3392133e65749a7f84242e168390084c45b7739b6931921e9d138ccf67dd3678

Analysis

max time kernel
300s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2023 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mGBA-0.10.2-win64-installer.exe
Size

15.3MB
MD5

818f3b5e496c9911e8e1da06a9be6205
SHA1

99d075c78516bbe18c14ae5d9354ec3ace8be5dc
SHA256

3392133e65749a7f84242e168390084c45b7739b6931921e9d138ccf67dd3678
SHA512

d5e5657bcccfae3a726e28f2dfc0c192926adaeca866dcd40af50a6fe933412558cd7b8f7913abf91e59bde8cd9ca0ef78c44b59cbfc7b946c959408aa198244
SSDEEP

393216:tVDNiNedpAm8BUEImw8NMtOymsNMy8E54n0UC2/mIT5:ttNiNed2M0u7Z8mUjDT5

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll	aspack_v212_v242
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll	aspack_v212_v242
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll	aspack_v212_v242

Executes dropped EXE 4 IoCs

Processes:

mGBA-0.10.2-win64-installer.tmpmGBA.exeGame.exeGame.exe

pid process

1168 mGBA-0.10.2-win64-installer.tmp
4396 mGBA.exe
4192 Game.exe
380 Game.exe
Loads dropped DLL 10 IoCs

Processes:

Game.exeGame.exe

pid process

4192 Game.exe
4192 Game.exe
4192 Game.exe
4192 Game.exe
4192 Game.exe
380 Game.exe
380 Game.exe
380 Game.exe
380 Game.exe
380 Game.exe

pid	process
4192	Game.exe
4192	Game.exe
4192	Game.exe
4192	Game.exe
4192	Game.exe
380	Game.exe
380	Game.exe
380	Game.exe
380	Game.exe
380	Game.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in Program Files directory 52 IoCs

Processes:

mGBA-0.10.2-win64-installer.tmp

description	ioc	process
File created	C:\Program Files\mGBA\shaders\scale2x.shader\is-563BC.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\tv-mode.shader\is-PS9KR.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\licenses\is-AU1AN.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv2.shader\is-QI6FF.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\unins000.dat	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-7V00B.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\lcd.shader\is-E3E6Q.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\pixelate.shader\is-L57GN.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\scale2x.shader\is-KA9T9.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-TCJA0.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\scale4x.shader\is-JKDU4.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\vba_pixelate.shader\is-E9E45.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv3.shader\is-5M3E1.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\wiiu.shader\is-PM9KV.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\wiiu.shader\is-CJ6OB.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-T23AD.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\gba-color.shader\is-4GQGT.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\motion_blur.shader\is-8H5VF.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\soften.shader\is-FT6QK.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\vignette.shader\is-6OPFD.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv3.shader\is-H166Q.tmp	mGBA-0.10.2-win64-installer.tmp
File opened for modification	C:\Program Files\mGBA\unins000.dat	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-8VI86.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-48BVB.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\ags001.shader\is-O1TNP.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\ags001.shader\is-QRL31.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\vignette.shader\is-OUPQV.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\ags001.shader\is-0KUDI.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\scale4x.shader\is-Q13P2.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv2.shader\is-UIASN.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\fish.shader\is-SPHAP.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\gba-color.shader\is-D4S3M.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\lcd.shader\is-3D3GP.tmp	mGBA-0.10.2-win64-installer.tmp
File opened for modification	C:\Program Files\mGBA\mGBA.exe	mGBA-0.10.2-win64-installer.tmp
File opened for modification	C:\Program Files\mGBA\mgba-sdl.exe	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-A2JPN.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\agb001.shader\is-05UPP.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\agb001.shader\is-FRH7C.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\licenses\is-T7LA3.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\licenses\is-8PIFT.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\licenses\is-B7GSR.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\motion_blur.shader\is-PJS5R.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\scanlines.shader\is-V65A8.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\soften.shader\is-G8MBE.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv2.shader\is-63K2A.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\xbr-lv3.shader\is-US4DV.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\licenses\is-RDOB5.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\is-KJAKO.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\fish.shader\is-4ONKK.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\scanlines.shader\is-2UTI2.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\tv-mode.shader\is-98HV6.tmp	mGBA-0.10.2-win64-installer.tmp
File created	C:\Program Files\mGBA\shaders\vba_pixelate.shader\is-V96N5.tmp	mGBA-0.10.2-win64-installer.tmp

Drops file in Windows directory 6 IoCs

Processes:

Game.exe

description	ioc	process
File created	C:\Windows\Fonts\pkmndp.ttf	Game.exe
File created	C:\Windows\Fonts\pkmnfl.ttf	Game.exe
File created	C:\Windows\Fonts\pkmnem.ttf	Game.exe
File created	C:\Windows\Fonts\pkmnemn.ttf	Game.exe
File created	C:\Windows\Fonts\pkmnems.ttf	Game.exe
File created	C:\Windows\Fonts\pkmnrs.ttf	Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133297841275567432"	chrome.exe

Modifies registry class 40 IoCs

Processes:

mGBA-0.10.2-win64-installer.tmpsvchost.exeGame.exesvchost.exeGame.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\shell\open\command	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\ = "Game Boy Color ROM"	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\shell\open	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\DefaultIcon	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\shell	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\shell\open\command\ = "\"C:\\Program Files\\mGBA\\mGBA.exe\" \"%1\""	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\DefaultIcon	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2548970870-3691742953-3895070203-1000\{F13A066C-3BCE-43A2-B3AD-E456C91DAC69}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Game.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2548970870-3691742953-3895070203-1000\{6731EBE5-D0B2-45D0-8C87-1A3D9F2E27FE}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\shell	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\DefaultIcon\ = "C:\\Program Files\\mGBA\\mGBA.exe,0"	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\shell	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\shell\open	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\ = "Super Game Boy ROM"	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\shell\open\command\ = "\"C:\\Program Files\\mGBA\\mGBA.exe\" \"%1\""	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\DefaultIcon	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\ = "Game Boy Advance ROM"	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\ = "Game Boy ROM"	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\DefaultIcon	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\DefaultIcon\ = "C:\\Program Files\\mGBA\\mGBA.exe,0"	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\DefaultIcon\ = "C:\\Program Files\\mGBA\\mGBA.exe,0"	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\shell\open\command\ = "\"C:\\Program Files\\mGBA\\mGBA.exe\" \"%1\""	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\shell\open	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\shell\open\command	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\shell\open\command	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc\shell\open	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba	mGBA-0.10.2-win64-installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\DefaultIcon\ = "C:\\Program Files\\mGBA\\mGBA.exe,0"	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb\shell	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gba\shell\open\command	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\shell\open\command\ = "\"C:\\Program Files\\mGBA\\mGBA.exe\" \"%1\""	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gbc	mGBA-0.10.2-win64-installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sgb	mGBA-0.10.2-win64-installer.tmp

