e6123e01c5dd8db903ff062217e1a0ec934373a7e660bb3b7f43d8214d21d408

Analysis

max time kernel
194s
max time network
196s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/06/2024, 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krunker Central - Free Hacks & Cheats 7.1.1+.rar
Size

316KB
MD5

6f2c324e7084fd2c079b6153bb80223f
SHA1

23fc5d10d0c002f3c5a3b306265cd8f6dbb39b56
SHA256

e6123e01c5dd8db903ff062217e1a0ec934373a7e660bb3b7f43d8214d21d408
SHA512

ef98f250e0ae0994f747d6027857cf89dd39558e4286c201272bf06f9f65f12488a574f5c1f34a7827cc5808b4cdb8474a0ba8fd6e4afe351b955e45f240cd53
SSDEEP

6144:V6isjXp2t8TcGlmFQxFX3ZyMC1A3phvAGQG2R2EUtTkuEj4E5gAA:VNt8TR8Cphv82FkuEjLa

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
238	discord.com
232	discord.com
234	discord.com
235	discord.com
237	discord.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642144020434865"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{6C00E0B2-7BE5-4E40-B83F-D141D27B4754} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{087250FC-9263-4DFE-96F1-C116CC1FF0EF} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com\NumberOfSubdom = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1436	MicrosoftEdgeCP.exe
1436	MicrosoftEdgeCP.exe
4344	MicrosoftEdgeCP.exe
4344	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3680	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4524	MicrosoftEdge.exe
1436	MicrosoftEdgeCP.exe
2376	MicrosoftEdgeCP.exe
1436	MicrosoftEdgeCP.exe
5032	MicrosoftEdge.exe
4344	MicrosoftEdgeCP.exe
4344	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4404	3832	chrome.exe	80
PID 3832 wrote to memory of 4404	3832	chrome.exe	80
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 3516	3832	chrome.exe	82
PID 3832 wrote to memory of 856	3832	chrome.exe	83
PID 3832 wrote to memory of 856	3832	chrome.exe	83
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84
PID 3832 wrote to memory of 2496	3832	chrome.exe	84

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Krunker Central - Free Hacks & Cheats 7.1.1+.rar"
1⤵
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe5b59758,0x7fffe5b59768,0x7fffe5b59778
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2988
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7f84c7688,0x7ff7f84c7698,0x7ff7f84c76a8
    3⤵
    PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5424 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5484 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5712 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5664 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3084 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3076 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6032 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5512 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2904 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3636 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6100 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6004 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5988 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3092 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=2540 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=2444 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=2948 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5932 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3140 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=1828 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=1496 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=816 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6004 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5424 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:1
  2⤵
  PID:300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1852,i,15794409701199576544,14556091991675314835,131072 /prefetch:8
  2⤵
  PID:4480

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Krunker Central - Free Hacks & Cheats 7.1.1+\" -spe -an -ai#7zMap25900:150:7zEvent26497
1⤵
- Suspicious use of FindShellTrayWindow
PID:3680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Krunker Central - Free Hacks & Cheats 7.1.1+\Krunker Hack Script.txt
1⤵
PID:4480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:2100

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Krunker Central - Free Hacks & Cheats 7.1.1+\Krunker Hack Script.txt
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
16KB

MD5
8e45624405f4c4ca2bbf3c3870174e15

SHA1
b45ef653e5cbdc1b02f110196920d98416ec64f1

SHA256
a546cb599aa3a1506d42355d8ade4912484be5cc4fdd03c9c972baa08973a530

SHA512
4bc31fd1c11e85c88bbe53ae9387fe495ec8de3bee295205083787ab5493a32d0eb10eb9aa1328b050fe657e9dd6021d16671ae6411e7f3563ab56664ce6103a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
26KB

MD5
d27144b20c25dff04c9c77fed3e608b7

SHA1
72b6ef6dd6fda7cc3d26d39dd62a6c712b68d022

SHA256
fdc7c3336b033d0a774af92542aed956a720dcec73c9555c493589e68a267ca0

SHA512
1296015187139eb65bbc794c5d5d749c5c431216a3b2748bdfa4440c8dd0cc6e6702cb5c78d8997900ba3539f244f320af0fd1de512592f8efecb91fbb80133c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
16KB

