnl\7za.exe
      "C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Users\Admin\Documents\krnl\7za.exe
      "C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Users\Admin\Documents\krnl\krnlss.exe
      "C:\Users\Admin\Documents\krnl\krnlss.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3788
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb465b9758,0x7ffb465b9768,0x7ffb465b9778
        2⤵
          PID:2680
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2
          2⤵
            PID:3632
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
            2⤵
              PID:4512
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
              2⤵
                PID:2588
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                2⤵
                  PID:2332
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3272 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                  2⤵
                    PID:5088
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                    2⤵
                      PID:4108
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                      2⤵
                        PID:4740
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                        2⤵
                          PID:4720
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                          2⤵
                            PID:4880
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                            2⤵
                              PID:4476
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
                              2⤵
                                PID:4808
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7c29c7688,0x7ff7c29c7698,0x7ff7c29c76a8
                                  3⤵
                                    PID:3888
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4912 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                  2⤵
                                    PID:4880
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4424 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                    2⤵
                                      PID:4720
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4332 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                      2⤵
                                        PID:1920
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                        2⤵
                                          PID:632
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                          2⤵
                                            PID:1508
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2760 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                            2⤵
                                              PID:4644
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                              2⤵
                                                PID:3396
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2860 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                2⤵
                                                  PID:984
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4508 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                  2⤵
                                                    PID:2620
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                    2⤵
                                                      PID:4340
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3412 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                      2⤵
                                                        PID:2572
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3940 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                        2⤵
                                                          PID:3844
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                          2⤵
                                                            PID:3672
                                                          • C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
                                                            "C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
                                                            2⤵
                                                            • Checks whether UAC is enabled
                                                            • Checks computer location settings
                                                            • Drops file in Program Files directory
                                                            • Executes dropped EXE
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1336
                                                            • C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
                                                              C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7ac,0x7b0,0x7b4,0x6bc,0x7bc,0xd057bc,0xd057cc,0xd057dc
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:1728
                                                            • C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                              MicrosoftEdgeWebview2Setup.exe /silent /install
                                                              3⤵
                                                              • Drops file in Program Files directory
                                                              • Executes dropped EXE
                                                              PID:2816
                                                              • C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe
                                                                "C:\Program Files (x86)\Microsoft\Temp\EU7620.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                4⤵
                                                                • Sets file execution options in registry
                                                                • Checks computer location settings
                                                                • Checks system information in the registry
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2308
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Modifies registry class
                                                                  PID:3152
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Modifies registry class
                                                                  PID:5004
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Registers COM server for autorun
                                                                    • Modifies registry class
                                                                    PID:3136
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Registers COM server for autorun
                                                                    • Modifies registry class
                                                                    PID:3416
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Registers COM server for autorun
                                                                    • Modifies registry class
                                                                    PID:408
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOTExRDQ5QS1CNDFELTQ0MTktOTY0Ri00QjM2QzkxODQyNDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDE3NjEzMTc4IiBpbnN0YWxsX3RpbWVfbXM9IjE3NjciLz48L2FwcD48L3JlcXVlc3Q-
                                                                  5⤵
                                                                  • Checks system information in the registry
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:2132
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9CE99956-FD1E-4655-83CD-BB05D11E6986}" /silent
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:1636
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:2
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1700
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5000 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                                            2⤵
                                                              PID:3584
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:8
                                                              2⤵
                                                                PID:2020
                                                              • C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe
                                                                "C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac+launchtime:1682799245721+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D745e3621-7cc7-4b94-bd35-7e0512661c21%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp
                                                                2⤵
                                                                • Checks whether UAC is enabled
                                                                • Checks computer location settings
                                                                • Drops file in Program Files directory
                                                                • Executes dropped EXE
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3464
                                                                • C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe
                                                                  "C:\Program Files (x86)\Roblox\Versions\version-31b938635c234124\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x738,0x73c,0x740,0x70c,0x714,0x7457bc,0x7457cc,0x7457dc
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:1044
                                                                • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
                                                                  "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t CeKA1jkY6MqPvq8gNUxKTf1aJfLjZDsp-KvP8FeEV9I-9_txqnCy77JvIcZ3ugKpkbO0olmz_Zwub04IU4k71_6ODvirkr7Mc3QW2HXQXPkmMkUVzKxR5R5ygtK9wAl5pVOltclRYWcW793Ic2Ukj7qskYJ7dKpAUU4gTba0mzD0lLXwxa2NT3w4n7bhl179V6vLY1Nayfu-31sTzjF222apL-Zik8JsJtW0yaBEdac -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=745e3621-7cc7-4b94-bd35-7e0512661c21&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799245721 --rloc en_us --gloc en_us -channel zwinplayer64
                                                                  3⤵
                                                                  • Drops file in System32 directory
                                                                  • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Modifies system certificate store
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of UnmapMainImage
                                                                  PID:4464
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -u -p 4464 -s 1992
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:1988
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1480 --field-trial-handle=1864,i,17017154421730575627,17468424332192850004,131072 /prefetch:1
                                                                2⤵
                                                                  PID:4100
                                                                • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
                                                                  "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w+launchtime:1682799337223+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D170710005181%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D01c43e03-df9a-43b5-9afc-6e49eac81d55%26joinAttemptOrigin%3DPlayButton+browsertrackerid:170710005181+robloxLocale:en_us+gameLocale:en_us+channel:zwinplayer64+LaunchExp:InApp
                                                                  2⤵
                                                                    PID:4352
                                                                    • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
                                                                      "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x560,0x564,0x568,0x53c,0x570,0x10357bc,0x10357cc,0x10357dc
                                                                      3⤵
                                                                        PID:4652
                                                                      • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
                                                                        "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -t kq1KNgdRRe7YvXCXBPCKCCJGwtgpg0cJKI4C9koWH50o5a48LyzFLjIu8vfPmwGd9UBxoxqw95yn1_EnA9jCULtGyv-BSTJbXBblNZgLtqIh2elVIKFTm3xJELQSIR6GggufR3m6YplBlOkse0zN4FTHOSGLrTTnzbfsjNJY_LJURh4fwM9i2792_d9bEobzdZiQzu7s5NZDARUB8FbOM910cyMO96zJmd7FWhYWB5w -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=170710005181&placeId=142823291&isPlayTogetherGame=false&joinAttemptId=01c43e03-df9a-43b5-9afc-6e49eac81d55&joinAttemptOrigin=PlayButton -b 170710005181 --launchtime=1682799337223 --rloc en_us --gloc en_us -channel zwinplayer64
                                                                        3⤵
                                                                          PID:2132
                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                      1⤵
                                                                        PID:1900
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                        1⤵
                                                                        • Checks system information in the registry
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:3604
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RUVCODg2Ni03NTU2LTRBMjItQjEyNS0zODE1NzkyQ0ZFMTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDI4MzczNDQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                          2⤵
                                                                          • Checks system information in the registry
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:1284
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:4592
                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\EDGEMITMP_1B709.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7B4635B5-36EE-4001-89E4-4CB81EDC28BD}\MicrosoftEdge_X64_112.0.1722.64.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                            3⤵
                                                                            • Adds Run key to start application
                                                                            • Drops file in Program Files directory
                                                                            • Executes dropped EXE
                                                                            PID:1508
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUNFOTk5NTYtRkQxRS00NjU1LTgzQ0QtQkIwNUQxMUU2OTg2fSIgdXNlcmlkPSJ7NTJGOEJDMjMtQUQ2OC00OTk5LUE5MzYtRjRBQkQ5Njc0M0YxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQzM1QkIxNy1BNkM4LTQxRTgtQTNBMS04QjYyNERCRkRFOUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuNjQiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwNDQ0OTI2NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDQ0NjQzODIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM3MTcyMzExMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZTk0MzI4YmUtMzY3OC00ZDA3LWI4YjMtMmU3ZTA1MTFiYTMxP1AxPTE2ODM0MDM5MTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZVpzQWlPZjNPZTd5ZHpmbDloQm5FZEZFb3FjaG9nSE0lMmI2bjFvaTBLVjhOaHNMNjZ5ZVVNNjVuNG9Eem1TRkVQa3BWb1JkdGNFU3N4UHVRdnljQ01pUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgZG93bmxvYWRfdGltZV9tcz0iMjI4MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzcyMDQyNzQ3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjM5NjQ2MzE2OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI0MDM4MzE4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk5OCIgZG93bmxvYWRfdGltZV9tcz0iMzI3MjkiIGRvd25sb2FkZWQ9IjE0Mzg3ODEwNCIgdG90YWw9IjE0Mzg3ODEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iODQzNDYiLz48L2FwcD48L3JlcXVlc3Q-
                                                                          2⤵
                                                                          • Checks system information in the registry
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:4940
                                                                      • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
                                                                        "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" -app
                                                                        1⤵
                                                                          PID:1152
                                                                          • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe
                                                                            "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zwinplayer64 --annotation=RobloxGitHash=84184678f9eab8ed5ceb955a9995c3213bffb741 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x72c,0x730,0x734,0x69c,0x73c,0x10357bc,0x10357cc,0x10357dc
                                                                            2⤵
                                                                              PID:1052
                                                                            • C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe
                                                                              "C:\Program Files (x86)\Roblox\Versions\version-14a29e72cc524327\RobloxPlayerBeta.exe" --app -channel zwinplayer64
                                                                              2⤵
                                                                                PID:4428
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -pss -s 404 -p 4464 -ip 4464
                                                                              1⤵
                                                                                PID:2788