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

mGBA.exe

pid process

4396 mGBA.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mGBA-0.10.2-win64-installer.tmpchrome.exechrome.exe

pid process

1168 mGBA-0.10.2-win64-installer.tmp
1168 mGBA-0.10.2-win64-installer.tmp
1004 chrome.exe
1004 chrome.exe
2520 chrome.exe
2520 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

mGBA.exeGame.exeGame.exe

pid process

4396 mGBA.exe
4192 Game.exe
380 Game.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe
1004 chrome.exe

pid	process
4396	mGBA.exe

pid	process
4396	mGBA.exe
4192	Game.exe
380	Game.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AUDIODG.EXEchrome.exe

description	pid	process
Token: 33	3068	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3068	AUDIODG.EXE
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

mGBA-0.10.2-win64-installer.tmpchrome.exe

pid	process
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1168	mGBA-0.10.2-win64-installer.tmp
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

mGBA.exeOpenWith.exeOpenWith.exeGame.exeGame.exe

pid process

4396 mGBA.exe
4396 mGBA.exe
4396 mGBA.exe
2108 OpenWith.exe
3460 OpenWith.exe
4192 Game.exe
380 Game.exe

pid	process
4396	mGBA.exe
4396	mGBA.exe
4396	mGBA.exe
2108	OpenWith.exe
3460	OpenWith.exe
4192	Game.exe
380	Game.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mGBA-0.10.2-win64-installer.exechrome.exe

description	pid	process	target process
PID 4780 wrote to memory of 1168	4780	mGBA-0.10.2-win64-installer.exe	mGBA-0.10.2-win64-installer.tmp
PID 4780 wrote to memory of 1168	4780	mGBA-0.10.2-win64-installer.exe	mGBA-0.10.2-win64-installer.tmp
PID 4780 wrote to memory of 1168	4780	mGBA-0.10.2-win64-installer.exe	mGBA-0.10.2-win64-installer.tmp
PID 1004 wrote to memory of 1644	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1644	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 364	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 2548	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 2548	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1108	1004	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\mGBA-0.10.2-win64-installer.exe
"C:\Users\Admin\AppData\Local\Temp\mGBA-0.10.2-win64-installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Users\Admin\AppData\Local\Temp\is-H5G80.tmp\mGBA-0.10.2-win64-installer.tmp
"C:\Users\Admin\AppData\Local\Temp\is-H5G80.tmp\mGBA-0.10.2-win64-installer.tmp" /SL5="$90030,15026443,876032,C:\Users\Admin\AppData\Local\Temp\mGBA-0.10.2-win64-installer.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1168

C:\Program Files\mGBA\mGBA.exe
"C:\Program Files\mGBA\mGBA.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x32c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae929758,0x7fffae929768,0x7fffae929778
2⤵
PID:1644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:2
2⤵
PID:364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:2548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1380 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:1108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3276 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:1488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4660 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4796 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4416 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:3836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x21c,0x244,0x7ff635ed7688,0x7ff635ed7698,0x7ff635ed76a8
3⤵
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:1696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5232 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:4448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3224 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3248 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5532 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:3696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3396 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:1
2⤵
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6272 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1844,i,7619493657393494317,9315556309044576116,131072 /prefetch:8
2⤵
PID:2560

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Pokémon Iberia V2.03\" -spe -an -ai#7zMap2509:102:7zEvent5717
1⤵
PID:2192

C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe
"C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe
Game
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\mGBA\mGBA.exe
Filesize
40.8MB

MD5
13e00df982bc412ad7b6c27edc417e58

SHA1
f80142741f533f4cd9a1987f137611cc1282d3a2

SHA256
94484216159683d03d2dc696f0ecc60c8eda462cba4ca6f44d1e3ca6a0405151

SHA512
8011d8a395e7fafa8dcaa170d13b4a505430efa56e779722c37a70dee8b0936cddfc883a4f916d04eab5ad3a3ad25c25bd13e8757da30dad9a580ae08b6e0eb3

Download Submit
C:\Program Files\mGBA\mGBA.exe
Filesize
40.8MB

MD5
13e00df982bc412ad7b6c27edc417e58

SHA1
f80142741f533f4cd9a1987f137611cc1282d3a2

SHA256
94484216159683d03d2dc696f0ecc60c8eda462cba4ca6f44d1e3ca6a0405151

SHA512
8011d8a395e7fafa8dcaa170d13b4a505430efa56e779722c37a70dee8b0936cddfc883a4f916d04eab5ad3a3ad25c25bd13e8757da30dad9a580ae08b6e0eb3

Download Submit
C:\Program Files\mGBA\mGBA.exe
Filesize
40.8MB

MD5
13e00df982bc412ad7b6c27edc417e58

SHA1
f80142741f533f4cd9a1987f137611cc1282d3a2

SHA256
94484216159683d03d2dc696f0ecc60c8eda462cba4ca6f44d1e3ca6a0405151

SHA512
8011d8a395e7fafa8dcaa170d13b4a505430efa56e779722c37a70dee8b0936cddfc883a4f916d04eab5ad3a3ad25c25bd13e8757da30dad9a580ae08b6e0eb3

Download Submit
C:\Program Files\mGBA\nointro.dat
Filesize
1.9MB

MD5
6e2845be175763739a9122a8e5b6330b

SHA1
5e4b5cc17914ef1fb686468abf3234c471758fc8

SHA256
0534ba4c13ce813a9fd0d62bbaa1c34910c53981d4a26d3047dba7a83ad2c57c

SHA512
8220dd26428e801bb75dc83215d42319b696d88b5737892a1f4eb401142e47b812b2734df94c118fc4f01369581d3aed6215be8274dbc9c4393021b51262f3c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Filesize
62KB

MD5
68e29003d09ec9fb9409d19cdd1aeeb1

SHA1
78cf38ff43be8bef23d8beb4df952180554347e5

SHA256
6ad1b6590af1ffe600add0d0f9fe5cd7053004738ae7ea486e82e46179f31a3f

SHA512
1454191d0db2a07a51669e6fe38a8f119063b012ceb7dc6c75a0c35e13b0d1cea3bf75b42a8a7a81975ca0b373b8eef8c18a9d27afb25bc16f0017bd4fd4b8f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Filesize
20KB

MD5
39307e27138b106e53f1a4af27d63094

SHA1
9c2fbfb3f19bf72a282a101d1c802c287dbb5fab

SHA256
07c09b206faa8934e6b12c518a4f834d8bd5b2bbe92a07a4f169173ab620b464

SHA512
8e48c468cceab8dfb296c62c2fcf4e82adde92fc06e3b14418a4cc08dea5712aaa7f61eb5421b9d5fbc0803b1b8f2b05a344a2e3db7831212af9e2579972bc52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Filesize
117KB

MD5
952bbbe85b0ee7b7244ca4735b02eca1

SHA1
5fb017b07703c03f5e1f935fb5dff87d4606f19a

SHA256
34f0c51c70fbf08539f5bbc21fffc19d5d97d6d057c66a6c7e7ed1ce42ab5a69

SHA512
7496c9bb5b1f130044dffea5129b502d943c7786f48ace8381a904c1a6dc88dfa83810c353ce8bebd8c76a4853e8879697f1e935b2f0dd78cd1c460a0ad86094