MD5
9d95b6d00b5d326ffa9988ef3c6b2ad4

SHA1
a065fe1f6302343a14c8815468a1fb10d30d39d0

SHA256
325dc04d51d4237200b2ded7990f41c9cddca002c48a46852a98dfd160558093

SHA512
bdd1a8bde7edc99c1d1088024844f571570d2f5f63c73bed6726f2418ff6d36b5fa3571a72e3038629b412a66beec8c390314d6c4f4c74b4f873f848289f5d4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
101KB

MD5
2314b8ff60bd5cd832b1e081466e3ad8

SHA1
124c741637fa023558dd50e230b26f7ce33953d0

SHA256
509f7a1a09026ac7a36b77fdafe09df4e4f07aed0976910296dbe5d92a7d5a53

SHA512
1b60430929ff46ba60c59532f4c7770d8bdb359fdbcb606db411e1c6ab0b09d33047c180ad5bbdd54dbe978333b06802041db8aeea1d016b9a7a78fa6b7c0492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\142a528a8a37a27b_0

Filesize
279B

MD5
864990b9379c49720a4712f19f5a7fe7

SHA1
e83e8d7a1b3e356cbcf1959c23844279bfe33cff

SHA256
3f768ebd23c48dcea0772ff94470551e7d01bcfc250a1be76b71340b25220652

SHA512
e67de4d18cd6ec9f47423beec44319219fce2f3a44b46e17c1d5177b27c569b9097b35c9edb379b52055e85fddeb40c5ec4e419f47a179795c8c33f3533e0378

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c72eaffe54c388b8_0

Filesize
33KB

MD5
24297acf7ad9c2321e7e8b58e6b15983

SHA1
715d187f0b1649cfcee512067e9c7b4936d9aff1

SHA256
d4327e734e754c27612f13422e2e879df7169112da0de943f77aa310f9895a21

SHA512
2e454b877845d68f10e83a8a37171bef4dcfd7f5b2d6132c889b8a1093f019e0e76c25634bc1882f8e18c5ffc5fb2f1cf42627eddab1ad9bfebd5e1e032063cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7e3029608ee1b5ef7c079614160f1534

SHA1
f8a27f4429ee596037e5dfc7dab0ff20c81ed31f

SHA256
ada3ab9e387c5216cbd8347e199e2188d1740c5eab6e8f7105da30c004c7e272

SHA512
b3d7aa0c41ec837523c9b10982c17bdac8e9f8aba3fd4c20da75ae2510cd1f0674ff717fb7e9ddc883d843a562717f97b3cce69e189953ec771913f56bdb0ba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f231ac3549ce622f416a7a7d9b45aa3e

SHA1
bc815676ae6a1249836e54dc28d3432b165a4228

SHA256
78c7a6e9e7447a17e3ea559e2fc88404039adce8bc1215043c0698666a48bb2d

SHA512
fecfc763406784fd3a9415c4fe3caa95fabcf191eeaf8a01111e8acd0b5dbe6d08ba3292325aab1fe99db9e201e46b3f0af0e061a3406e4a034837f4d041d86c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_krunkercentral.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_krunkercentral.com_0.indexeddb.leveldb\LOG.old

Filesize
395B

MD5
dad8b329a49ce73c8fa9692cb85ac667

SHA1
ec7a29f843ad6f8d23f428aa43abb5b862787e30

SHA256
ced9649e7569fe9dcec09a6f44ce4d0a826c13a609963cb8e2942aeca7a0a62b

SHA512
174e3ecef946228aea79c080387a6f7b94b9516b613bfad14c900c0f8599650958ae81ec58de13f4a309dceeaf35e13d35843dc05f614a0ce4e4e44206f01a94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_krunkercentral.com_0.indexeddb.leveldb\LOG.old

Filesize
395B

MD5
25d10286be83810ce2be9c5d9481ac54

SHA1
d987115d74b79c9a2ad2d9e097d6218bfc336f2b

SHA256
6fdf121e06b1890cfce7e5920b81169d8962b2b9a634d61099bff34685eeac77

SHA512
0490c47cb5d15a450ecc7d334541765be0983093b5072796acf1c798e54c14c4f2607a0f683bd32ec3319d7dff117f37de01184c33134486617a417f8d29b36c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_krunkercentral.com_0.indexeddb.leveldb\LOG.old~RFe587f6c.TMP