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v6

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.64\Installer\setup.exe

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      MD5

                                                                                      55dbfedec31ce800442d30f4e65c9ec2

                                                                                      SHA1

                                                                                      2ebc1bac365e2e1ae73089bebdeaabef6c8ebd7b

                                                                                      SHA256

                                                                                      69afeb4fd99981b52d947c2b0255bcef3768bfe1e2643e14971e2d5916749c94

                                                                                      SHA512

                                                                                      af87bfd9dd0f4375a551829a3d711bfb32c4c02225cb30246d0e19cfa5d7f4b288c95567dd6d442db18ede124ade12e03211a374c73736670c9f6daf0c8204af

                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\112.0.1722.64\MicrosoftEdge_X64_112.0.1722.64.exe

                                                                                      Filesize

                                                                                      137.2MB

                                                                                      MD5

                                                                                      b389a801f3373bc45a2b85335da47aac

                                                                                      SHA1

                                                                                      ee244117aa01a2009112ab5d4e8d562fa665de85

                                                                                      SHA256

                                                                                      4ad07fd7bcf2326f110b1902942c884ae0e2b67ca0e48e010b6be4ee11d1fd2c

                                                                                      SHA512

                                                                                      4015dada1088fd6179ec8fac0288e7454125bf3159e1d666301e48873d17efdf77d2a79492a2623047a246fb4648382cf01b667095b4beb5ccf3087366051639

                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

                                                                                      Filesize

                                                                                      201KB

                                                                                      MD5

                                                                                      4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                      SHA1

                                                                                      494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                      SHA256

                                                                                      87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                      SHA512

                                                                                      320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                    • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

                                                                                      Filesize

                                                                                      2.0MB

                                                                                      MD5

                                                                                      3bf891bf24d2216d1f799334d88a14ec

                                                                                      SHA1

                                                                                      0962cdfcac41c498ea9469df19c4f6e069be04af

                                                                                      SHA256

                                                                                      bea0ba994ac766b5956695f0520fb9dfb2c6a73f4e9fff349d29efd39163bf94

                                                                                      SHA512

                                                                                      7d6ba4776c4916729018cf3c486095e9f57d2e1b2954a576efb00931f1d8e3fa989e9a7e3a05a36bcd1bea5a30112abf5999e1ed0e90045ab64b9af6d2f2c48c

                                                                                    • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

                                                                                      Filesize

                                                                                      2.0MB

                                                                                      MD5

                                                                                      869a00ad6525080f22e06f0a8b5a8fd0

                                                                                      SHA1

                                                                                      053085ba1ef8264f2c030fae52ad7c8fa541bb08

                                                                                      SHA256

                                                                                      b6744e15755e1b1e8ef266aade9330dc61961344e4e1db2cd2041ee81cbe00c0

                                                                                      SHA512

                                                                                      9dffbfc8769581d0d92bf7ede1fbb0d564305360bf73b70c177f101c85708d4ad591235257fb63ba43ea5270f08a2268f89cf81b3d1e7673d9618563299977ce

                                                                                    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                                                      Filesize

                                                                                      149KB

                                                                                      MD5

                                                                                      6b05382235bc0418a5da0051530ce873

                                                                                      SHA1

                                                                                      d31b0d0a6ae6de908ef3bb3ab169a16f3d82eceb

                                                                                      SHA256

                                                                                      0747310a01030b2c88ba9f1063932eb24814651c34a39254071dcd00dd7a812f

                                                                                      SHA512

                                                                                      c49d19639e84124b43fcf5cc4f3c993ead41c3fe56c21b01266e5b1845f77b3a62bc36f93d2eeb9c2d2da313f9eaa69d427201c5cfbc0c105e072804ee2ffd34

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f624fb8-2bdf-4b25-bede-6fb8e36d3573.tmp

                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      ede1f9ae6f6b66194a717c77820cd9fb

                                                                                      SHA1

                                                                                      c3e0fcdeca9c2739d9b138aadae083780b8297eb

                                                                                      SHA256

                                                                                      b9ec406fb04eb50ee181e9321530d3b2c5863e5f5dadecf40a8f56fe6401c797

                                                                                      SHA512

                                                                                      90d477d508aa709005b3c6f71e7e54394f47f516849439ec0a187ad4ca3fd88f36c8ff41f701ebca6abcf6ebd88518d23967cfb58e528cade5675c7735d04e11

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f765110-dd2a-4f2b-81da-c805ccda5493.tmp

                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      b349e14ce7e14447aab2be060b0562aa

                                                                                      SHA1

                                                                                      7fef61c36b1a641f340a7c9880909c5e6a4966fa

                                                                                      SHA256

                                                                                      4165dc396c234ed2e51d4707ee5493ff518c60ad6564f0af850f43ea134d0771

                                                                                      SHA512

                                                                                      b177e3771e6c57c87b25d5429430e9f47d48a49a0c581bdf4e8b5ed9aceaf411a076f30fb7465fc6acee33bd91ae871f3edeffb2db0093e73419120f71784ad2

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

                                                                                      Filesize

                                                                                      97KB

                                                                                      MD5

                                                                                      34b97f8b9e4296af5238fc8f67586b72

                                                                                      SHA1

                                                                                      e6c4b92901c1a9d8aa6a7247143c2560a90efaba

                                                                                      SHA256

                                                                                      70c158c98bf7abf5e0bb3167edf6ed0d378f9380fabcf281cf0fe59623a0c774

                                                                                      SHA512

                                                                                      0df677459ce64c61aa109aeabcf8f91e5a19a98ddc3426818d5cb256e05abab604b2455296e83fd4687798f6f241d470af431ac9e153df95283186c28c3ab4d3

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

                                                                                      Filesize

                                                                                      66KB

                                                                                      MD5

                                                                                      9607b1f17ee9215cb98d30fadf7d8f07

                                                                                      SHA1

                                                                                      02f24d48c3b75b001c34b0bd447d3f48e27721fa

                                                                                      SHA256

                                                                                      ed1667af355f9c82290a4ea786ea0a4a96bda9a6730a0e81ed42bfdbc798f3ee

                                                                                      SHA512

                                                                                      c290ce91e1c03646b3f4ccdeb3b7e7f470d8e574925fd8a0b71d6dd58f29af3fd4eb6099f2bba921424ab8fd42d97430107f9944af4b7c53ce4f10caf94a0815

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

                                                                                      Filesize

                                                                                      49KB

                                                                                      MD5

                                                                                      c12075d6afcfce79df001ecba960cc0a

                                                                                      SHA1

                                                                                      f11913a40353bc451298b24b47642c65d591c2b8

                                                                                      SHA256

                                                                                      3d738adbbd4904e038babeab34d1481963921df6d8e7fe721e84649f1518cf05

                                                                                      SHA512

                                                                                      b4732bb0b6c5edb0f9d42e1f3d3facb8752c81bb70c3c7982ab14d7380b2bac31c367b77a11163592a511ac13ef894009846760a0a1246eaeb9df11c6408132c