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Filesize
72KB

MD5
dac8a37eeaabdd231aca2bdaccc6a71c

SHA1
219a9291ba889821fe114b40c3168bdf655bb383

SHA256
eed1820bb9ac55153c70359a2e2bc4bff1e1d725dcfdabb70c756bfe8e2fbdff

SHA512
97b40e0df291ff69aab0c6c8b62a6dbf059b211a79b2fba7e144bd8b45efae6a9a50bbb0c477302caab3bebbd02a318766b6588bc9c696950cc13d8ce5f4c0e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
f2cf6305909bd060efac86a9b2c34e66

SHA1
a490219a14f233ab1f48de06f0007d7bbecb40ff

SHA256
706478db48a6b9a65605e38f52be99825a251af927149bc8c38484c6336328b9

SHA512
f2e489507eb0830decc885aa191475f5b449015f4fc9dc41ee71685212c78e949ee07d58ca8a7daee5bdea38efd2a63248c391bae24bf458d311faf906d17610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Filesize
264KB

MD5
1863ee739a87d63ff4625e4c8e966341

SHA1
b248b63f648f72a77e1581c936d19d1b5dcf0f6b

SHA256
97f4767ea5990a757969013c605d1ed258734028636ffe2a942ee05587d85566

SHA512
22881f9184f1c69e0dd4760dd060b3f566c9e56d9900b3b007b8012ed74debb1fdbc8e310d93543746e1eb1d96d35d36bca26ed8ae56d2c5abf36896baf99336

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\00\00000000
Filesize
1.9MB

MD5
f8a7e181cab4f9821346d2fcbbea53ad

SHA1
cc87d084d8c9124178ad816f9e5aab532eecef6a

SHA256
ca41c5a45e95bf4989d856532d5d6c674667f8336ddd2692260e22678307e1f4

SHA512
8c16b71f7338901c57244816cb40b887e45a6d0ccf4d69e9978c17835689eecb03bef2f5e45e351f6ec432fa0ad9170d31ca123bc814c7a15413fff62e2bb25d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Filesize
13KB

MD5
a5cf36bcf1300f89aa8a49169e5f12a2

SHA1
477f0ee854216567607c85b9aedf3e32dc6844e2

SHA256
3ca6d309ba9412127ae0576d064d4e9d39d2dd94a1ae91139e7d38cc60309f01

SHA512
1f04de647eb6b25b90d4b155e6d8a6fa6db7e149455a9ee3b85d546d60f3225cc79291f2ed17d880010605bc90fa051b613b806e42cdd8e951b58e017589f67a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
a8279fe3e6cc09521c739de62ebdf5e9

SHA1
b2a043117910a0a938de955cdc619e15ee5dfb3c

SHA256
4235d916652353ce98e327b6b1b07df99596424720037a435fae429360b24276

SHA512
fd710dce01ba3b6db010ddc4d7de3eebbdcad944cccbaea6c3189658d95ae07dd4a0c91a12c8fda52356a5a4e9541bc8eba964d377928b2faca69e66b92e478b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
5ced5d0856d725761411866d470f866b

SHA1
3a3343fb84b5f002d7b9cb5b3448dd3fc5dc04b5

SHA256
2898677aa865b8d755272723bf3a69ae3a96443614496bbc37c66a16ab4a3ab2

SHA512
2e59b913b505c40e7393924ad06b8e5007ede8ad235cefd9a6da9eaa2fc2cda9f169919b2bd18cb8b04bcd7a9d7b751041ddcd3f80ffe650d6be1077d0405809

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
fad0a5549e949c6ce958fd7cda0d0a4f

SHA1
3fb297d37adec1a74fc0d41ed4e61484835434a2

SHA256
3f579b5c8eb321a60d5e8877281b7d78e738d60bd0514ff7a108cb7cf33f0469

SHA512
4357ec699ee5f5370d071c0f6cbda9046ae19d12a0969b54b0630423af0e3cdeffc0be61308ec5a3b4f89c30fea2d6978ae0c28c1601f99e2be3f29778667ce0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
376B

MD5
1b3eb53a515a6034574978918718c0b8

SHA1
c9738c5699437961b6dc85728ed38358b50f9315

SHA256
762935de16ab0f8f71968f321c85e04554f4aa80859e473bf78b8a29f7211f15

SHA512
2b8feeffe82dea5e04e10de016f42575f51b86c840dd8f8a479a5f82bf2d14161a625cdd2f79894d61aa6fee3dbfd2fac7d8113cce2f13053cc991753c114355

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
b0c660d5e2d5c889e526967beb5719c8

SHA1
79291349ac1ad79fdd3d59845983634ac5e8ec5e

SHA256
aed90feaed07a9b2c5a97724e572cfd6ad0d62b3459666c0b068b1744420db41

SHA512
b2dc874f2597d8b165a885c7930e3ead9b628ca5ab26a360a9b4bff77ac9d5ce00396dd17bf58338209db7740faaa083143c51d9eeca326bd2850bb3c0fc47be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
c966eec4205e01f219c2ada529a527dc

SHA1
9cac70b469eee42033b56ef7050afddd08917ce4

SHA256
722970e5232962b6e5ae601362e26b890657f8a4ffedd847bdb1a56c332e43cc

SHA512
df5e68ffe51d483c23cf744893fa84a308a12d5a7e81f4455350e025f81209301e62f002c8dd3de99b58b8b8bd73fa6f9fc613398aa6cb4339e549048060773b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
afad4baff4da197631d6f2744edc19fd

SHA1
5b902d4020e7bf3a2128d02c5a025994a8970a9e

SHA256
08bc654a11ebac6580201dd2168a1d00da76a1db9ac1aac99d95479fb38c98eb

SHA512
4ea848ed22035962a7abca37c68ce7a304fdccdf21d6538754f97a59010ca535588e8fe0d653463d0c811659f68d36d39650defbf45781f36f1e7ca340ce565d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
1edaae5f022ec4baa0246cba2833e556

SHA1
a37df32f11a6e03b1c121b8ad1de7ed7735e74ef

SHA256
eb979d87f0edef4e47199f44104c99ff42d046e36c2cda106c8f8fda1d90d701

SHA512
5a00aa458abce794baa244ff9457514918b5b6c822300565c8fa254bf05e4905107e7606f88d26c99c6660df78c1e221597ff27a925e1f420be0a9b08637cd76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
6fa4f238c276562b1a78dd8903fa2eca

SHA1
ca572fbfd19182615f1947f0009673bc0cc71a62

SHA256
83d5f38e735594d4b99da92008e41c452f43f2de4c7fde1b11e379e567230e05

SHA512
19e5fe48c7390937d8a35891935eb3750cb5d903f08bc26a8e6cc6a08c995bb02ad23ef59f65ad1f5564cf34995ef397f5f3c22f1fd0d179ab67a0a049e3cf82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
f43d00b824985412d1b2eb3dd1a99704

SHA1
8c11e8430e4b951bd631a9aaaf0e88540e3a3796

SHA256
fadcd04c2590002ddefbcdae8afbbceecfe1161d40dbb5973e172c6f96166466

SHA512
13c355f660a58644dc8a21b18ee19f8c1b83548ce844fba3f14c019b9d18e3fcf95394377ae4a17f092f6fd2c684396e68c637a575c1485c6f9e79d6fce7897d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
7fd26b9d2412aa43ced934a66587bc09