Filesize
355B

MD5
965e5a50357b2b00298a5c573da0f0c6

SHA1
bf2c1f9a2d755febb6663bcaf09fe2ca9d58c7c8

SHA256
b6332a5fb9e8da51546c899808fe7860725d1a1dd6bb37201df69369e8415a0c

SHA512
d06ab1059950f3423729ba62908eb7d4f750f0bd27e9749f6a6a18bb035094503074a89b21eafdfaa123aa974e6453b3cb2ca806e35d312e17934988059b342d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_krunkercentral.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsRecentClosed\f3376ea9-dc9f-4330-b52e-4d01a31160f9.tmp

Filesize
27KB

MD5
12c8f37ef9de42e31dc6935bb435c921

SHA1
5ed30ac66cba705ef628706333bb14abe835f367

SHA256
2a1440db826d2ef9df415dd92c9cb0a7d83846959fe4211af765658ce7072139

SHA512
1d392c548ac51cc0103fad868d994a93bd7bf183ad1237ce0280324e6c771d2f3f5bfcb01b52b7b5d266903d6a2994953f811abe5cb4b2ab7743d664caaa4a31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
bf0c33e140274bce2b08b22e4a5e67da

SHA1
3e04b053827c32cd6fd6d461db4661c39b3f759e

SHA256
3ecd03f9da2262916d17ff92ef7ce7a6c3550e4f008fdc08d6a2a89437fa5683

SHA512
b350a084c6c3eadbc606f41d1f31c7fa910482746d8c7345cd2b073783ce369fcf3119ec667a7bbbfc93b8d9c1702f4d62c60da77c355d3edd130f15c010ae8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6ac642d2a0c442f64627c86a341f663a

SHA1
c6d4ea2b18e8f63633276d0679268570c2a197b9

SHA256
16e292e05a5e7b3b3113d27f0e7008e214813e733d66ca34d54f6da716cee5ef

SHA512
18cf7c94b83ea596751153cf9238bf29b329e54c04a67f5b8db9debef3c953133937e3dc6f0bace035bc64d777c2dc0ae3a661e3092bfd073a06a431dcaf3dce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
042ca093b1f53939c5eb5b2963f5600d

SHA1
bdc77b03396562cac6774701eb153c6287604cfb

SHA256
015246f2e4986b905c0be75c6acefe5a1abbccb3b93328160ebe5a4705392577

SHA512
b09155b9a1918b18b7b4861a98fe96b93b049541728aa2daf3f7cd8305ce0f9307c25f56a739b146e5abd0baef7db59980ac68a240f574fc7a8362b809969db3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
460515a7f073963ebd2d68a7531ff8e5

SHA1
b9cd29725026cd3458397e624c10966f5bae1115

SHA256
41d202b76b6da28451142cbfb6e17d839794a64b9853982d1ab83f70db4b3b63

SHA512
0aeb4a5a92fa1fe98d29ba699a83f45020285a029657840aa62332dbedb1060f0f82e676040098564a589c812e15a89a6aee49676730e1514f45da7b4aaba389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1aafef1e116de2b860661d3fc0668df7

SHA1
1689ac68ad20c098c3f0a22847bda7e150ec446f

SHA256
750aa48acd22c9ed1620a1c8740c11e4e7e915fea7cf597a37ad870d125a5f7d

SHA512
59c5d13c2ce596c4bf1fd3bf8b784a4d9d584630aa55c2925bedc87dd12f8390341b78126fd5074194f093d5d62fdc44bb8375879562a41acc9f830fe56d4229

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c1c5471b842b1b232b1382d724e2dc36

SHA1
777519383d0761e46b2076fb0e22364a54b1b318

SHA256
ed7def3d54f1dcf6b6551935ec483e0be114378137f769076d1041e5f9d5d9ed

SHA512
cd67dd1c2bd0705aa4d089c2f2b5eb9163c26bf8b7efa4bfe5dc3470e617898352780e1255b67af9ffb20337bb3d684b383e3fcd11999afdc3cf2e66a242cb96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c4484e95b66c4d918f4843406754dfb8