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

                                                                                      Filesize

                                                                                      16KB

                                                                                      MD5

                                                                                      01d5892e6e243b52998310c2925b9f3a

                                                                                      SHA1

                                                                                      58180151b6a6ee4af73583a214b68efb9e8844d4

                                                                                      SHA256

                                                                                      7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d

                                                                                      SHA512

                                                                                      de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      7525fc346f07f54107a82e5607a81de5

                                                                                      SHA1

                                                                                      c8bb8b4f7b8e079bfc2442f926e5614cf05739a2

                                                                                      SHA256

                                                                                      94eb1ffd3312040dc73ffb3aab104b190a3b44375cc9ab696c7c80458207d361

                                                                                      SHA512

                                                                                      289fde686b8f04ca2608c963c1cf5f88ea89a8b32e31b582a621b0e6de8f83dabc52db00eb38cb6453518a82f1b56425ae11794f50d5fd39c0c6839589a58bec

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      f343325dff5e63c0fe34bc3bf2c91ef4

                                                                                      SHA1

                                                                                      3d433dc78cf8eef3474761e8140d500e75ea52de

                                                                                      SHA256

                                                                                      b8e5e328f5d2ce87abe2b7bf2ae518f5b1033e064c2b83cf03535447535456b8

                                                                                      SHA512

                                                                                      bfb3385f6dc937a418aa6705bcab565676eafa96ad95c37d274159f11eef26523e555ce398e665b59991a045a222289852002dfc08ca7a1fb3b297d75727584d

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      09bcbc21ddde0355274fc76294a40c1a

                                                                                      SHA1

                                                                                      b8da5c10199161d5cbc968ca6242958466437dee

                                                                                      SHA256

                                                                                      b2383ca375efdf79b8589df52e8f14a7385b9ce67f857c44ca81b9eb8ed1fdff

                                                                                      SHA512

                                                                                      8b02ccbb98930c69bb565511230cb258c5f5e0ac6da7c8e2c05e822f4087b8626b19e7022d5f7724f4576514a3db6662dfb6e1dc48be710817d4f7d0350a2621

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      2678681b4a6b32f4331a83af1c3de6d7

                                                                                      SHA1

                                                                                      a8652d54f85bd84604d1633063ca9ad620212b96

                                                                                      SHA256

                                                                                      87f58a14cc74afffe86e71c9c8556b670f7a4f8b1f7d112bc00b211d97393335

                                                                                      SHA512

                                                                                      8ffa79ed5cacbc44c7a1f2d83a05537f1ec253509a7aea04b1c42ac17caf889b7326c223818d3695dfcc5c5becf79817bdfada06d075c5adb2bc287e370334ea

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      c1b0f01e2e2873fefc14f86fce44c501

                                                                                      SHA1

                                                                                      37b39894b93934fc9ec2e4f3e8b07c2daf4cdecf

                                                                                      SHA256

                                                                                      f90f963623511ce269557a5b224e6549da9666d0cce6d33bf0f10dcc49c836cc

                                                                                      SHA512

                                                                                      08fcac239d5a313685c0a2ec0943ace51b4314c7d682c8107a51bdad1beb6ef17296d91a957610c37d1b619ee19a511d38c22bc3923052c90cab247aba7721ff

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      484b05819eeb000de58b456381b42072

                                                                                      SHA1

                                                                                      e559d19664c0d50d1b55a02d1c992175d4df7442

                                                                                      SHA256

                                                                                      bfdc093cffc163fcc7598d08c02951ef9a9cd8291e03b069d82795490ef8308a

                                                                                      SHA512

                                                                                      c5bdeff92d584d135a4982723447d0c81b46a7234088ac2bb015b9d2ae1322483de02d302d679f36e87dff0b28cc15d5663beee4f11d2aedbed3214cddc5838b

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      9b020fec1be1b52a015ebf72bf8eb239

                                                                                      SHA1

                                                                                      9db2ae296341ff4ab253453986bf2ad175a21661

                                                                                      SHA256

                                                                                      8a38a8f225dfec2abada16a2dc3a7107353672ebd8738e3c08c4cb320dfc77f4

                                                                                      SHA512

                                                                                      1ad212cbd9a97f6ecd766e0b9228424c7ab142674980b8aa517f6370e1241402bf2d0dc0622935ddc4cccf5622bda6f5b742d1b0469ab0987f39a820052fe74e

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      cac33b802514f5c0a0db935041cff84b

                                                                                      SHA1

                                                                                      c09a109278a37251a4de145a88dff090c6cae7af

                                                                                      SHA256

                                                                                      af858897a7b5cb65a71512cf0594ebd72a45608df329c5076f454792c36d0a3d

                                                                                      SHA512

                                                                                      4e47caeb82393d68362c128f8efa93b14f10b00d7c819561e14652cb66be46ebfd0359b1baa9fb3c7ecd055d0dc4fa4995b4ade55d489eb2a4441657169fde5d

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      77de238191b6471e1e61f2296d8ad069

                                                                                      SHA1

                                                                                      86bacc69b58a36eddd2c0e4735fbb59ace86a016

                                                                                      SHA256

                                                                                      c79f1a985f03ebeb6103a490c14e7cd30d68c5aa8eb610d211d5637237ece106

                                                                                      SHA512

                                                                                      c131e2da233421550559d103b75b6875380c6f137455b9724f4009bbd41f63d515b02c1550a7c5a9532faddc44a958728f551c5342deadd94434e7d7266fb34e

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      fd013531c8c3a230e061c5cf1c62dfe5

                                                                                      SHA1

                                                                                      7e430c9eca4debe6e579bf1da616e9a220959b7d

                                                                                      SHA256

                                                                                      4cb75365faef44cb49afee32c1c1ec52f1323265ffe650c58d8c55c6cc57a53f

                                                                                      SHA512

                                                                                      67e154c60d3f8ffce29b32ada03c8eba8c151ce7ef09bc0b45f4c5d779f19898dcef4b2289f28f59f573831c9ded2b3a403b9deb5ead0be8ea965a2156f7c4e3

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      1a3025e0cf2cc86be5d8806bcec52ddd

                                                                                      SHA1

                                                                                      0ce2b0e9a25768f155fea1b4441d99a221409b8f

                                                                                      SHA256

                                                                                      7dba031b209366d6de98fa77486b40eae05ca205366cd4b712cc4c115abe3bb9

                                                                                      SHA512

                                                                                      7b4d76d6c236f1c3f98b32992564deb892f9aa42b02d1f13425674d5ee3eee27baba72ab32fccdf3c47cbcfd2f9a13c7731c742c23f057619221cd6e89c23289

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      ff60bef30d3a32ece074258a0c1fc77f

                                                                                      SHA1

                                                                                      367ac44a2a8b2503fc60cb08c84e5837e769a27f

                                                                                      SHA256

                                                                                      d0b997652ee911d21593bd7284e1605461adf3d54252d7b532d9b7e08e54a46e

                                                                                      SHA512

                                                                                      1cfc47aa01f8f56b40ca70dfd8d16a7ee65dd4ba7e0efc13f489e55604e42249acfb9b7395091768c03b36611e0f634841238bb714aa649c343c69f7376be037

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      ac6347fe8fed0d4777c68127260b56aa

                                                                                      SHA1

                                                                                      de4b284bfa3234a60b0dde5a171189fdd8c9f973

                                                                                      SHA256

                                                                                      64f479329d07c56b4276c102f5543451007d479668f80506962defdf69bae85c

                                                                                      SHA512

                                                                                      7905247fd976d4022e2a4b8ddbe5f5f44e6f80ad929262185aa892456310d941a8d1e3257ac6dc6edfac3665bbaf98271e416b27535968ad9e704b22586474a0

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      9ddb0fc333ca0f4067844bc55e01542f

                                                                                      SHA1

                                                                                      3acfd1cfa60e15bd70905461a5b7984e0bd066c3

                                                                                      SHA256

                                                                                      fddb14e0327a5339d7821ba7695abc4d7ecc8c226a78ec610e23bdc6264d797b

                                                                                      SHA512

                                                                                      efd9b2bf36d4f0e472256d063aea448d6ae14fc4b5a75fe081553e0f32a2a280a792847c943b4100ee67cb50591e2be4c37e68d7570a00b5903b629c043016de