SHA1
ae6fa4af7c785472ab9335ff565bf4cdc3b08b4c

SHA256
2ea3b4127ea6d59c18e91a851a26532fca801940fd2e1cd2f3d4a4706658fe46

SHA512
857009c79f059d1ec0771aa7dcfdcaed74d3f4885b69a6cbdb7bf0f02ee2f82c37aa6dbd66268d432b57dbe362becca7916e152207ec9d0b7107d619220b224e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
376B

MD5
c478385faeaafb60b0936ad963fece7f

SHA1
9517dae332c9862cc5269278a744e36ab2f5c237

SHA256
0b171df64f3bb79048d51c7131354a94e2f09babc839069d04c2ae231cfb9024

SHA512
2742fcfbb928513f6b4f2ccabcc5ae9e7cba03545f2864c8ecfa4b2c0cf58ade0f9bbad48fe766360bcc138ff61e0e4bd1162921d3b467083d5f387b8cf56652

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
376B

MD5
34412785255c16dd0cad8d292aa2154d

SHA1
2c56c2ea32b1c7626dcc12c230d8991a01a4d1d5

SHA256
6129ea73542ec09dc5efc1d83d08a7a32b241ffe2e1da8c41b11fe9e03259d7e

SHA512
c4e3e3a816010d340e5c088644ae19c804ba309f36d23689c790c6f3b6e1a6a6d2e1909fafc029d3c24affa3547ff799ff712e7646e03d9e26eb02cf8907b7ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
d9acd8cb7738df4fbe977b78697236fa

SHA1
de1fee12523b1012baa5c8a81108ca5f53310ef5

SHA256
bbfdb802a5f9d4a9041281590ca7349fa049ab20c6d5b4b0a1ed5a60f18a83d8

SHA512
b503a9ab4f6f1b6e9e1d7f25e3c264c1ff63541fde04f9ed7e6cc621657c41dfb89a0a973c35654938b9fb2ac75adc069614beb2af1ab2d09fb79c81c2b87a0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
42f6f5723e0fa4b430ac18e668255cdf

SHA1
5c4dd5461a902414153473ccb621f657fd0c9026

SHA256
0a682cc537fcd36052d40215dfd1ab623be8ea13c95272cf6a7dac075d0b1c2c

SHA512
93e2bafdfa9b051bea61778a26f8cc356c9ddbfb271311e42c29593205b3c59f90f11d2f3f2fe4ee6458b0e6f58a19e4a1c6b61919f5daaac994a54a5a7cd6aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
032795fce9ca35ea9191b32e8690f9ca

SHA1
e86d4bc8c8a617223818a2084a54d91570f8a93b

SHA256
d30e61c3b0c9683dcc3ad6222123f5246aa69ed582c047cdeb36a62e1e02957c

SHA512
17c80a7af4d4ce8ac6a858fc42ad9caa5eaa150e256fbe931a0cd735258948751aea1b421f69d5c84d776d1835ab8b18ded7f420a5e9980a6046c975a8dd7fd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
6f0110e71245d68954c446639332fb2d

SHA1
c44d0fb6db5ec0676b537952a5f5f690b958576d

SHA256
8163a63081f956881c58725a73ba255e9adc27f4c1e929a8fcf29112d0c144f1

SHA512
0d394c67258b851f7afb16aff561f4833cd4be186c2178c81652e865fffda218aee0ebf08acde29605223dcf7fea43517b1e4998c00d1a1ae7a467fe2ba304ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
376B

MD5
b3647f64aa66a0c87fe1d27bc709e174

SHA1
4feeb7f4f5d3917a92364d3270d9a48e85724861

SHA256
0acc2d375cc757c6a64eec82221efd240613ca58d182238b497fdcbb7a68825f

SHA512
ca46a9cb3a49be1556f827cdbc5d71d76d87292adb3f1faae83955008f347b858145a13534693f4f07d89c4bd224b39c22f1feead47b724e1ecafd5ef195bb22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
3bf2985945bb98fc798777c910b8365b

SHA1
953523829d5101c1ce3a9658498de3386a495438

SHA256
79541cea84b14d4025acd7fbad57af578375c470fc0fe393860f1522290be599

SHA512
5afea1b7250dd4d1800e57faa16bfbb7c4e1c3c701c5500ce72eb13ab72e53431bdf65955a7947f0bd3df3a617c840bcc99cbf5b46803b387f06054cfb1a6db3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
72af064c066fa16b94002c9b780bd084

SHA1
1728d4b27e89d51a28101091092405eb1d4eaa42

SHA256
93d0c42e057ab5a9c36c5076aa9038b7ea2fc063837ad569bd7c4502b2eeee2d

SHA512
33db6a6daacdf1369f9c64baeefa6fba021dac2d2171fa9de14c8a3725f12f0323be55044693108cf33fc8b0b24742ac218c1bfa91843a4a114a7a2c312ed9de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Filesize
373B

MD5
11b02277d81c142624ecb203407b2373

SHA1
8cc3aacf38ad7e543c07292700761ab242a78d34

SHA256
fee3b82adb97b8b8ef5b12bfd0ff32c00e93cc66a7ad29cd4ef2c43149ee29da

SHA512
cf3e5fc313dbb37496d732319e6789864ab6bc3e54f5ee735c152dd3ab54d3b885f54666e2b285b773ed10062f251dff7d53819dd67c427df555ccac5a54ecb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe57d6b9.TMP
Filesize
335B

MD5
fbee0db81dcaa408ef65d52a38c893d5

SHA1
e5e027a0db9a501d02d6ea4e3d5dd49e86399880

SHA256
6609e2e172f027c0446199fec8a2eece9e2764ce9a5def25f5235ec6f5d81f53

SHA512
f698e1890449fd9a4c72b16c7e5a0527740472bac03e4a1ff3c069bab281599e46a1c3b391ff328233176e409a7a29326873a18c286643a82f13200c882467ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
20dfe34a82ec5746eec8e70b4b33d674

SHA1
5de0ac728709d1b062e994d4e5c5b4d887825486

SHA256
8fea15ddffa849ec6298c5896d606fd0e55f0dde225616fcf61d86546475db9f

SHA512
908c5819f86ddce3ec4ccbcdced35b5b2ac4ff83f18c59e3ba1f3f19db2fdd2fef8ab6e3f0860e96ee82ad04609c9382e98f06d7f6e98d30d9e84822f4704b2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e5c1c04a70b94ea2a03b591bfa60da92

SHA1
b8de1c6b1a6c73a61fe8a821ffcb6e3a9795f457

SHA256
e74aa5b0bf76015cb09f4dc915c2582ef1a6b3b8b631ad52deccc330b3783561

SHA512
98832d25338e13fc0f4dc7511c2f1c8c58f2b59e742aa5c0446495a58967975edeb4b8f56dc55c4e98bc27b316e75a64376b614f6bf5acdcb051f0b296995f8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
90fa2127fdb2dcb954472f77a249b18b

SHA1
2f2d620de5064df3f9c72ee6d4603b67aa9caeb7

SHA256
138769af49c7b72e791de1d22b20b9b709e3914051f1c4e0b58020d4c4596197

SHA512
057f5c37ab4e0c3f5e91383df9222e303c7de47f473199d9dcdb6d405d4558abd0ed58bdd66194921464596f76b567173a6ae254140d2b10bed5efcf47a909ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
c21e1b74e3fce83b83226d570e196bbf