SHA1
203bc6b9f20fb90f9be46ed06ee73fd7a0d12fa0

SHA256
25ad22db83df8dac90c6176b413e6be991863758e130ec4d0d36596737cf88c1

SHA512
f1bf616fb28bc4448fda01eb392969be0ab9c767c445bb66e64656828c829cc0d3e47e65bf43cca60263f25411fef29a037d3294e5bd50cd3b6e3faf70feaf7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5daea90383691f7f949a4c4cd3e5628a

SHA1
87aab8772d9761543c8746d68acf92a96a963f26

SHA256
9e94f79673773194d4357e61f7a497d70feaa076914d17100b17fe023f3b9476

SHA512
a1db4635703937e510e3c4869df1fd832079845665f8b350ed194689eed4c0abfc6758c591a03b3e5029fca59865f1162db4628bdeae059b73794a4612996e8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
edfb795334926c1e8e46df7dce11ab15

SHA1
2e43f63860460291d56459efb701e6f5e07c5d8b

SHA256
9671eabe8d9efb60d7387ed90d5d3d416909abac51d2fa91874ebe9b74ad907c

SHA512
3669b12345efb81ce59284a51d4a4701a775f47e84287cca11f8b369d1a19142086bdf38a271fbdad9ea24397f518764790646ceabe5f1083ef38812e301bc0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
233f6ddd297c1a4f746a86b003b448f8

SHA1
8d3080c508009ff0780202b378c23eee3c0a68b2

SHA256
393b31983d1d619c9f055d8b9f3aafefe2a97c00d7fe1bbad1fc5ddff36fb84d

SHA512
253f514b6017eea471d52ba95669b05712689bd1d46378c6963a13574f17d6aafbf6a6bf52360b8f78d1805f48bd546328fa257805357d97514d0739e365ec3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
851812f7db8a0db0f20a3a13798ef251

SHA1
4e82e5377b1c6898d6f05d3218293e8a160a5316

SHA256
ee65ae7c068ce616314119f4b36c4b4a52a1a56d0b8a975271dbba2cf0f25965

SHA512
09852013255c5ba98a7ca00c42aca68b4678273d603d8c96932ff0504011a1220ac233abfdc589415b013efa748aa4c167553a6cfd3a7c506b3096af2c6d2872

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
11805fd82eda03e8c24771c8ec139e57

SHA1
83fbbf5610427d3752ec6f0b6a41cdca8fb8ba1a

SHA256
60f00bda429d9c19e0c9616d1e91221a5e4af23ab0eeb1f4089cc4f715e636ae

SHA512
7f3c6019fa79fb82942b40a0fc6fe3512a0c005e0be2169ee86ebe749626b911a5e8dc12dc87f7a7533bab89472a2ca3b4229b15141cb1b215224679ae510f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
3e68413cdad6abfc5721087dcaa81b29

SHA1
b239a1d964932447e395ec6fb8499101c7f9d857

SHA256
46728d70167067b589d2d09396ec8ccc6cb4b4837e2d668036ca8343db4d381d

SHA512
dd522e2ea77f872dcc69914853c62483a77a6f46436a9ffa1cbfa01555d93630d3e14399e4af7328fba80c13f3b86397a84e8f53a91813c70e11e943a7d564f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
66d11aca3d39e3db19c559a69a2d2152

SHA1
32dbaf23b2e892fe0800c97f96a37c2cbc271bcf

SHA256
0b762bf96bcde65c7c081cc3c9af4c7122baa2eb57f72fe852fa1a372f83aa66

SHA512
8ac5be7ef9db68e14f5cf3f5498d8d7da7ff6f25c634f68e727ecc2df631d2a7b5ddce499516bda71fb80fa815512f16e1ae2ee3190396f52b0f3d6dda484697

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
289KB

MD5
4afd65d9d36c1e7a6477423dd7f2c373

SHA1
1949a6c0e9acb5cf519a87e1ae0e73b68f2da825

SHA256
3fec115bf727ea358b05ec87ff544afdf914885b11cbd10e6d7c68591b5a2a35

SHA512
29591e3cd6aa163185e46d3c3a2d461008b27c4246ca4b3d666bc37bec7c3d2ca43a7aea184dd61dbb24bb9882e2db561dee976f8e5420330d623d211ce3bd80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
289KB