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      ac6ce51052fc6c86a49489c82fc658fb

                                                                                      SHA1

                                                                                      67ef6cacc86b0b5e8a26080f1dc6f86618daff2a

                                                                                      SHA256

                                                                                      75a8d2e5b455e0908ea5fb4098b0b2b893113c40c4828bc1ef215d1cc3118039

                                                                                      SHA512

                                                                                      ea43816a1267ca3d4696003805ad68ac9237b5f59100b0ecf5e1b3c2e86ad6e49d21f4703dff847618ffa000be54b6806c55879a2ae654a0415d6f1687d35d5c

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      55c96751eda5a24324c2fa0498877bb5

                                                                                      SHA1

                                                                                      53cfb2f1a5ba7353124044836890e305b1044124

                                                                                      SHA256

                                                                                      229683735f98a2ed80ae0c594f77f8c5ea9a4c2288c9ddc9065b487ff7adf328

                                                                                      SHA512

                                                                                      2332f14508bda0737f08afaa7428f042fa0c4c1354b69da71a58e9e2215b9bc49f45a30fccc0b93dace8fe58565ea5c812d9ef0c90613460f14c7e013ec815da

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      4f34519b7e5669fb4b8f6830ab7e74aa

                                                                                      SHA1

                                                                                      347d27b6b5f41336adb4ce9a7acafac2ff24be72

                                                                                      SHA256

                                                                                      65bbe81656adbbdfd81a55f9a072110d1444a49dbde34951d148a2992feab8e4

                                                                                      SHA512

                                                                                      60ff4eefe147cc8d44c11871274abf978df16f3004b202a3ce86404c50699db1e03c5f10c23a569fa28f0dc5691e4ce3801f58e9242943d6d93c30ee6fd05bca

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      d7ef0a5d8d4b606d0f84de4293917dda

                                                                                      SHA1

                                                                                      a2e2cfbc6f16f7dd11a46c2c240103dcc23b23a3

                                                                                      SHA256

                                                                                      fc1152dbfc557de59a7902d13c90a17101a581af6f71f1620de3f8f1c31c5bc0

                                                                                      SHA512

                                                                                      1fb2b1c02b804094d03ccb242a54e99933430d188230c70bc03a71791b1e683efe3c4afdb592dff72797a260cbe02d601ad6d399080876a5f507755b90d83551

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      dfbcd0672dd375750eae47d367782b93

                                                                                      SHA1

                                                                                      de1aa0cf0df8d83f5fec2e8e61b9d7daabea37ec

                                                                                      SHA256

                                                                                      83267f7929f73bfcbbfea963214303c691a47eb37dac63e9d71ce3a27e5f2f80

                                                                                      SHA512

                                                                                      cd33b4c15e44f0c44f78b48782bc5d420dc9d78c75c724a2af5c6e7d5eaf5d084193f19cd4396e0774831af5cf41b3f4ef9e536847c19e8f21822fd746c63ba8

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      02f2b2866b21720c4742e3a172a94098

                                                                                      SHA1

                                                                                      adca9b9c46144725c9a88f42e6a3869beaec85f0

                                                                                      SHA256

                                                                                      0464d390837fce2b5082bb1d29d238c538401b0363a710e8194f55ec248f8ebe

                                                                                      SHA512

                                                                                      4946d48b17911899614365094ec051d710c8dd9a7adaeccb5c052143acc60bd801bc36c7526cf393d3ea5a2b405921654bbbe41b0a45ad9bc3ec8d45b461abc4

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      9b8b8cd035497752639c9cf02e375090

                                                                                      SHA1

                                                                                      a4ecb2a76e0887a6fed3f9f0b52cd86f35917552

                                                                                      SHA256

                                                                                      d972936544fea74e0e1ff78535cc0e04a1c908c0fb178681a4a820fc933a11a5

                                                                                      SHA512

                                                                                      07f0200853e6b6882f4d3a3cfcd3211120db52fade1d15df1d94781479274d67a9a42b8b5a65d8ffa931bbab5a513bf0656d46ff3e01d1331a731f9233615909

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      25ccf9e312ae31df927fe60c3814ed7a

                                                                                      SHA1

                                                                                      d822b6371ec0003dc37c7204d2f64ff4b330a25b

                                                                                      SHA256

                                                                                      961d1b2a1bfd827dc73f459a0419a10aed994b10e7b7106873bd053a0b4b2f65

                                                                                      SHA512

                                                                                      c559e43da7cd0fe87837a9294c67d03f373f8a2072f98b48472585366d6cb282b38e82bc372d05fd458a437cdff5bc302a7da03e33b4409191b058ef17648684

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      3a9463011fe8ef70a78773bc60df7e8e

                                                                                      SHA1

                                                                                      dff2d5dc57325ab9d40a3a387ea89e4d711b9caf

                                                                                      SHA256

                                                                                      533c6adf56694ae5f63ccba54fef8216d92098f9daa740f49669447d478d4847

                                                                                      SHA512

                                                                                      89d52328a081d8c262ee5bded772a2f60d1a1f7108e096192ba90b89664efede0d711fae893f6b9d8bb05cddce885a24cd99e8b57688f96e31a47bbb7bde1276

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      adb18cb531c8ed9ba1468aaecb2a7851

                                                                                      SHA1

                                                                                      4c50f057528b16dd6a021e3b4ed6e97efe15de89

                                                                                      SHA256

                                                                                      3c7a47d98976e793683e2560c8e2eede52460c362fcbfd328eefdbd148f4d48f

                                                                                      SHA512

                                                                                      dfc8749272424f766d23a0a49e5600f690244e6a852e6a574a4f5e4cd6e6d9a816f4c117f304a253afefcbde9f928b58cabe5a57f1882c1244f9fdbccffa0a28

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      34bf4cc5a498295c7739db9b1cb7c2e0

                                                                                      SHA1

                                                                                      565dd62bdad19f15b2d7b025dfedb1a6f2baceb8

                                                                                      SHA256

                                                                                      fbdfa12b684460113787be26a705fe5751b3c275260ca9bb83981de7655d5af2

                                                                                      SHA512

                                                                                      b1a8e3aeb4e84c64c3728f8991428386e12c9eb84f9d6364be2ddb6897344af049aeacd220aaa20b87753fbb2302ba1fb73cdebc472b1084c8a5849221b526fc

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      b3fa13fa1493d979f87dad1d5ff87ef7

                                                                                      SHA1

                                                                                      0370383e1eb27f7120bfb3ccc7e2d0b04fd5d7d9

                                                                                      SHA256

                                                                                      41e3d024793199e228176c480d5c2c48e3ff7e77a1d77f8235d19c1ad60381a6

                                                                                      SHA512

                                                                                      8eaa8642e834db583bc87663fa0f12269eab07f90a3e76785464d669246163d7ef805507493b938a1de50a0232e36587e906f488c9da3a0fe5bf062fdcad78a9

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      c52fbd991d63b40b7c090a4a45e1a9ee

                                                                                      SHA1

                                                                                      6dfd1bb26c55de038f48c96d4340d4805caee9e1

                                                                                      SHA256

                                                                                      6fa7bae6058ecc607a3a0c642bd699380c8fde86a8d60c10035ecfe5e4959be2

                                                                                      SHA512

                                                                                      8e07b0d7a52309d4d3d3f5a120d9c9faf1eb5195cd88ace20345761b352a424b0d50bbe357f3fd5831cfb419f0314d3856abca0f0024f1fce451823174d7a643

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      413ac7a8173bd40768b103c9138bef2f

                                                                                      SHA1

                                                                                      3b7f5c98977af53c3e318566c48dafabefa19adf

                                                                                      SHA256

                                                                                      08b90a1cc797705f4d243c1af62421a480898093bf1ab7072f0fbad64b1d5c6e

                                                                                      SHA512

                                                                                      d2ab080c1855ce083ea728bd7e9437623c5b85adbf341c4bd888081bc9d7a7a2d7bd80e6b15ce02f6bcc44582e469210c44de7b56c36ebb293e098c72d168746

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      c069834d056b8049130823ac0c4101c9