SHA1
20c0d1f98fe0a663a7441422be53ddd823a87ce2

SHA256
37c4ad2def42e3ef2081f35ec6e381b6502628acbd10e555df804c9e1cb58737

SHA512
478505bb79d982ea79543a7c574e05962f2005222d9c881a54e0f78ae046968594d4677aeee39673713fbe32f28159d54efe1c44221d35cec05368503c5dd4f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
e6831767111634543396f0a2a58d02f5

SHA1
77c0cbb895bbf03548d9339ce5019ebd87467351

SHA256
b91bc68b53fca0f9b7ba976c23fca03054aee0e05c9d0d78d017a7484aad347c

SHA512
ef99f7d3230dc848a986f7defcd88a6ae855d5c7c57ecd76f18dd0a16e7692b20aef9ff79a5ca66f574049436c54c5ecf4d8657072b47e5165d3c9a0535c5bb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
1bf88ad95573a9968a4ecb1df4681e0e

SHA1
21d3641b25e603515bc81e795799a85507598a0e

SHA256
f1a92afe9d1a2b7b0b0bc26072611978533ce509dbb90ee025d6f1095c9bc039

SHA512
a5c5f1741b355059397a39cdeaf11c9c2601827adcfe14e002016bdf5ab121d2a522c795e8d561f4b55a0644913153700a5245d6c1757cccf68945da026cdcb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
6a7b114f41c4921a073267ea12160db3

SHA1
3b90f6210feb7378df79d92e9ee0cffb1c110a0a

SHA256
83b037ec019d3b94f5b80a1ad7c8562af1fb8f799d7d686e1c872b4e912a51a2

SHA512
a4b521efaa9384b967be60120d277b84cf5a5555d5d51d65ab9aaa7ff1b77721ac36058221743ee15420ab8e945bc3f2b9ee8a257f2f322a71024e14131b2e22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
6b8e74f7808c64273959419d768ed687

SHA1
a1276fb92b0e65dcd634829b0d7dfdef90281c1f

SHA256
7669c8c9426cd496aa1ac2eb8d5efe2fbeec46da176014c5d332302fb96f3693

SHA512
4ff9a78b911008bdf18a38cede1b6ae8bace25b2b543240fc802739708ca9881f5b8b1af952a3f2ca3d1bd7efa963bd4f3e5f7c6028d3b551499eeec6bebc3be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f627.TMP
Filesize
48B

MD5
2ca083c902a17f79553236e81fc17347

SHA1
ad070ba592ab724a910c3e8b019f0ab28ae73f58

SHA256
db4a0b75f978dd11ff68855cafbc4d8e94a3cd281c61869438ec26a6bbb27491

SHA512
bc080e418cc2725855f80f2753c74422d86224329c39b0fe9a38060d429358b941a2793317ae18027ec9ed142397439528bf0c58f52087113b2640484b32a0d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
154KB

MD5
d36c4961797e1e96025dd5459b00a3cb

SHA1
5bf5035635be2accdcbbae8da6b4cf7ade627ac6

SHA256
49da7bc9bb154edcd0105a6809e2e5e65d1204eaa729cef4d9a326b6dbef5c4d

SHA512
4f19f2b31e79055545b3014282ea9b1af87ba1d5b3f6408944cd8164275bcf78ab1c4c8db167e4b4eb7ca66580ea86ce9f806c1e70bb41b129529f93fcbc402d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
154KB

MD5
5001ecc07887cd6037950c4bac76321d

SHA1
b36e2828e62f604fa86eea580e1750232fccfbb1

SHA256
f0bf9e1a4c5a5d75f1fd99efd8a373631e17a859eab111033e1bab3688157ebb

SHA512
49ebbff121136eae05cf90f72eb64900d7e40f21b6ed02df934c351c94fc1e4e6862b3b5492e186d07251418c7924f09bf46c2ee32aae1c7bba8148da07621b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
154KB

MD5
df9592463327e9cf9e4aab86871b470f

SHA1
09a113760e3a595ed31d2d08761a6ac7975de5a4

SHA256
9deca151291c661a6ff2e93f98ab8d01538a9580b159a82f4c2a0ecd4789101a

SHA512
adbe8e983a2ad1495629603d063521dd7284179894ad3219058b7c481b0934fcc1cafadb59dd7d35396c7b12c179da90327eb9aa56512d8ae8628809d29d842c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H5G80.tmp\mGBA-0.10.2-win64-installer.tmp
Filesize
3.1MB

MD5
7e0f22cff7a0cf15d734aad2c28c4f8b

SHA1
2ed8f9754145f6331160fdcd699b6a7adbcb3624

SHA256
346b1872d7fd3e10693932685012cd8674f5c78574099d55964cf3596baa51d9

SHA512
fcf3276223fd14ae13c74c218278cedd465f81ee060e59c787e50fa30f03ef18bbc35cb47ff415d7d4c455924faf3c512554254c09aedda6bc547532e821b4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H5G80.tmp\mGBA-0.10.2-win64-installer.tmp
Filesize
3.1MB

MD5
7e0f22cff7a0cf15d734aad2c28c4f8b

SHA1
2ed8f9754145f6331160fdcd699b6a7adbcb3624

SHA256
346b1872d7fd3e10693932685012cd8674f5c78574099d55964cf3596baa51d9

SHA512
fcf3276223fd14ae13c74c218278cedd465f81ee060e59c787e50fa30f03ef18bbc35cb47ff415d7d4c455924faf3c512554254c09aedda6bc547532e821b4db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03.rar
Filesize
423.8MB

MD5
c2d74e89a9d3665fa77d6935f0b640a0

SHA1
66a427de007e17bf5b69b10b8b508c229c4588bd

SHA256
efc270464f05283dc3df69d30990fb2d3d6016c1fe891729272d81e654134f03

SHA512
f45d8ab6f6c221d027325f3c6114589488d0606c0d6cfad2eb63a5420eb576db68e4d4254292fb3cb42aded63db451418733a90321f48dfcb7bf71b3d4de3d76

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\BGM\Titulo.mp3
Filesize
1.2MB

MD5
2f4772e1a5e97444ba5facc84c9252ee

SHA1
59b0273c56d4968972cefa1a27780b5576d2fa2d

SHA256
c153c6e41de771a6de324aa3c87f9f64a1dd7dd93acbce65c84a75c6eef3dc74

SHA512
84b14e27cef5f62358c62a0cb5c5e47f77f848b7e8cf9c4baf80e559f89bd3b033beab82a0d5792a2e52284a30a767c6f31e7cf2998695d9c92fd0f9cda7a28e

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\244Cry.wav
Filesize
9KB

MD5
57da202cbb6558c0b22c31ffb0118670

SHA1
2ced56c1d5e052a96d7c1f7eb2faeb9372b72bf1

SHA256
7cf74f78b3b5ce250c998242bebb8156c651d5bdd30cdcdd915c7984976c9b4e

SHA512
eac2aa9863875a7601097241da9ec5ba9224e45aeb0e9613997ac0d84f5df6c6ba8a76bc9e731a2255f55bb24e81e6afc61756747caa3c758e3d8547a0d90ec6