MD5
3b6dc66c18b7d471b991276d4ee00841

SHA1
24f8aa02c1b012654ff92b51d0ed49442a696e4c

SHA256
8e2f3a6975c627a3e9445eed99d9d0acd4c113c6ff675d76fc34e4f7d666910d

SHA512
296c66cefa056d99d2289c40eac731c8852fc09debabd8fce972a53edcfd383fde0009105b8e8c7bcd6d60719fbd5a7ad6bcd024c74e17e1bfdbc86b28c4a40f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
289KB

MD5
301091dd2bdfe17de812e3f2b6426d43

SHA1
8ba1576a3eacf3de21671575f5f1e0e5f817c588

SHA256
8e22b2b7a700e04c4d4bee1dd05fdbfa9a9904764d133e4101898487d7d01452

SHA512
ec6f8f40073bf388f9bc7194a5c269b69107f12ec1186da0045691a1939f05ded2ab73da97d2de6bba947e61476bc5fd1afc43b3d8790e879eea85e368281d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
289KB

MD5
24ee94041e64f1affe769bc85a4f77e7

SHA1
7c6cab64248ab78fa57de9f878abb8bbd8513b56

SHA256
5dfcfe41b09aec8684ddd60fccbfc1c208955df449af686f76054649d461222b

SHA512
79086f2868a8c17dc655b858132725698f1f1f3b14a93636a66cd8eab96b1c76554766ec3ea222363989a880418cb0d4373b72fb6c889894bd156c7332ce0016

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
289KB

MD5
807a9d297963abb8cb1d4f5f080e8676

SHA1
3931330ea9938052ce6bc84700054b0d75d68088

SHA256
4fc812217952e86f63b8165ab59980c2ca8220459fb8c4e913f45ea246583bb7

SHA512
d5f87baacde018e2139c119b131295f7309eb4fe62bc773792964fc7f929dfc8b8220ffac300fe9fc76c520de65a2622b246164f250a73b1b8a2d6bd1eab5aa8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
a66e53c5d36436842a3fb9b80a358fa5

SHA1
cac937061e7e8464e56f90e4793f160a0b7fcfbe

SHA256
a433134338fff1a9cd05b8c19725964f53e209a13139e9cf3aa03f12a749dae4

SHA512
56b74bc2ea097aef5b82e539ee5230ac27195c17bab915b450c6ca73becb414b623b1acc09b982eb5895f48bd606fbc7db299e8db2e946ed7512ffb1cd0ab805

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58a6ab.TMP

Filesize
99KB

MD5
eb46c65c979eb08b9270319759b3bcf4

SHA1
98522395627be5e0bfa7d0f46f71c662e6d5799d

SHA256
e5f96dd97afe3b24a05e8130b24ff090e93312c4fde96d539100d587ec9dad29

SHA512
0795e347420964ab40f2e1078a3f74fab7cbf267bcc8175917fa07fbb0dcb15470d8e6b112cc30324ac59921c428a8a6331f4f4d566eee284b756846250e44cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\W7KJ4SZ8\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
6ff54f7b354a90da9c9339881de23ae0

SHA1
68f3fa65e3ded664a2ffe3c000121fcd744f4fed

SHA256
bdf015bf5e2aab5153f911da68d596fd351847d73146dbb8803773f2217d7524

SHA512
1b0cfbf2d5529cc31e3790410f359b5b91fe5e162f857ed122022ea2fddd1cda670168a4b5250873381d53ebc41be44408d00b5e3d6c629e4d76d716b967b4a9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\s0hthtl\imagestore.dat

Filesize
24KB

MD5
0634742404fc49430a67c8122137d412

SHA1
ec12fa32578de713669fc6b0bf8024a6f944a3cf

SHA256
758bddad6fe9638b593541b9d9bee62e34435c814c07090a429a04094a5ceada

SHA512
d91e4319707b8821498df0e6da20a99bb7e03548a56590c6a625f760577e3480dfab41087734512cf66332119ddaef709a8608d9f7decfefa0e0030255687c74

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFCA3C00C1933FE9F7.TMP

Filesize
16KB

MD5
e7a81147cbce8ce1529a8b79e2922ba9

SHA1
095a5f14a4438e1e8009ef833d644a40aa4d69d6

SHA256
0f8583e89b2efd1ea66e9c73960a35234499d0046f0ebccd312698ffabdbbab2

SHA512
de30f25da4d06ea092e7adbd9000054dc28c84d12335ecc94b88a357b6277e14a286b0311c56900122939c0efb21bfd9251b212640b480c3005e0fb287258d83