                                                                                      SHA1

                                                                                      0e3c1bac428402693f533b6caa59c5e0126eed5c

                                                                                      SHA256

                                                                                      0b1e480a9ca07e801360d893c10fd31e5a30a27d6d82149e9559d82ff1ef94ea

                                                                                      SHA512

                                                                                      a1f26a43df0605451bd3480a8ea7ed34eedc309884ffe7366d811fd5a2f847c0135c06ff8ef21a3c7b98dc902167af84e799706adb4bbac49aa3d6bfa9ed580a

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      9882d33cbd24d6e2e096177d77cb4c5e

                                                                                      SHA1

                                                                                      8f72ab5324729fbcc75140e947b6869f245b5c67

                                                                                      SHA256

                                                                                      caac4aafbd52f7087a92a4cec0622b66ff888a28596b40b1230611a263d1de48

                                                                                      SHA512

                                                                                      760162a384236130ea3977bc207adc63a7e3ec5fb394835a3a86404eeff643052d02e2e73fba081ef24a88988ec71ee8af47b1a07415fb96de33378bc84a7d3a

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      838b037908bdda4d960a887bc30b7ebe

                                                                                      SHA1

                                                                                      b2d514bfefce15453293c8db2a0b2ed7b0e85f30

                                                                                      SHA256

                                                                                      7bc2b54511fc1be68c7d7a18056ffc97d2cbe220122b768593c8f9ac6f9f462a

                                                                                      SHA512

                                                                                      5b9d6c3fb238a5f241ce0a5ad64e5b2ba5d8afbb46ec6bc045ff024dc4c3bbfd37dfed97626634191dd0db2b8cf9340329799f0a0fed482a95d742c99d7fb9b9

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      575d707c3776c167a259891f3e5419ae

                                                                                      SHA1

                                                                                      6f43b2c16fcec7e9f9b4be14e64efa4823ae46f4

                                                                                      SHA256

                                                                                      9cd86e57b5ce4af0fab011a8176189fbe9351646c947407c7a012f42c92e6952

                                                                                      SHA512

                                                                                      3653401d7a4b657bce84038f159d172b1e6bd0dcd39fcb95afd02e4bee48797a5efb00c9ed2b3ebc8e6bc0414b60b3ddec81442b48bd3090e518b3b64e8726f8

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      db70e8b33a19030ee16166f08e245bad

                                                                                      SHA1

                                                                                      192d540079291a5efc6033d9ca5d7629334df321

                                                                                      SHA256

                                                                                      8bfece289710096698cea6dccafc4b924f0889f1eafff213fbd5a4523d404b24

                                                                                      SHA512

                                                                                      b0d3d5401047471524d77a8668d69a487b085aa95830a80f697233b9150765d3d8740dbec2517027c5b1e0b8faa77825f70784608888c463477f5547460b3335

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      abd3f419f55fbc5d34d66b8ff1c8d996

                                                                                      SHA1

                                                                                      166616e826c5212c3f916cc4987d1d7121212833

                                                                                      SHA256

                                                                                      12179d3ba822a4663234a5876012dfd3605ded1c471248909c9e39d9b84a65b8

                                                                                      SHA512

                                                                                      fb87e2f24c52bdde7e8133f1b64540ce0b99921d8a9c48983e24b8213b3042b9328da78201b2ba7921337c6dab4b5234928d20d288686299e7825194497461da

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      b804b80b2f8dc684e1e3490bb93aecb1

                                                                                      SHA1

                                                                                      5b01be9e1a490e162add7018c622f56e267257c8

                                                                                      SHA256

                                                                                      3ec33946939114598f33ac297542d8c67693395d6d2d16def2c2b0f4957306d9

                                                                                      SHA512

                                                                                      5d1904d79bdf1aa55a1131984b6ffc734c5d0285177b326e910a18708edb6c64c1a273e8c4a51186bce8df986d0daa10133f76e6719a7d69e18359c3f836e453

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      57b083c0b43f959df1a03e097bbdd7ba

                                                                                      SHA1

                                                                                      1c951bf3f5cc660ecc219ec8c553cb924bcf9451

                                                                                      SHA256

                                                                                      190bcc68f99f38b6fafead62249ed06b2767c342d26a348d4d1de6fe29d06bab

                                                                                      SHA512

                                                                                      404397212c455bff4a996ba515a83bdf914f07d5388930f58675c9047cd8a775b9d7223f7ad7671e0c0e34fc075c9d4423c6d3ba2729eb13ba8be33556be4fa4

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      99db85bdf43a99138d5a50a2fe2af148

                                                                                      SHA1

                                                                                      585fac72ef1803fec5b3d56891ba7df34790e54b

                                                                                      SHA256

                                                                                      3552f164eb60f8d901ad669283fb0015af59c8cf015f4e42237ff274f8dce7b1

                                                                                      SHA512

                                                                                      8e2e9a1dac6b9ffa1281a7691b0cbac05c8ea082c74c8d25851dd93b7bef545f57a663a83068f1307117f692dd9a701dc97fc45aa8953b3e9a7b0f9e8b75be02

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      4558403d3468fed3481569657e3221a8

                                                                                      SHA1

                                                                                      7db0428d0b1e5018e793c85660a8e5ad3cf5a82d

                                                                                      SHA256

                                                                                      518addb71ac01eb7f75ca2c6a263c31904edb9fcc9acfaee5af7be6ebc242909

                                                                                      SHA512

                                                                                      06eaaf41d6508dc99354e04a43c1a5bb427a09dbe208e8a40b79b06240e0b9edcc0d2d00aa2d22349fc93ec9df2830a88e0aac12e036d376c86db6ba7c99f839

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      77ffbe34383883903365d18af90fb15b

                                                                                      SHA1

                                                                                      77559a822c5b37dce464e0ba39b47e9aa8b87406

                                                                                      SHA256

                                                                                      e5e40778c56813b5c52ac6e2f3d65bd9be4cf4c8a42b09ad3c811c786564513a

                                                                                      SHA512

                                                                                      2b4f139e3e715cac04e9b4e8cca9fe84e1553fa94015988fa7c95a0e8fb1e3c2b0d4f0f73c018673cbf39261827970fe12a74d41752a630ec7467be1432dbbcc

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                      Filesize

                                                                                      148KB

                                                                                      MD5

                                                                                      68960caba526b3e93542e6d7d1ec2ca1

                                                                                      SHA1

                                                                                      403fd6904cf390c4ebd1b343baeb0caa581ce8ea

                                                                                      SHA256

                                                                                      ffdad0e8352853898b7877afc8d2c91fb42dc98f4fede58d4edcad582c591636

                                                                                      SHA512

                                                                                      869de8496f9451eac5d19b9bd50936345ed8e83b9947e70c5fb6fca3d17ac2c6498a5d09ecc201423c5c32c6f0ac7199f0d435a620323074183bb63f90f3bb4f

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                      Filesize

                                                                                      103KB

                                                                                      MD5

                                                                                      a652635ac4b368f74e8f8995db8ca632

                                                                                      SHA1

                                                                                      fc35b20b082f8927bf88815505a26f698609b070

                                                                                      SHA256

                                                                                      3eaf7717f1321500a397c5f04f48045410912bd5b3dbf1ce2700694f380fffda

                                                                                      SHA512

                                                                                      19023ae364d78e3a23231d9e9ba0bbcabe22c373f0331bf71d5cd0e62a7732db6238ef43c99e48ad1169f4ad87806283d04d0cbf4221a588ec11fca818e8053c

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                      Filesize

                                                                                      114KB

                                                                                      MD5

                                                                                      b3469483234412c8be7809ee38d7bce9

                                                                                      SHA1

                                                                                      35318fab62bcba91cb7a8c8e309bccde7178e57a

                                                                                      SHA256

                                                                                      35c7f29e318e6d92dc666ef9f472af82da610ddd4177f6ebbc1debd7de01611b

                                                                                      SHA512

                                                                                      9f4b13019048c15608b8748f28d7fbc9044b5da286f3a7183461b460d8a2381aa42546713bcd6a6cc9a84c0ecdbcdba4c0c1aa3d963c942777fbb43d0c7538f5

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                      Filesize