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\915Cry.wav
Filesize
22KB

MD5
2f8e50489ec4aaf4f0e2a6a8900a345d

SHA1
0c103135a98ba6be3ea063ef71f7cabb35e6f337

SHA256
2ec096b214d0b69c57d7ac9e4f6f8a2000d8660599918a5bd50ed6f184b252bc

SHA512
5ca90de9db261dd12402bfd9bb705ce7e286559a3164ac24891e13d8c72da3a67d7ea7f533f2afcc657a02cfafac246953c59a0824d4d8e4d37a6814a9c21f6e

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\Battle Open.mp3
Filesize
7KB

MD5
c2ac944a9281cd202eec7bc6c042ad7d

SHA1
a9b4f4f77de026a47150648109bfc0bcf23bf4f9

SHA256
f0106daf847e3ee7cf0c87f0d6bb7d3664e762b6d7fa03aae2c74ebe600c5875

SHA512
2249a18c11bbc225083a87c8aa1a76c49dc32949ae26d73f713b767afe933866d9f8ac59466170c65586e1f3409cf35fc193d5001cffba7e8f6cdd042ff2c6f8

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\Choose.mp3
Filesize
4KB

MD5
ec355043dba420da0d8c3a8dc2fbc9cd

SHA1
5054c7af2ed272035b60aea7be2719edb838961a

SHA256
9399d3e288aa110120afa62a05446b9e22b91b826ff1539a9130628b67cf4b8c

SHA512
083e48b67482ac54d8fc511882386459c0840b5954485fc4b4f9c007f96e34173ca0cafb3bb796da40edf465f35bf434c6f6d98fdeeb9e909c71d494ddc67d66

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\Mining tool change.ogg
Filesize
7KB

MD5
56a1e0804afa6c4177e50857bfdcdacf

SHA1
437c69d5b6f0a8ac3c84da0a9bd57ac0882cb0b9

SHA256
8c23123360ed67d330fdd2f1b7f7fc7c8d59f68583b1b9e047ee769eda8c98a4

SHA512
1744d690b79a0068b1d49974eb8fda3f020a57b523d554d86c0c1e0afccd375c70e6dbbd9fcdae14306737153bcbffc35715c8fe50f6187aebe740a56f27126c

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\MiningPing.mp3
Filesize
26KB

MD5
81ff158d747065669312732fdbc92008

SHA1
670d15b10acdadbc829e8ff021010676596668cd

SHA256
e800ca3d8436cc09b03b06e81574bf2dd5292c90261db5672b2e1ee8f1f408cf

SHA512
4cb7178439c274d917e39f0705d066ab3b6304fdc380c45b9cc51afdc94be4d5bf0f29a83bdf4cced081a405acc5cba0b4881d6d04a8012078cad7a222ecb130

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\Vs flash.ogg
Filesize
11KB

MD5
ef2ddc2b6e29072cc98f191f091c8b12

SHA1
c4c67f8b967b73812ade0b7427cdf11db57b9ff6

SHA256
4e102023e68acc033634583bb12fc9136ed644e3f703d51f63b850ceed40a974

SHA512
32b50a9aa55ccdfd364d789617eadf1d219dbe09452a7099fa8725bf2c8b52d9f2a84aad5e6491c27b1d1b1466d6784cd6262e64ed586abe0e1601e11dbf0953

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Audio\SE\Vs sword.ogg
Filesize
11KB

MD5
a8c2e50aaf1293411b30c01d5fe538aa

SHA1
0459de59a2e719d4111d82f8950719bcd5918bcc

SHA256
4dc1ab67600ad4d1cdf1f1ddec217379fa5e5251a6367c5a2183125a2aae210b

SHA512
43c4d970744783f7594c2380ad85b521ce028ebca63ea35f1baf6db0dc11baa6a3b88fa4557f7c60ece26c7367c1a0f6a7af30295ce3a9741b959c7b3478b3ef

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmndp.ttf
Filesize
54KB

MD5
d0cffc3163af00b88abcc17e81b7da86

SHA1
5f402d2a8a226d3fc8ce5dd9a2cf6f18189d284e

SHA256
49e228d7081b4ee8b6ad51047edd5dc3d3c7add4e3927e7fe5a299da2abf6918

SHA512
8726a12729b031b6ae55d113c7f813527db57bff5f322230bb566216bd54042716bc016b7180f80658af2b8ecdac46cb1de0f41ef3fc02c8d587063a94cebe01

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmnem.ttf
Filesize
19KB

MD5
10683dd0144b8d455f940164193a5b89

SHA1
86168ce5695486a62eabeff2c08723520462842b

SHA256
310e8fd0e5e903173c0c0e4b79da242e2653d238a87c283ff04b902d458dd726

SHA512
915a917890c589bfb25522e08301dad1e271f79c82c185ccc88516a232bb1f567ecfe8ea16f662812a9d5f4da77bd3cadfe0cd6414068f4926bda8b7bc27b8e2

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmnemn.ttf
Filesize
18KB

MD5
7cde3171d4d71a93d48a10b2edb1c078

SHA1
f47b7faeab4788ce17628a8a3adfbf9401cf1bbf

SHA256
f78fd4811cffd4e97c2815cafa6bc4b9b07d821b12629bc090bb895da54a452e

SHA512
c32f1c8b252e0d327c41e9f2f7e5ec19652f5464eb517f526beeac947560073d39395fd2030e02fbf575010397e39be72c4884e43615b4c22ba7737a62483075

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmnems.ttf
Filesize
17KB

MD5
e8f7ab4ddaa4c305d5df56c59e92e386

SHA1
3bf903d2643b77e16144a48c99be97f7f87493ba

SHA256
07d47be463f38c6036983aab8d8b6773a88c37a50d29b3223c6c9188edc442f5

SHA512
6aaee76b302057302ce9a258007600f9f75d3ecce2c7f1e582d38664f7f996e0cf3024fb6c43ffa5f820a8b8d30fed799864e7daa34dd8c7cea5dd547eb73545

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmnfl.ttf
Filesize
19KB

MD5
d2d7f825fea4d40846937cb63f309e02

SHA1
4c07b9a3405fcbf8a5e5c01fbdaade26c085810d

SHA256
18d3f20b4100d9727ca866641781b5b591da4ea4546d88cc33edb879de91c55c

SHA512
5a2342973b302109f91d3312a24dbadfb1cf9379c006c83553e0d5e53367ba02d35a61cd5e6ea9ad633ae6cbd107c8f97b0cdfab018fbb6bdfdeeeb447bda7f4

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Fonts\pkmnrs.ttf
Filesize
19KB

MD5
bcc029df2a9495c0b5195af4d6bec64a

SHA1
0b93ce028bb842878c80ab51c44cba527bfb58c7

SHA256
819e713c52cc5aa43893e15c8cc2452ca1a14fe100e9b9dfc7fea82f2e1c1e41

SHA512
f494cc97767652a7607296cf3c9dba0f8a4ace504a287fae09d5637da7e1fe7ad97df68ecafead8e03f417ca433726ae3cfcdefaf007b02cce1c22698727a297

