Analysis
- user interaction
yes - max time kernel
58s - max time network
59s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 04:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/JCtQWByQ#Y0uQymWLDr5Zt7rsUPn5MjyP33pfaoGXaPhSvAkDDFc
Resource
win10v2004-20260130-en
windows10-2004-x64
18 signatures
300 seconds
General
- Target https://mega.nz/file/JCtQWByQ#Y0uQymWLDr5Zt7rsUPn5MjyP33pfaoGXaPhSvAkDDFc
- Sample260508-e3y7bscz7v
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions RC7.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools RC7.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RC7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RC7.exe - Executes dropped EXE 1 IoCs
pid Process 5208 RC7.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum RC7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 RC7.exe -
resource yara_rule behavioral1/files/0x000700000002479b-1789.dat upx behavioral1/memory/5208-1790-0x0000000003390000-0x00000000033AC000-memory.dmp upx - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4328 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RC7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer RC7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion RC7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226881286027328" chrome.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 chrome.exe 3808 chrome.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe 5208 RC7.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeRestorePrivilege 3628 7zG.exe Token: 35 3628 7zG.exe Token: SeSecurityPrivilege 3628 7zG.exe Token: SeSecurityPrivilege 3628 7zG.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe Token: SeShutdownPrivilege 3808 chrome.exe Token: SeCreatePagefilePrivilege 3808 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3628 7zG.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe 3808 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3808 wrote to memory of 1860 3808 chrome.exe 86 PID 3808 wrote to memory of 1124 3808 chrome.exe 87 PID 3808 wrote to memory of 4328 3808 chrome.exe 88 PID 3808 wrote to memory of 1124 3808 chrome.exe 87 PID 3808 wrote to memory of 2072 3808 chrome.exe 90 PID 3808 wrote to memory of 2072 3808 chrome.exe 90 PID 3808 wrote to memory of 2792 3808 chrome.exe 91 PID 3808 wrote to memory of 3980 3808 chrome.exe 92 PID 3808 wrote to memory of 2792 3808 chrome.exe 91 PID 3808 wrote to memory of 3980 3808 chrome.exe 92 PID 3808 wrote to memory of 4956 3808 chrome.exe 93 PID 3808 wrote to memory of 4956 3808 chrome.exe 93 PID 3808 wrote to memory of 6012 3808 chrome.exe 94 PID 3808 wrote to memory of 3240 3808 chrome.exe 102 PID 3808 wrote to memory of 3240 3808 chrome.exe 102 PID 3808 wrote to memory of 4740 3808 chrome.exe 105 PID 3808 wrote to memory of 5428 3808 chrome.exe 109 PID 3808 wrote to memory of 1640 3808 chrome.exe 110 PID 3808 wrote to memory of 2872 3808 chrome.exe 111
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/JCtQWByQ#Y0uQymWLDr5Zt7rsUPn5MjyP33pfaoGXaPhSvAkDDFc1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1b2bc728,0x7ffc1b2bc734,0x7ffc1b2bc7402⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,5671461715433330706,1245844997664173788,262144 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,8346484948640436035,2870308101999183770,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2112 /prefetch:32⤵