                                                                                      117KB

                                                                                      MD5

                                                                                      747bb5bce5ed36e7248b43859edfc3a2

                                                                                      SHA1

                                                                                      7f34798e150ecbcfff01ad5d1a3490c7be4fc40e

                                                                                      SHA256

                                                                                      fa5f2502564f1f90930c4e0c775d06a22cd64408e051a05cfb4d088c76ca08b3

                                                                                      SHA512

                                                                                      6295e81763666f8e769d5ef0f63ca373f64bc35823bff1d86cde5c0617e3dd8bd37d8dcbb9bb04395f7d1e3598c2ac87ac4ef8225a5985989030a8d698da47b7

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582054.TMP

                                                                                      Filesize

                                                                                      98KB

                                                                                      MD5

                                                                                      adb0e6874083b5271ff04ed2c2f392a0

                                                                                      SHA1

                                                                                      d3f72ba64d7cb9bf92d1460258580b690eaf915b

                                                                                      SHA256

                                                                                      eb74a522eceddd34d43a6ea18ea091022f8b1d9dbf572dcd9da861ba1e6a3fa9

                                                                                      SHA512

                                                                                      b31cd8387054e725987857801f22558c11b7bf0d20a73a911ddd2edb57d2992a134ec895d6fe84aa491d33550251263744044ce817db318a7c68a95242855182

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                      SHA1

                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                      SHA256

                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                      SHA512

                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\zwinplayer64[2].json

                                                                                      Filesize

                                                                                      119B

                                                                                      MD5

                                                                                      4b9a858432b8e5f49839c29d35d6575b

                                                                                      SHA1

                                                                                      77b0c9e67ec6b41f865f5c1dac5ee926825d6f8f

                                                                                      SHA256

                                                                                      f2f8ca31507bc3c4e1d4218a115751fb7445ac0ad5b8effc21c6d6f85487f8d6

                                                                                      SHA512

                                                                                      c2d1cc468a0da6dc9d9f83af77b482b806d31ba678db4fd9dedaff7a3e2d197518d68067089927ef6d5cbc256f0541f0717c9e3d9a6e10365ce74d1f729fa0dd

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\BatchIncrement[1].json

                                                                                      Filesize

                                                                                      163B

                                                                                      MD5

                                                                                      bedbf7d7d69748886e9b48f45c75fbbe

                                                                                      SHA1

                                                                                      aa0789d89bfbd44ca1bffe83851af95b6afb012c

                                                                                      SHA256

                                                                                      b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

                                                                                      SHA512

                                                                                      7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

                                                                                      Filesize

                                                                                      943KB

                                                                                      MD5

                                                                                      2ff7acfa80647ee46cc3c0e446327108

                                                                                      SHA1

                                                                                      c994820d03af722c244b046d1ee0967f1b5bc478

                                                                                      SHA256

                                                                                      08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d

                                                                                      SHA512

                                                                                      50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

                                                                                    • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

                                                                                      Filesize

                                                                                      40B

                                                                                      MD5

                                                                                      4b5ad874c09b3ffcaea4aa89ced6fc05

                                                                                      SHA1

                                                                                      9faedfbfd6186a1909af132857fd65fd12ddef17

                                                                                      SHA256

                                                                                      1fd516ec4bb4e116152c90f717d5ce956daab8a4bf1a554e64cb76a6ba4e27a7

                                                                                      SHA512

                                                                                      0a29790c432637cb647f982fb0fc7f2e33e6d2fbfd552e169635b63552a27e3391f0fe9851b12ad33138e2ae1778ad93f2491f1bffa6335546d5c6a155a278bf

                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      f3b25701fe362ec84616a93a45ce9998

                                                                                      SHA1

                                                                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                      SHA256

                                                                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                      SHA512

                                                                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                    • C:\Users\Admin\Documents\krnl\7za.exe

                                                                                      Filesize

                                                                                      628KB

                                                                                      MD5

                                                                                      ec79cabd55a14379e4d676bb17d9e3df

                                                                                      SHA1

                                                                                      15626d505da35bfdb33aea5c8f7831f616cabdba

                                                                                      SHA256

                                                                                      44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                                                                      SHA512

                                                                                      00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                                                                                    • C:\Users\Admin\Documents\krnl\7za.exe

                                                                                      Filesize

                                                                                      628KB

                                                                                      MD5

                                                                                      ec79cabd55a14379e4d676bb17d9e3df

                                                                                      SHA1

                                                                                      15626d505da35bfdb33aea5c8f7831f616cabdba

                                                                                      SHA256

                                                                                      44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                                                                      SHA512

                                                                                      00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                                                                                    • C:\Users\Admin\Documents\krnl\7za.exe

                                                                                      Filesize

                                                                                      628KB

                                                                                      MD5

                                                                                      ec79cabd55a14379e4d676bb17d9e3df

                                                                                      SHA1

                                                                                      15626d505da35bfdb33aea5c8f7831f616cabdba

                                                                                      SHA256

                                                                                      44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                                                                      SHA512

                                                                                      00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                                                                                    • C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                                                                      Filesize

                                                                                      236KB

                                                                                      MD5

                                                                                      2ecb51ab00c5f340380ecf849291dbcf

                                                                                      SHA1

                                                                                      1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                                      SHA256

                                                                                      f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                                      SHA512

                                                                                      e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                                    • C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                                                                      Filesize

                                                                                      236KB

                                                                                      MD5

                                                                                      2ecb51ab00c5f340380ecf849291dbcf

                                                                                      SHA1

                                                                                      1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                                      SHA256

                                                                                      f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                                      SHA512

                                                                                      e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                                    • C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                                                                      Filesize

                                                                                      236KB

                                                                                      MD5

                                                                                      2ecb51ab00c5f340380ecf849291dbcf

                                                                                      SHA1

                                                                                      1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                                      SHA256

                                                                                      f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                                      SHA512

                                                                                      e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                                    • C:\Users\Admin\Documents\krnl\ScintillaNET.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      9166536c31f4e725e6befe85e2889a4b

                                                                                      SHA1

                                                                                      f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                                                                      SHA256

                                                                                      ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                                                                      SHA512

                                                                                      113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                                                                                    • C:\Users\Admin\Documents\krnl\ScintillaNET.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      9166536c31f4e725e6befe85e2889a4b

                                                                                      SHA1

                                                                                      f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                                                                      SHA256

                                                                                      ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                                                                      SHA512

                                                                                      113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                                                                                    • C:\Users\Admin\Documents\krnl\ScintillaNET.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      9166536c31f4e725e6befe85e2889a4b

                                                                                      SHA1

                                                                                      f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                                                                      SHA256

                                                                                      ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                                                                      SHA512

                                                                                      113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                                                                                    • C:\Users\Admin\Documents\krnl\bin\Monaco.zip

                                                                                      Filesize

                                                                                      641KB

                                                                                      MD5

                                                                                      1a19fd7c42169c76e75e685dca02c190

                                                                                      SHA1

                                                                                      f16b4697bcd348d44965bf9ded731523db9bd606

                                                                                      SHA256

                                                                                      d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331

                                                                                      SHA512

                                                                                      93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src.7z

                                                                                      Filesize

                                                                                      52.5MB

                                                                                      MD5

                                                                                      7c380ecd5bc2cd51511d0ee5b58df745

                                                                                      SHA1

                                                                                      615749979477621579dd9b04ada8d4dcd9430f1e

                                                                                      SHA256

                                                                                      38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07

                                                                                      SHA512

                                                                                      110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      c7430597fb837d6bc7549b988bdc78a5

                                                                                      SHA1

                                                                                      447d90f6cad3afe3d2c47fd45f730c68d3201990

                                                                                      SHA256

                                                                                      531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                                                                      SHA512

                                                                                      41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      103d84c4a22967defcbedaea6e11720f

                                                                                      SHA1

                                                                                      f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                                                                      SHA256

                                                                                      7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                                                                      SHA512

                                                                                      410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      103d84c4a22967defcbedaea6e11720f

                                                                                      SHA1

                                                                                      f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                                                                      SHA256

                                                                                      7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                                                                      SHA512

                                                                                      410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      103d84c4a22967defcbedaea6e11720f

                                                                                      SHA1

                                                                                      f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                                                                      SHA256

                                                                                      7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                                                                      SHA512

                                                                                      410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      103d84c4a22967defcbedaea6e11720f

                                                                                      SHA1

                                                                                      f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                                                                      SHA256

                                                                                      7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                                                                      SHA512

                                                                                      410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      103d84c4a22967defcbedaea6e11720f