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe
Filesize
68KB

MD5
c22b8d8acb738776d94ea0cc10277144

SHA1
4dcc713487826be8c67f614d0f90b0ab59d2215c

SHA256
0ed9b5139edb0ad0f0f4b5b88dd0265ddbf56d36d6f173d6a22f3b23e8212e22

SHA512
9d6c734e6fb6edc4d7944345293332c2b9637c67e9abba359553710189d007051e5f0084aa919e70a9d2fa0c328e92c8c06d398074c7d64a255b9227fe4468e2

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe
Filesize
68KB

MD5
c22b8d8acb738776d94ea0cc10277144

SHA1
4dcc713487826be8c67f614d0f90b0ab59d2215c

SHA256
0ed9b5139edb0ad0f0f4b5b88dd0265ddbf56d36d6f173d6a22f3b23e8212e22

SHA512
9d6c734e6fb6edc4d7944345293332c2b9637c67e9abba359553710189d007051e5f0084aa919e70a9d2fa0c328e92c8c06d398074c7d64a255b9227fe4468e2

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.exe
Filesize
68KB

MD5
c22b8d8acb738776d94ea0cc10277144

SHA1
4dcc713487826be8c67f614d0f90b0ab59d2215c

SHA256
0ed9b5139edb0ad0f0f4b5b88dd0265ddbf56d36d6f173d6a22f3b23e8212e22

SHA512
9d6c734e6fb6edc4d7944345293332c2b9637c67e9abba359553710189d007051e5f0084aa919e70a9d2fa0c328e92c8c06d398074c7d64a255b9227fe4468e2

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.ini
Filesize
168B

MD5
33653b2d3d907955e968afd20315c740

SHA1
72f7bb97df3a7b7227b345d4f96e315801997d27

SHA256
49638adb4587b22408a7060b1778718b052f97cb7c635fca7883a78fcfa2d799

SHA512
d56f4ea5090178d43d9bed7ca49e1f45dd8d90547a2bf4a6da3c4a24d4ef360379da3fc7111bc6b72d5963eedfbf2305b8df5b2164c3be5350610de6901c44e5

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\Game.rgssad
Filesize
108.0MB

MD5
7925345d76419caed45f419d6c199bcd

SHA1
8ab54faaed22cfb879995eb4a6fbfe99a784ff41

SHA256
bbff0b054a04a1aaa7b9f9528a465fe36692f624df9a517047a69396435381f9

SHA512
69c40f60ad8fb3caf8d54dded1568b0531db42a6b1ffed9289ebae0311c19a7c29578a3a297dd20e82c1ad3ff8c11d249fc72cd9f8023c36581dacd6e41be2ba

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll
Filesize
760KB

MD5
955c8369e771fcfb32cbf2c6c0315f61

SHA1
4fa905d0d5fcd48290f578aed8e1c0f0d6d442f7

SHA256
f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb

SHA512
1a208bdf1ae9aaed5e065121721eaa72d4d16c8b36dfbf482fb00a4bc1997233c955d59ace4bf2f1767a41d0559e4ce4c8e88244cfd8916b0082374a299dab7c

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll
Filesize
760KB

MD5
955c8369e771fcfb32cbf2c6c0315f61

SHA1
4fa905d0d5fcd48290f578aed8e1c0f0d6d442f7

SHA256
f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb

SHA512
1a208bdf1ae9aaed5e065121721eaa72d4d16c8b36dfbf482fb00a4bc1997233c955d59ace4bf2f1767a41d0559e4ce4c8e88244cfd8916b0082374a299dab7c

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\RGSS102J.dll
Filesize
760KB

MD5
955c8369e771fcfb32cbf2c6c0315f61

SHA1
4fa905d0d5fcd48290f578aed8e1c0f0d6d442f7

SHA256
f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb

SHA512
1a208bdf1ae9aaed5e065121721eaa72d4d16c8b36dfbf482fb00a4bc1997233c955d59ace4bf2f1767a41d0559e4ce4c8e88244cfd8916b0082374a299dab7c

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\gif.dll
Filesize
32KB

MD5
499d56154bb7bcdeb0b5e6ae8c58f5e4

SHA1
e551f103064cb901a11b335c9a3dc026251ac2a7

SHA256
c388f705424ac6efe60f9bba0d6f83f0d9a7f4d8e37513bb51587d3721f25221

SHA512
4c4a2ded60a7c481562515775e367587a29727a7722f6e6af74fd38f8632df87bfb8ce96929cde9ce7f5f1ae11e67f3a99af91e2e821465adb4432a4543a0133

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\gif.dll
Filesize
32KB

MD5
499d56154bb7bcdeb0b5e6ae8c58f5e4

SHA1
e551f103064cb901a11b335c9a3dc026251ac2a7

SHA256
c388f705424ac6efe60f9bba0d6f83f0d9a7f4d8e37513bb51587d3721f25221

SHA512
4c4a2ded60a7c481562515775e367587a29727a7722f6e6af74fd38f8632df87bfb8ce96929cde9ce7f5f1ae11e67f3a99af91e2e821465adb4432a4543a0133

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\gif.dll
Filesize
32KB

MD5
499d56154bb7bcdeb0b5e6ae8c58f5e4

SHA1
e551f103064cb901a11b335c9a3dc026251ac2a7

SHA256
c388f705424ac6efe60f9bba0d6f83f0d9a7f4d8e37513bb51587d3721f25221

SHA512
4c4a2ded60a7c481562515775e367587a29727a7722f6e6af74fd38f8632df87bfb8ce96929cde9ce7f5f1ae11e67f3a99af91e2e821465adb4432a4543a0133

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\gif.dll
Filesize
32KB

MD5
499d56154bb7bcdeb0b5e6ae8c58f5e4

SHA1
e551f103064cb901a11b335c9a3dc026251ac2a7

SHA256
c388f705424ac6efe60f9bba0d6f83f0d9a7f4d8e37513bb51587d3721f25221

SHA512
4c4a2ded60a7c481562515775e367587a29727a7722f6e6af74fd38f8632df87bfb8ce96929cde9ce7f5f1ae11e67f3a99af91e2e821465adb4432a4543a0133

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\gif.dll
Filesize
32KB

MD5
499d56154bb7bcdeb0b5e6ae8c58f5e4

SHA1
e551f103064cb901a11b335c9a3dc026251ac2a7

SHA256
c388f705424ac6efe60f9bba0d6f83f0d9a7f4d8e37513bb51587d3721f25221

SHA512
4c4a2ded60a7c481562515775e367587a29727a7722f6e6af74fd38f8632df87bfb8ce96929cde9ce7f5f1ae11e67f3a99af91e2e821465adb4432a4543a0133

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\rubyscreen.dll
Filesize
27KB

MD5
69ee5b4f2eec4f25171a8396f38b9ac2

SHA1
596281f5c47a6938c999dbaefd1ad9835b2baa5d

SHA256
777055e7400b49941cc083f86343c8bb5c8c067021b32435809e87e4bebe3807

SHA512
a91ae45228667b07eb323045f6185534dd8b7cee576d4c80c7cbb8a0fde455553a803bebb67eb478a4f420c2b3c280cd0749d73ed449ddf90c12fbaa963656fa

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\rubyscreen.dll
Filesize
27KB

MD5
69ee5b4f2eec4f25171a8396f38b9ac2

SHA1
596281f5c47a6938c999dbaefd1ad9835b2baa5d

SHA256
777055e7400b49941cc083f86343c8bb5c8c067021b32435809e87e4bebe3807

SHA512
a91ae45228667b07eb323045f6185534dd8b7cee576d4c80c7cbb8a0fde455553a803bebb67eb478a4f420c2b3c280cd0749d73ed449ddf90c12fbaa963656fa

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\rubyscreen.dll
Filesize
27KB

MD5
69ee5b4f2eec4f25171a8396f38b9ac2

SHA1
596281f5c47a6938c999dbaefd1ad9835b2baa5d

SHA256
777055e7400b49941cc083f86343c8bb5c8c067021b32435809e87e4bebe3807

SHA512
a91ae45228667b07eb323045f6185534dd8b7cee576d4c80c7cbb8a0fde455553a803bebb67eb478a4f420c2b3c280cd0749d73ed449ddf90c12fbaa963656fa

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\rubyscreen.dll
Filesize
27KB

MD5
69ee5b4f2eec4f25171a8396f38b9ac2

SHA1
596281f5c47a6938c999dbaefd1ad9835b2baa5d

SHA256
777055e7400b49941cc083f86343c8bb5c8c067021b32435809e87e4bebe3807

SHA512
a91ae45228667b07eb323045f6185534dd8b7cee576d4c80c7cbb8a0fde455553a803bebb67eb478a4f420c2b3c280cd0749d73ed449ddf90c12fbaa963656fa

Download Submit
C:\Users\Admin\Downloads\Pokémon Iberia V2.03\rubyscreen.dll
Filesize
27KB

MD5
69ee5b4f2eec4f25171a8396f38b9ac2

SHA1
596281f5c47a6938c999dbaefd1ad9835b2baa5d

SHA256
777055e7400b49941cc083f86343c8bb5c8c067021b32435809e87e4bebe3807

SHA512
a91ae45228667b07eb323045f6185534dd8b7cee576d4c80c7cbb8a0fde455553a803bebb67eb478a4f420c2b3c280cd0749d73ed449ddf90c12fbaa963656fa

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
\??\pipe\crashpad_1004_MESIONTAKKNZUXXT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/380-4725-0x0000000002CC0000-0x0000000002CF3000-memory.dmp

Filesize
204KB

Download
memory/380-4730-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

Filesize
4KB

Download
memory/380-4732-0x0000000003F30000-0x0000000003F31000-memory.dmp

Filesize
4KB

Download
memory/380-4731-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/380-4726-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/380-4733-0x0000000003F50000-0x0000000003F51000-memory.dmp

Filesize
4KB

Download
memory/380-4750-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/380-4728-0x0000000003E80000-0x0000000003E81000-memory.dmp

Filesize
4KB

Download
memory/380-4751-0x0000000002CC0000-0x0000000002CF3000-memory.dmp

Filesize
204KB

Download
memory/380-4727-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/380-4724-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/380-4729-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

Filesize
4KB

Download
memory/1168-141-0x0000000000400000-0x0000000000725000-memory.dmp

Filesize
3.1MB

Download
memory/1168-142-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/1168-250-0x0000000000400000-0x0000000000725000-memory.dmp

Filesize
3.1MB

Download
memory/1168-248-0x0000000000400000-0x0000000000725000-memory.dmp

Filesize
3.1MB

Download
memory/1168-138-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/4192-4604-0x0000000002B70000-0x0000000002BA3000-memory.dmp

Filesize
204KB

Download
memory/4192-4661-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4615-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/4192-4616-0x0000000003A30000-0x0000000003A31000-memory.dmp

Filesize
4KB

Download
memory/4192-4618-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/4192-4619-0x0000000003A40000-0x0000000003A41000-memory.dmp

Filesize
4KB

Download
memory/4192-4617-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/4192-4620-0x0000000003A80000-0x0000000003A81000-memory.dmp

Filesize
4KB

Download
memory/4192-4621-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/4192-4622-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Filesize
4KB

Download
memory/4192-4623-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download
memory/4192-4624-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

Filesize
4KB

Download
memory/4192-4625-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/4192-4626-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

Filesize
4KB

Download
memory/4192-4628-0x0000000003B00000-0x0000000003B01000-memory.dmp

Filesize
4KB

Download
memory/4192-4627-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/4192-4629-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/4192-4630-0x0000000003B10000-0x0000000003B11000-memory.dmp

Filesize
4KB

Download
memory/4192-4613-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/4192-4612-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/4192-4611-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4192-4635-0x0000000008740000-0x000000000874B000-memory.dmp

Filesize
44KB

Download
memory/4192-4607-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/4192-4636-0x0000000008750000-0x0000000008777000-memory.dmp

Filesize
156KB

Download
memory/4192-4610-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/4192-4609-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/4192-4640-0x00000000088E0000-0x00000000088ED000-memory.dmp

Filesize
52KB

Download
memory/4192-4608-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/4192-4719-0x00000000125D0000-0x0000000012610000-memory.dmp

Filesize
256KB

Download
memory/4192-4642-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/4192-4644-0x00000000088E0000-0x00000000088ED000-memory.dmp

Filesize
52KB

Download
memory/4192-4643-0x0000000008740000-0x000000000874B000-memory.dmp

Filesize
44KB

Download
memory/4192-4605-0x00000000039C0000-0x00000000039C1000-memory.dmp

Filesize
4KB

Download
memory/4192-4646-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4647-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4648-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4649-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4651-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4691-0x0000000011C70000-0x0000000011C74000-memory.dmp

Filesize
16KB

Download
memory/4192-4653-0x0000000002B70000-0x0000000002BA3000-memory.dmp

Filesize
204KB

Download
memory/4192-4652-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/4192-4654-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/4192-4606-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/4192-4677-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/4192-4672-0x000000000FDB0000-0x000000000FDC0000-memory.dmp

Filesize
64KB

Download
memory/4192-4660-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4614-0x0000000003A20000-0x0000000003A24000-memory.dmp

Filesize
16KB

Download
memory/4192-4662-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4663-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4664-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4603-0x0000000010000000-0x000000001019B000-memory.dmp

Filesize
1.6MB

Download
memory/4192-4666-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4667-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4668-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4669-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4670-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4671-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4673-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4675-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4674-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4192-4676-0x000000000CBC0000-0x000000000CBD0000-memory.dmp

Filesize
64KB

Download
memory/4396-1108-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-255-0x00000252BFCC0000-0x00000252BFCD0000-memory.dmp

Filesize
64KB

Download
memory/4396-4650-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-4597-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-4572-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-3767-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-2536-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1675-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1456-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-4641-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1354-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1220-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1189-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-4657-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-903-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1028-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1007-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-962-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-1139-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-855-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-809-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-679-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-442-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-301-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4396-271-0x00007FF7819D0000-0x00007FF784576000-memory.dmp

Filesize
43.6MB

Download
memory/4780-133-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4780-251-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4780-140-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download