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
e0b24cbcf6ae6cf81cbbf93f3ab83555

SHA1
4e05c3681eaa4dfda685e80415c18540dbd1b1f2

SHA256
3cb3aa6f53dd0d1a6a9773c81017b640e4ddf839fa4926e32b9bcdb4418ef06f

SHA512
d6e074de556d4570332f540c4919481641746c1140e9edd26dca37767a61ffa17576d167831086d80fb08807132c14e3dd8b88bb10386da86e0892a22ad637ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

Filesize
8KB

MD5
cd9e6b6c506839369c626c3805e7d72d

SHA1
d09bd0dfe07c0814d5ff1f09e2c26da4f5d19829

SHA256
6f94a4beba46511a04dfaeccebbe929919bc038cc3dd1ff17d3986a373d82ee2

SHA512
f7207f23d9d8478827f3ab34af6dbdbd794cf93e3f72a2278f82a1f8e4c03264d689b0ecb85f66f33ac7975f76082e9896575a5fb42d3c92c3a852eee613a023

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

Filesize
2.0MB

MD5
941d6e16b057dfee75f9541c3e1a4008

SHA1
5776e37151acd60a30feec0fbc5fb70207000ed7

SHA256
fcac99b386fe084a702ea32e89c077b5957ca2cbba87610ff83da6dccc76fc3a

SHA512
4f23fd263214edcbb8ec3c65eb1345501ac990e2e9bda0c92e1cd23d293d528345d3d30c7fa139d7efc606411d982eab62254a396966f4908e477183165bd751

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

Filesize
16KB

MD5
4a4bcaba305df63290f4e103f0ae7461

SHA1
96c8f2bbe279cb666d6bf8fa204a2a85a1aad3a2

SHA256
15fe68658419478a5c1cac85569182572f07df36eea7e16cd355d1cfac1beb95

SHA512
e33f9dc493149832bbc0442a72f8b9234a7ef6b6e75ebdddbec76f3ab1ae316e02d16cd23467ba3a4d151a1ddbbd032cd0b659ed32c85c26031fbc207651c70e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{087250FC-9263-4DFE-96F1-C116CC1FF0EF}.dat

Filesize
4KB

MD5
330ebd0bddb8ba46a7b1fb98fec0e948

SHA1
861a4372823b9ae99d472499191a45fd40d5ef2f

SHA256
970b7917e3b41a058bf80a41e8dbf998b85af4d8939a1567e6983f478326a5d0

SHA512
21c99c6c9ee5d1fe7dd38f1b12898d98460d5f3ab5d933c3b62de5871405457f280e52c27144a096d8e178578adf9c556d4cf952b69f0642baad6294bc4e9bed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{70AF8781-0370-494F-91C8-7CAEEB87613C}.dat

Filesize
4KB

MD5
fb5b9d8e334cd2bc1b730f69ba7d9a10

SHA1
c22de104b8afe8293306f884fdf69225334732d0

SHA256
da9fff00552434a07e96b2baf91b004d41c9ba91f627a00a5c587b5d7ce88367

SHA512
575eb9a00a0ed19400c0a57f37874b67febe5a4ac2a767be72a89fd076d29d01cc857307d79a5dca8c9cc2931451daa7aedaec67d8670a0af20b50e05e5959ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
4fda5521d7a59e8a6ead12328fb7ff68

SHA1
2bc5f7291847c75fe063d44eb9d83f2723b964ae

SHA256
229a09b9408e9d7e975d14d74690ea8dc09e689bb9b417abfd5522cbc4499e88

SHA512
d7eddbb17635d6dd054f84603f450f5ee4b911db8a88b8eb3c45375a9a89f719ced9c514a77e1bd306a99ae211d8e4f12bebb88e68447bfda05afd3a1aa3586d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
165505d9aac16f785083e3e05bfb37b7

SHA1
dee4c4c579c0867c8a99181f031c86a567cfaab2

SHA256
f6cbe151b491d5a02195554e635f486d46c67e63024319c3063150e528d36739

SHA512
2da9d6178e838ea011b45b95cdbaba368ea1ab29daea9e0f111d4b2c328c70499a84ab3b51bcb404a0bf214d5e00ef86425050f902c656da79438d2a603e53c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
dc70917a40faa6371cd44272fe2b1e8f

SHA1
2d659ec9fa04eb3071393c1df23fe99cfa4850a6

SHA256
5a83e7f837b80bb1b932c397612672b3b4e6165c4e7ed40f05732432dc1c034e

SHA512
7bf1651d15d402d0d277938263a252b1998bcebba3cdd4cb2aca11e6bb67ad266b50f3b83b4a76cca244400b0d65bc65d7441af6479c53cf74f00c5f33331a4c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
1ffaea06ad2ff093ecae902b51a8bbcd

SHA1
b6d0dfabb8d480ea46adbf0322c6599a88f98690

SHA256
63512ec5eaa7ef66dec48d509f816d24619d3b9e0cf0a3c44cce1a76944ef860

SHA512
7cf765e1dbcb68a7b0ce44a0e7f78e56a2ca38b45aa1347e885f21eda1d02ec5b5fcc2eb9274776f6c8751d033743763b54bc23745e17811c99a8ab9ef77e694

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
9KB

MD5
d599edf06194b8db9ccaecebfa9ea42c

SHA1
9b31c712cb6f85c8c75c140e0f7dc581c7d97e01

SHA256
c5b0b1e2edcf60412eadfb5f347f99aa9425edae8774d704d3c2127489ffa643

SHA512
cb26f0fa7c6002b77c9817aad7f931124a4dd3da86b55f0ba7b29a8f3de4a44191edbb8dda8b50e062a3c4b528c67ce3a9627c0f26ac055816ad4708c0d33556

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
419ce1e1c9704bdd30d5cd990ca866b6

SHA1
91428c999d13c17250683cadf58e29fcfe71a968

SHA256
3b42adb5461edea83f77b1a839607ec4d49a72fb3bf7a55f55cd6283fd63d616

SHA512
03fc532f069f1caef31e620232a778a4b386a22d11ea97c2f2a757c69d0f4ab536b66717e3bbe88ab8eb6f15f228b014349e299cf21ff52ec569cb5074479455

Download Submit
C:\Users\Admin\Desktop\Krunker Central - Free Hacks & Cheats 7.1.1+\Krunker Hack Script.txt

Filesize
858KB

MD5
2897bb0dbcbbd2039fadddd9dcf653a3

SHA1
1f4976d3ac3b3de9dc8af4cc5ab57c4fad8650b6

SHA256
1300bf6451d0d18a564a4787ac9f89a381324437ea43606e8b4ecb931fa3dfb7

SHA512
bc9f90a3d718142c42066f1a4f3317023ff5c8ae8319a864b38088fb3be2fbd564a7b4af01986638676f14f809a8a30df4076ec0ead34fa4402c1424ee1518e3

Download Submit
C:\Users\Admin\Downloads\Krunker Central - Free Hacks & Cheats 7.1.1+.rar

Filesize
316KB

MD5
6f2c324e7084fd2c079b6153bb80223f

SHA1
23fc5d10d0c002f3c5a3b306265cd8f6dbb39b56

SHA256
e6123e01c5dd8db903ff062217e1a0ec934373a7e660bb3b7f43d8214d21d408

SHA512
ef98f250e0ae0994f747d6027857cf89dd39558e4286c201272bf06f9f65f12488a574f5c1f34a7827cc5808b4cdb8474a0ba8fd6e4afe351b955e45f240cd53

Download Submit
memory/2376-831-0x00000264727C0000-0x00000264728C0000-memory.dmp

Filesize
1024KB

Download
memory/4524-862-0x0000020772C50000-0x0000020772C51000-memory.dmp

Filesize
4KB

Download
memory/4524-855-0x0000020772E60000-0x0000020772E62000-memory.dmp

Filesize
8KB

Download
memory/4524-858-0x0000020772E20000-0x0000020772E21000-memory.dmp

Filesize
4KB

Download
memory/4524-822-0x0000020772CF0000-0x0000020772CF2000-memory.dmp

Filesize
8KB

Download
memory/4524-787-0x0000020775A20000-0x0000020775A30000-memory.dmp

Filesize
64KB

Download
memory/4524-803-0x0000020775B20000-0x0000020775B30000-memory.dmp

Filesize
64KB

Download