                                                                                      SHA1

                                                                                      f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                                                                      SHA256

                                                                                      7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                                                                      SHA512

                                                                                      410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      5e5fe029bff022007c27d024ae7cf262

                                                                                      SHA1

                                                                                      fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                                                                      SHA256

                                                                                      7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                                                                      SHA512

                                                                                      60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      5e5fe029bff022007c27d024ae7cf262

                                                                                      SHA1

                                                                                      fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                                                                      SHA256

                                                                                      7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                                                                      SHA512

                                                                                      60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      5e5fe029bff022007c27d024ae7cf262

                                                                                      SHA1

                                                                                      fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                                                                      SHA256

                                                                                      7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                                                                      SHA512

                                                                                      60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      5e5fe029bff022007c27d024ae7cf262

                                                                                      SHA1

                                                                                      fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                                                                      SHA256

                                                                                      7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                                                                      SHA512

                                                                                      60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      5e5fe029bff022007c27d024ae7cf262

                                                                                      SHA1

                                                                                      fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                                                                      SHA256

                                                                                      7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                                                                      SHA512

                                                                                      60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                                                                      Filesize

                                                                                      218KB

                                                                                      MD5

                                                                                      5f79e7737e5e8be2cf8711374c114e85

                                                                                      SHA1

                                                                                      86eabaa284074dd2f86f856cea043061091897ef

                                                                                      SHA256

                                                                                      5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                                                                      SHA512

                                                                                      41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                                                                      Filesize

                                                                                      218KB

                                                                                      MD5

                                                                                      5f79e7737e5e8be2cf8711374c114e85

                                                                                      SHA1

                                                                                      86eabaa284074dd2f86f856cea043061091897ef

                                                                                      SHA256

                                                                                      5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                                                                      SHA512

                                                                                      41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                                                                      Filesize

                                                                                      218KB

                                                                                      MD5

                                                                                      5f79e7737e5e8be2cf8711374c114e85

                                                                                      SHA1

                                                                                      86eabaa284074dd2f86f856cea043061091897ef

                                                                                      SHA256

                                                                                      5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                                                                      SHA512

                                                                                      41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                                                                      Filesize

                                                                                      218KB

                                                                                      MD5

                                                                                      5f79e7737e5e8be2cf8711374c114e85

                                                                                      SHA1

                                                                                      86eabaa284074dd2f86f856cea043061091897ef

                                                                                      SHA256

                                                                                      5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                                                                      SHA512

                                                                                      41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                                                                      Filesize

                                                                                      218KB

                                                                                      MD5

                                                                                      5f79e7737e5e8be2cf8711374c114e85

                                                                                      SHA1

                                                                                      86eabaa284074dd2f86f856cea043061091897ef

                                                                                      SHA256

                                                                                      5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                                                                      SHA512

                                                                                      41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

                                                                                      Filesize

                                                                                      788KB

                                                                                      MD5

                                                                                      6499ea6b92ab4971886bd06c12625819

                                                                                      SHA1

                                                                                      5ebb75eeca7625b9511233158a02f50a92867a39

                                                                                      SHA256

                                                                                      6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

                                                                                      SHA512

                                                                                      e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

                                                                                      Filesize

                                                                                      788KB

                                                                                      MD5

                                                                                      6499ea6b92ab4971886bd06c12625819

                                                                                      SHA1

                                                                                      5ebb75eeca7625b9511233158a02f50a92867a39

                                                                                      SHA256

                                                                                      6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

                                                                                      SHA512

                                                                                      e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

                                                                                      Filesize

                                                                                      96.9MB

                                                                                      MD5

                                                                                      8c51876f1b5dfbf4964732a65c1f2724

                                                                                      SHA1

                                                                                      ed5653a3a5655ba65d6221285da93799bd2517f9

                                                                                      SHA256

                                                                                      5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

                                                                                      SHA512

                                                                                      a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

                                                                                    • C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

                                                                                      Filesize

                                                                                      96.9MB

                                                                                      MD5

                                                                                      8c51876f1b5dfbf4964732a65c1f2724

                                                                                      SHA1

                                                                                      ed5653a3a5655ba65d6221285da93799bd2517f9

                                                                                      SHA256

                                                                                      5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

                                                                                      SHA512

                                                                                      a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

                                                                                    • C:\Users\Admin\Documents\krnl\krnlss.exe

                                                                                      Filesize

                                                                                      1.5MB

                                                                                      MD5

                                                                                      4d7c519cc2127f785d13694d7a281f33

                                                                                      SHA1

                                                                                      6d5d49494ca03fb99f7124197296d43c68d0c027

                                                                                      SHA256

                                                                                      6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

                                                                                      SHA512

                                                                                      50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

                                                                                    • C:\Users\Admin\Documents\krnl\krnlss.exe

                                                                                      Filesize

                                                                                      1.5MB

                                                                                      MD5

                                                                                      4d7c519cc2127f785d13694d7a281f33

                                                                                      SHA1

                                                                                      6d5d49494ca03fb99f7124197296d43c68d0c027

                                                                                      SHA256

                                                                                      6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

                                                                                      SHA512

                                                                                      50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

                                                                                    • C:\Users\Admin\Documents\krnl\krnlss.exe

                                                                                      Filesize

                                                                                      1.5MB

                                                                                      MD5

                                                                                      4d7c519cc2127f785d13694d7a281f33

                                                                                      SHA1

                                                                                      6d5d49494ca03fb99f7124197296d43c68d0c027

                                                                                      SHA256

                                                                                      6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

                                                                                      SHA512

                                                                                      50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

                                                                                    • C:\Users\Admin\Documents\krnl\krnlss.exe.config

                                                                                      Filesize

                                                                                      202B

                                                                                      MD5

                                                                                      0ed4b3831ff5e91dff636145f68aac4c

                                                                                      SHA1

                                                                                      2d1140812945dc1b9e400a88c911803639cb2e49

                                                                                      SHA256

                                                                                      03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347

                                                                                      SHA512

                                                                                      4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c

                                                                                    • C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

                                                                                      Filesize

                                                                                      2.0MB

                                                                                      MD5

                                                                                      623cd7b48f9b5f0bfd233ebb930cff82

                                                                                      SHA1

                                                                                      ec32d6a43eac16209aafae6cb3912c398e9b80c0

                                                                                      SHA256

                                                                                      e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0

                                                                                      SHA512

                                                                                      107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3

                                                                                    • C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

                                                                                      Filesize

                                                                                      2.0MB

                                                                                      MD5

                                                                                      623cd7b48f9b5f0bfd233ebb930cff82

                                                                                      SHA1

                                                                                      ec32d6a43eac16209aafae6cb3912c398e9b80c0

                                                                                      SHA256

                                                                                      e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0

                                                                                      SHA512

                                                                                      107cd6ef0de342b4fc10c3ab509a2bef3b4945da7d1108c36c64bd2f38eb540a8885068477fe9a97755d2c5f6e5d5e0f01b8e4bf1846a65285f1471fce604ca3

                                                                                    • memory/3788-735-0x0000000008550000-0x000000000857A000-memory.dmp

                                                                                      Filesize

                                                                                      168KB

                                                                                    • memory/3788-664-0x00000000008F0000-0x0000000000A74000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3788-850-0x000000000CAE0000-0x000000000CAFE000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/3788-939-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-807-0x000000000C8B0000-0x000000000C926000-memory.dmp

                                                                                      Filesize

                                                                                      472KB

                                                                                    • memory/3788-955-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-790-0x000000000C960000-0x000000000CAB4000-memory.dmp

                                                                                      Filesize

                                                                                      1.3MB

                                                                                    • memory/3788-789-0x000000000C700000-0x000000000C800000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3788-778-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-760-0x0000000009A30000-0x0000000009A7A000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                    • memory/3788-777-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-776-0x0000000009DA0000-0x0000000009DE2000-memory.dmp

                                                                                      Filesize

                                                                                      264KB

                                                                                    • memory/3788-770-0x0000000008F70000-0x0000000008F7E000-memory.dmp

                                                                                      Filesize

                                                                                      56KB

                                                                                    • memory/3788-764-0x0000000008F60000-0x0000000008F6E000-memory.dmp

                                                                                      Filesize

                                                                                      56KB

                                                                                    • memory/3788-749-0x0000000008630000-0x000000000863C000-memory.dmp

                                                                                      Filesize

                                                                                      48KB

                                                                                    • memory/3788-748-0x0000000008CE0000-0x0000000008D02000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3788-747-0x0000000009530000-0x00000000095EA000-memory.dmp