- System Time Discovery
PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,8735074220549110799,2448309549835997917,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2568 /prefetch:82⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,15691261278824161978,999063159226463435,2097152 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,10812445163202390816,13993591209264175631,2097152 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,9877917779110277804,14495004014908697463,2097152 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4280 /prefetch:22⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,9995179211703474506,6636400436895922371,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,9059862861300074145,5476145042193812107,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,11972641934905500566,9783887599188569719,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5920 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,2327721419527174246,2422427921619029085,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6168 /prefetch:82⤵PID:5428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,16919470287882607760,3920896285540395078,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6068 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,14113780076559984971,7202959355152355245,524288 --field-trial-handle=1984,i,6784501684281838788,14912965124636268123,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6204 /prefetch:82⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5744
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2408
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RC7 Remake\" -spe -an -ai#7zMap20949:82:7zEvent115391⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3628
-
C:\Users\Admin\Downloads\RC7 Remake\RC7.exe"C:\Users\Admin\Downloads\RC7 Remake\RC7.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 5fa89afd0db29605297483d9924f2d95c9ca41215aca46f69b4ee464797a3d65
- MD5 27d4828d46c822a59d0eba3ee88cd73b
- SHA1 1d3ba7163fe19763d1d7802cd1b9a9cb3e536933
- SHA512 3e70c2f84840a0fbe3dbae99a94bebc1568ccdd243a50b1b05bb410847bb39f0cc4194beb96388167b4139f6d1b2e7064a3e23a7cc805aafaafb23f87a03f872
- TLSH T12EE02B96C961EC2719FD176870540646E78513572F514D4F3E3D82088FF863E418686C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 384c273d6759b6aac95cc25d8e1f7d8d0d432b26f1be95fd4c13e3dcaeb4f0bb
- MD5 648a6b8914a4679b7199b4c1fd47aa9f
- SHA1 f91bad807956f0750d9f875db13b3d180ca0e228
- SHA512 ebd3e5a9b13d58bdbb48deb16076273797a725703bea9057c26674ecd63f3ad13f37eec4f122c482d9d119e19d13af9f47a7a0c215ab5e43208a0e6bfdaeeff1
- TLSH T1ADB022C00AC82C02EBFC0FBC20AB2CC033200EA8030B232383C0A0B888323F0288300F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c03f613f7e0e13da8cc914cfd27c9a3db1164921fdecc86a172dd744cde68336
- MD5 4b0a96f621253285425f16298f833e3f
- SHA1 206119c8449d84225c6efe156fe03413d312873b
- SHA512 dee2be53758c8475fc0b622f1b5d40f3100efe12adf5660b878378c53c130c429707a0ecad6259e906d26a99111fa9dd0f928fcc75135f127f4a0807f8fcc409
- SSDEEP 192:VORzrUy+wwd5V4Lv7tYpAPRp2h2Gy9CHsb+WNnOr1GsC2DVqkwprieHVyIsnAUge:VORzruwxzhYUXejy4w842pqJjhe
- TLSH T12542B52EAA14393B8CDBC229FE667B57D7F5102161D82E94EAFC8E2C14DB5CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 92847983981b19a6a6e5fdf54a7fc1f266d9219e5c4dc79eadd8a5c254d34f9f
- MD5 b252eedc1f344d73e85a55802cedf773
- SHA1 662ce5bd2abfb4636301d5a4dee331d40743ee32
- SHA512 82a4cec50c4d550e8156fa0cd9bbb7fefd27ed1e07031b20f63f48ec8bbfbf4c8b1bda1143ea8218b4f5373ecdb6dcaca9103055728ca916ff4771c2df2ddecc
- SSDEEP 192:VORzPUy+wwd5V4Bv7tYpAPRp2h2Gy9CHsb+WNnOr1GsC2DVqkwprieHVyIsnAUge:VORzPuwxRhYUXejy4w842pqJjhe
- TLSH T13B42B52EA914393B8CDBC229FE667B57D7F5102161D82E94EAFC8E2C14DB5CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
- MD5 d25832a19ff9c1c57c95ef5ecf3d457d
- SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
- SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
- SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
- TLSH T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 cc5bf799bdc3005ed8ea1065be523e00dc91473ee25459108aa5414151295b6d
- MD5 5ec486415456d8ed50412062828c97b9
- SHA1 7b043ab273a771b17b2778f965959bac66c1a974
- SHA512 358483054efcfbedc9af79a6fb84026912b97446c4b9a748b1c2a834e7f7f9c67706b86dd28f63afa5ac0c2b401dfc86c9d7a1b742523cd92d3e141d42f6c3c2
- TLSH T1F7C01215C845B131C04B03F1258FD8DC35246F25D609179853E45D36D835131D137279
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587162.TMP
- Size 96B
- SHA256 a00d52d2b497dedb68174dd447c984c08e9cef0acf701c98474b55c9b76655d9
- MD5 fbc5c7d0db950d3b0e02c82b006b0cbc
- SHA1 0b534cd5c9f0e57abbdaaa54d66f63c44e77c8c2
- SHA512 7f0d06d1dd2ec326e29bd3e7682a3009cf3d82981cbe3f012dd27ec6aef307728cd2faaebaa6f5e6110726cc5c1562d2467905e876080831172e04a8a1110c6f
- TLSH T194B0220EC0023203C00203B03AA2FAC83020EF22C2030232E2F00B22CC202300020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 6042f1518c081dec39306115c43c13de6e4a7d6a91fff6073eac13f8f882aa05
- MD5 fb797e219857a83ca476712afff0ae75
- SHA1 a3b9c5a6e448d6934704ea166c222cc77c751dde
- SHA512 0b9fcc008d57ad0ebe65924fe4df98422d263d726d6357dffd3c734fdc676e8b2118123d107ab829d822e4e7da91434fbf0a07e34bafa6935f42ac030795d6fe
- SSDEEP 1536:p3cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:x3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T1859312BA5E1A4AF755BE8691769E7809CD12130D30AFA9CC726C638C21D41CD2B73E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 471910229919af38c42aab15d913223c9b4a8895dbc521a2e7290ccdbaad7228
- MD5 d4c20e9e8868acf78cc9f54185aaef8d
- SHA1 247dfb71f331183df7708aa317b07e01cc66972f
- SHA512 e1b8286cb4a64c0692a8876bbec8733f7072fbc13984c18c365c29ac4d65f72b7ac01494e8b5739661e3c8466d40e15662536b8f9c97641a4f5c5bec9287575b
- SSDEEP 1536:83cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:q3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T16D9312BA5E1A4AE755BE8691769E7809CD12130D30AFA9DC726C638C21D41CD2B63E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 5dd1617e814981c207abaa0ca4efd1b18b772d453498489fd67dffdb348bc64e
- MD5 bcd68117ae0b1a776e986a6637d92175
- SHA1 1594e85072dff2838377eaa0c7ee2c7047eb7308
- SHA512 35d795c286eb92d1cf518edd50255698b44f857b5d41545f22d680b78a0605b3b7d406b3d852a938563d5ac6c74d024b3fb90b043a38771f2b416fd5ebd8d7df
- SSDEEP 1536:0NncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:In3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T1589302BA4E1A4AE7957E46C176AD7808CE12130D70AFA9CC316C639D61941C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake.zip
- Size 19.7MB
- SHA256 9336af33f730c3018d062172bf1974a598cca7cd5205e5fe1cd02704df80547b
- MD5 2f1ccaab2ecae65a3f0e7ff570420afd
- SHA1 37f53cb07951d28aeaea6c15485f97a9d078ef49
- SHA512 e864187f3c85613e8d2788c820e98c700d047f6fe7197c688e5bd539d6cfbc386cce374c31e27fa2d249eca9fe513b253c075b9849050aa27d582f3b1e6be85a
- SSDEEP 393216:W4+bDyyR/2SB18ul2vAC6T5x395ANCG4kaw7n7zrRNoqUfoXhiCvs60g:SDRR/LzMCxN5ANCGXawT7nRSXoxiytR
- TLSH T1542733558D21C7E7DB1B637FA076C9A3EA90900870A0F06F4988C1D95ED67F90EC7B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\AntiSkidDLL.dll
- Size 73KB
- SHA256 8c382f17397517bda1ac66533c8c40c571e1ec078c84a4b2d397fa2f34bdd1c4
- MD5 87294aa0912182ec94f9341fbfa73a6c
- SHA1 d096a3a80b908c1ecff1816fe748cbea805fde9a
- SHA512 1524762c8733d794c9318c0dc2cd00d539392ec99eb869eb5d7dbb23566105f7bb849a6f896777da0293df0d5364cf67777433b9b90b79537fd049717d0fdb25
- SSDEEP 768:+BGTaoVw4YRTxTvYgAycaCWN1E8MSrEoW0VPQ7VPbXb9bnavnzHiz9H6xC:+BgaoVwZRTt9fd6TFbpafriz2C
- TLSH T12673C927653EABB0D2D665F143F04814CB23A0E352E2C90E4AB37DDF1851BE6592AD4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\RC7.exe
- Size 2.0MB
- SHA256 9571f272c5d404238dcae6cf3a174e7b5986a67d949259b9dbde1ccc43f7853a
- MD5 0d7616df4b9137f0f4b713d5d21f6b34
- SHA1 4e7aa774d1f853fbd9abd17d00fbd050e7abc848
- SHA512 ad5d5cc756cad845ebfbbc82f5d76e72ba326a8216ba8edfe2c32c26145fe951faa726a6facda21f238b77d5cc0acbdcb99cfa4ccb0541d647c20076cfd58af1
- SSDEEP 49152:JHugpoEOcO+iki6S02/69HK/jHgQqFiwvkc/:JJi+iki6S02C9HKdK1/
- TLSH T1E3A5F1A0EB89E9D3C454B2FBDC201254163B5DFDA61A870720B47A3C1AB62D3DF5C19E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\bin\Themes\Blue.zip
- Size 66KB
- SHA256 117026b05e5ad9995b2f4e11d793ac6dcee2e13af54a05134cd613d88c3213d5
- MD5 ca1809254635ebf44f8ce975f611a10c
- SHA1 c78d89e9a6bab4ef6b4bde2fa0914f5184f1972c
- SHA512 ad614f93f05a5a03e50f8070178bcccc2a40919d593b3bc213eefd8dce2894597f67578f2482d797dd4b96fc76e0a5bc9237ae98db4d3c2d5ee07958c08093c6
- SSDEEP 1536:rjDt6YNdiJIsR5O9xRHcE4T3Nu4mZb42HjufYShWRNw:r3t6AimyAsDjNuvZxjLSyw
- TLSH T1FF6302DA71419C23D0F538F555A3CAA3D84A3F1B348CB403542A3075B8EA479AEEBE55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\bin\Themes\temp\Config.txt
- Size 22B
- SHA256 7beeb098d26ca5f3faf98f6fe78f0cee814e24a9028b8c9bc52dc8d02b53c776
- MD5 2bbd8f5c00c5cb222c1dac94a39485ff
- SHA1 7310763706bbb5d4f23bb8f7c2bd0a3ee196c908
- SHA512 5bcddafb0040f75f2c01dc70ba4510ee125261f4fcef58cbca61ef5b1496adaf5be737e634803d39c1029c2c095d46dbb1f66ae4dd713cbf35d9b89be6a2f4fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\RC7 Remake\bin\Themes\temp\MainUI.bmp
- Size 434KB
- SHA256 d94eb1486b039fa6dbb02ec1a55c9939309d4a1891c15744949b3616b2307fbc
- MD5 3eaefdfb19287629348295c14cc7c8d2
- SHA1 c2ce386fdf59798e7525ffc3742cfe65ddf6411c
- SHA512 3eec939a99007ce41b005ea1dca558c0925c823108c3e3e1962c832bedc51b8d56168176693d08f0fc705840d68e90829fc8d909f7f325ba63bb617d3a0b8337
- SSDEEP 3072:qIKRn/STgkqYYYYYYYYYYYYYYYYYYYYYYO8jQAL:qGaYYYYYYYYYYYYYYYYYYYYYYB8U
- TLSH T11B94132FE4A242C9D357253D922AFB3F66BE8B5E34138605D1722498B8579C14FFBC24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\bin\Themes\temp\MainUILogin.bmp
- Size 40KB
- SHA256 84f03ba62b459c286fe497c091a22046863f7876c5f7327bcc8f7e0e842d02e1
- MD5 823d00aa3c63daf1b74ca1808e9cae3e
- SHA1 359ab3a8bf41701c85f92ed08bb9d28860b80aa9
- SHA512 8f1f3957589f6287b12b379c8e90d8649b563838613a2b15e8fe286dfc89a7f4e1be4b88bf9761c7dcf118f75d602882b2bccf83dea6593daf150e8b8d03b8de
- SSDEEP 768:CBeaeFotM9pyNWlNtwUQ7u6Jdhf81gxdwuOWWWWWW4OTnnhE9vT/77:aeFnwKS1d58WxfgUvTj7
- TLSH T1AC03D0108AD63307D79928B0D0E70755C0B9FB987616C7DE0099BACADB4CDCBA443AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\bin\Themes\temp\S_Button_Idle_1.bmp
- Size 9KB
- SHA256 15cf2db423623ce6890d743300dbd273eb7489da67840db2a345edef8ada8f25
- MD5 85b62f3297228256b13668ca2fb3f1e2
- SHA1 106c4a9ca28fdabd397c82a3b7173b6e2d05f6bd
- SHA512 f4f099b4ae7a6fa760fc2ce3d5802d97401d566ca869c98e52fe194a2c279dc1328d5f03177ffa885cfc9e06538d60171bfd579a1d31c4420b41bb1cadb68d19
- SSDEEP 192:P9ipEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEe:P9ipEEEEEEEEEEEEEEEEEEEEEEEEEEEe
- TLSH T118122212E4A39285D301767E532AF73F55FFE70931954B06E1A240C4F85EEC48EB2871
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\old scripts\Blackjack NIGHTWING.txt
- Size 111KB
- SHA256 23668227feed6d748e2deb667539b059a49718787f8e37cf0951c7f25e9d1048
- MD5 a63903cfd80af7c1e21db37672010665
- SHA1 8d46dd6da02565fefdc4bfbc3da1a586cf135116
- SHA512 150b2c4941c0daf8c9b1306c1ca0f7152573091f9459e83967271244087ee596fa2944611b6214c3ba08ce6d7bc9b67eda7f33b7c3b10fca2f8da34573d6f2a2
- SSDEEP 768:W4LtrZL0Xcr0xBEqIZx9oYf8g8c1CM4N5UZeTKVrTbgk7mAEfdO01AFzv+WJ/TU+:W2SXnRYf8g8pM4NziMW02f2M
- TLSH T1DDB3F09983C454E4F68FE92C15553E0742F1F42B2AF84DCF72DC614AFF2E1483A64A96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\old scripts\Ganexius.txt
- Size 71KB
- SHA256 d30bc6463d50d46166ea6e6679f9ca276fdde059794c33d18b21873774393a78
- MD5 327845505d8bdc80dd7a3ac639edc9df
- SHA1 ebdd6b22b6422fc9eb313de7ec8828decdfcefb1
- SHA512 53a6a2a26f12e3c25bbf711f3306a871e45c2acd13fbea086ad58dcb4174577bd0bc2aa33f56d70246ffe92985fd97423d06f4b41bc4ecea7a4fa63d4bd564ec
- SSDEEP 768:44LtoWL0XkA+5oYf8g8/LL4oCJixsZNdaocU2PnUmxGoJ4YVOuqm4RVctkYWgqY8:428XnYf8g8TLyfi2ewMKNz6zcL
- TLSH T1B073B94EB7CD01B549DFEA3818772C42BE7BE023257A18CD72EC5045AF9890C64F5A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RC7 Remake\old scripts\Grasp Of Midas.txt
- Size 66KB
- SHA256 ed1e298aa8835e431cde732523b36343ba20a4545c0df9d4635894367e1fff0e
- MD5 269ef8f46cfaab611f13473816d5fac0
- SHA1 8afa006e837fdb65efb0f059b38e1830b914fa1a
- SHA512 5da22152ab1f6527ad8295578970ce903768d78dcfecf7b2cd8ab452024f8ecb2da2e58d304f6723679e257307cf76aaa270d2d25e55136d0db19c79f7533f90
- SSDEEP 1536:WdpXGRYf8g8UOovnEAMkgvCYwmqmRjbHruAWT3K5Vc8b20tjtgq:WdpXGRYf8g88vnEAfgvCYwmqmRjbHru4
- TLSH T1FF634529278710B345DA7734180A39125E66B4472F3B8EABB2CC00CC7B1F95C72ADF5A
- MD5 SHA1 SHA512 SSDEEP TLSH