                                                                                      Filesize

                                                                                      744KB

                                                                                    • memory/3788-746-0x0000000008E00000-0x0000000008E66000-memory.dmp

                                                                                      Filesize

                                                                                      408KB

                                                                                    • memory/3788-745-0x0000000009600000-0x0000000009786000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3788-739-0x00000000093D0000-0x000000000946C000-memory.dmp

                                                                                      Filesize

                                                                                      624KB

                                                                                    • memory/3788-738-0x0000000008F80000-0x00000000090F6000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3788-737-0x0000000008D70000-0x0000000008DFC000-memory.dmp

                                                                                      Filesize

                                                                                      560KB

                                                                                    • memory/3788-736-0x00000000087D0000-0x0000000008802000-memory.dmp

                                                                                      Filesize

                                                                                      200KB

                                                                                    • memory/3788-811-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-734-0x0000000008780000-0x00000000087C4000-memory.dmp

                                                                                      Filesize

                                                                                      272KB

                                                                                    • memory/3788-733-0x0000000008520000-0x0000000008544000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/3788-732-0x0000000008580000-0x00000000085E0000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                    • memory/3788-731-0x0000000008650000-0x0000000008772000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/3788-730-0x00000000083A0000-0x00000000083BA000-memory.dmp

                                                                                      Filesize

                                                                                      104KB

                                                                                    • memory/3788-729-0x00000000083D0000-0x0000000008414000-memory.dmp

                                                                                      Filesize

                                                                                      272KB

                                                                                    • memory/3788-728-0x0000000008450000-0x000000000851E000-memory.dmp

                                                                                      Filesize

                                                                                      824KB

                                                                                    • memory/3788-722-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

                                                                                      Filesize

                                                                                      104KB

                                                                                    • memory/3788-720-0x0000000007DE0000-0x0000000007E02000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3788-718-0x0000000008340000-0x0000000008372000-memory.dmp

                                                                                      Filesize

                                                                                      200KB

                                                                                    • memory/3788-715-0x0000000007D50000-0x0000000007D70000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3788-713-0x0000000007D80000-0x0000000007DA2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3788-712-0x0000000007D30000-0x0000000007D50000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3788-711-0x0000000007D00000-0x0000000007D0A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/3788-708-0x0000000008810000-0x0000000008CDC000-memory.dmp

                                                                                      Filesize

                                                                                      4.8MB

                                                                                    • memory/3788-702-0x0000000007C40000-0x0000000007C5C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                    • memory/3788-701-0x0000000007820000-0x000000000783E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/3788-700-0x0000000007850000-0x0000000007872000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3788-699-0x0000000007E10000-0x000000000833C000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/3788-698-0x0000000007880000-0x00000000078D6000-memory.dmp

                                                                                      Filesize

                                                                                      344KB

                                                                                    • memory/3788-697-0x00000000077E0000-0x000000000781C000-memory.dmp

                                                                                      Filesize

                                                                                      240KB

                                                                                    • memory/3788-695-0x0000000006FF0000-0x0000000007056000-memory.dmp

                                                                                      Filesize

                                                                                      408KB

                                                                                    • memory/3788-694-0x0000000006E00000-0x0000000006E50000-memory.dmp

                                                                                      Filesize

                                                                                      320KB

                                                                                    • memory/3788-693-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3788-692-0x0000000006D90000-0x0000000006DA2000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                    • memory/3788-691-0x0000000006E70000-0x0000000006F7A000-memory.dmp

                                                                                      Filesize

                                                                                      1.0MB

                                                                                    • memory/3788-690-0x0000000007180000-0x0000000007798000-memory.dmp

                                                                                      Filesize

                                                                                      6.1MB

                                                                                    • memory/3788-689-0x0000000006AA0000-0x0000000006AB2000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                    • memory/3788-688-0x0000000006B20000-0x0000000006B5C000-memory.dmp

                                                                                      Filesize

                                                                                      240KB

                                                                                    • memory/3788-685-0x0000000006AE0000-0x0000000006B1E000-memory.dmp

                                                                                      Filesize

                                                                                      248KB

                                                                                    • memory/3788-672-0x0000000005350000-0x00000000053E2000-memory.dmp

                                                                                      Filesize

                                                                                      584KB

                                                                                    • memory/3788-669-0x0000000005900000-0x0000000005EA4000-memory.dmp

                                                                                      Filesize

                                                                                      5.6MB

                                                                                    • memory/4464-2344-0x00007FFB641A0000-0x00007FFB641A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2372-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4464-2404-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2402-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2341-0x00007FFB64240000-0x00007FFB64241000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2342-0x00007FFB641B0000-0x00007FFB641B1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2343-0x00007FFB64230000-0x00007FFB64231000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2403-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2346-0x00007FFB64190000-0x00007FFB64191000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2345-0x00007FFB64220000-0x00007FFB64221000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2347-0x00007FFB64210000-0x00007FFB64211000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2348-0x00007FFB641D0000-0x00007FFB641D1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4464-2349-0x00007FFB64250000-0x00007FFB64260000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2350-0x00007FFB64250000-0x00007FFB64260000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2351-0x00007FFB64360000-0x00007FFB64370000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2352-0x00007FFB64360000-0x00007FFB64370000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2353-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

                                                                                      Filesize

                                                                                      192KB

                                                                                    • memory/4464-2354-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

                                                                                      Filesize

                                                                                      192KB

                                                                                    • memory/4464-2355-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

                                                                                      Filesize

                                                                                      192KB

                                                                                    • memory/4464-2356-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

                                                                                      Filesize

                                                                                      192KB

                                                                                    • memory/4464-2357-0x00007FFB643B0000-0x00007FFB643E0000-memory.dmp

                                                                                      Filesize

                                                                                      192KB

                                                                                    • memory/4464-2358-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2359-0x00007FFB62DE0000-0x00007FFB62DF0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2360-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2361-0x00007FFB62E70000-0x00007FFB62E80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2362-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2363-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2364-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2365-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2366-0x00007FFB62E90000-0x00007FFB62EA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2367-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2368-0x00007FFB61C80000-0x00007FFB61C90000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2369-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2370-0x00007FFB61D90000-0x00007FFB61DA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2371-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4464-2401-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2373-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4464-2374-0x00007FFB61F00000-0x00007FFB61F20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4464-2377-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4464-2375-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2378-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4464-2379-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4464-2380-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4464-2381-0x00007FFB63970000-0x00007FFB6397D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4464-2376-0x00007FFB638C0000-0x00007FFB638D0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2382-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2383-0x00007FFB641E0000-0x00007FFB641F0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2384-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4464-2385-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4464-2386-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4464-2387-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4464-2388-0x00007FFB64200000-0x00007FFB6420A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4464-2389-0x00007FFB62140000-0x00007FFB62150000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2390-0x00007FFB62140000-0x00007FFB62150000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2391-0x00007FFB62240000-0x00007FFB62250000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2392-0x00007FFB62240000-0x00007FFB62250000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4464-2394-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4464-2393-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4464-2395-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4464-2396-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4464-2397-0x00007FFB62270000-0x00007FFB62294000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4464-2398-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2399-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4464-2400-0x00007FFB61970000-0x00007FFB61996000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                    • memory/4948-234-0x0000000005B20000-0x0000000005B30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4948-133-0x0000000000ED0000-0x0000000000FFA000-memory.dmp

                                                                                      Filesize

                                                                                      1.2MB

                                                                                    • memory/4948-138-0x000000000A4A0000-0x000000000A4AE000-memory.dmp

                                                                                      Filesize

                                                                                      56KB

                                                                                    • memory/4948-233-0x0000000005B20000-0x0000000005B30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4948-137-0x000000000A450000-0x000000000A488000-memory.dmp

                                                                                      Filesize

                                                                                      224KB

                                                                                    • memory/4948-136-0x000000000A160000-0x000000000A168000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/4948-135-0x0000000005B20000-0x0000000005B30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4948-134-0x0000000005B20000-0x0000000005B30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB