e299a47ad46062cd9c93eda4b4fca56124ad6ffac2ce3f855506eee94588d1a0

Analysis

user interaction
yes
max time kernel
163s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Forza.Mod.exe
Size 9.2MB
Sample260630-bfzykabv9w
SHA256 e299a47ad46062cd9c93eda4b4fca56124ad6ffac2ce3f855506eee94588d1a0
MD5 259686d48920b69f239b615c506c5ce0
SHA1 3e992a4642e1d412af875573689d9888f7d4f5e4
SHA512 f0bc7be0d0806856bc9783737796358c12bd25a40231239fffeab06f077a4126405390345fd631eebb6e9ea5c158cff9604e40cdfc088402aa7ce8c7a5cdd41e
SSDEEP 49152:mnFIJkJb53asggM2bq7mTv+iru6gaDFHCUljX45t2gQlOgXyReN4DhNSwkm2XyPR:4Ng51+KsDlOxuUhNrUy89zP7XW/P1dF
TLSH
T153A64C14D358C523EB774E784B1288E1DA3068A64311F9CF1BEDAA394EC77C626B7523
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 31 IoCs

pid	Process
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe
4700	Forza.Mod.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1184	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4700	Forza.Mod.exe
4984	chrome.exe
4984	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	Forza.Mod.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4700	Forza.Mod.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5540	4984	chrome.exe	88
PID 4984 wrote to memory of 3780	4984	chrome.exe	89
PID 4984 wrote to memory of 3780	4984	chrome.exe	89
PID 4984 wrote to memory of 1184	4984	chrome.exe	90
PID 4984 wrote to memory of 1028	4984	chrome.exe	92
PID 4984 wrote to memory of 1028	4984	chrome.exe	92
PID 4984 wrote to memory of 5880	4984	chrome.exe	93
PID 4984 wrote to memory of 5880	4984	chrome.exe	93
PID 4984 wrote to memory of 5916	4984	chrome.exe	94
PID 4984 wrote to memory of 5916	4984	chrome.exe	94
PID 4984 wrote to memory of 2184	4984	chrome.exe	95
PID 4984 wrote to memory of 2184	4984	chrome.exe	95
PID 4984 wrote to memory of 1084	4984	chrome.exe	96
PID 4984 wrote to memory of 1084	4984	chrome.exe	96
PID 4984 wrote to memory of 5236	4984	chrome.exe	97
PID 4984 wrote to memory of 5236	4984	chrome.exe	97
PID 4984 wrote to memory of 1048	4984	chrome.exe	98
PID 4984 wrote to memory of 1048	4984	chrome.exe	98
PID 4984 wrote to memory of 4908	4984	chrome.exe	99
PID 4984 wrote to memory of 3616	4984	chrome.exe	100
PID 4984 wrote to memory of 3616	4984	chrome.exe	100
PID 4984 wrote to memory of 2312	4984	chrome.exe	101
PID 4984 wrote to memory of 2312	4984	chrome.exe	101
PID 4984 wrote to memory of 2532	4984	chrome.exe	102
PID 4984 wrote to memory of 2532	4984	chrome.exe	102
PID 4984 wrote to memory of 2244	4984	chrome.exe	106
PID 4984 wrote to memory of 3160	4984	chrome.exe	107
PID 4984 wrote to memory of 2244	4984	chrome.exe	106
PID 4984 wrote to memory of 3160	4984	chrome.exe	107
PID 4984 wrote to memory of 2744	4984	chrome.exe	108
PID 4984 wrote to memory of 2744	4984	chrome.exe	108
PID 4984 wrote to memory of 6040	4984	chrome.exe	110
PID 4984 wrote to memory of 5660	4984	chrome.exe	109
PID 4984 wrote to memory of 6040	4984	chrome.exe	110
PID 4984 wrote to memory of 5660	4984	chrome.exe	109
PID 4984 wrote to memory of 1616	4984	chrome.exe	111
PID 4984 wrote to memory of 1616	4984	chrome.exe	111
PID 4984 wrote to memory of 2716	4984	chrome.exe	112
PID 4984 wrote to memory of 2716	4984	chrome.exe	112
PID 4984 wrote to memory of 3328	4984	chrome.exe	113
PID 4984 wrote to memory of 3328	4984	chrome.exe	113
PID 4984 wrote to memory of 5924	4984	chrome.exe	114
PID 4984 wrote to memory of 5924	4984	chrome.exe	114
PID 4984 wrote to memory of 1620	4984	chrome.exe	115
PID 4984 wrote to memory of 1620	4984	chrome.exe	115
PID 4984 wrote to memory of 1640	4984	chrome.exe	117
PID 4984 wrote to memory of 1640	4984	chrome.exe	117
PID 4984 wrote to memory of 2376	4984	chrome.exe	118
PID 4984 wrote to memory of 2376	4984	chrome.exe	118
PID 4984 wrote to memory of 1212	4984	chrome.exe	119
PID 4984 wrote to memory of 1212	4984	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\Forza.Mod.exe
"C:\Users\Admin\AppData\Local\Temp\Forza.Mod.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb06b3c728,0x7ffb06b3c734,0x7ffb06b3c740
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13443910534311337076,11817882881908005325,262144 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,8256721677975406451,11558826117578280270,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,17584875470063170041,445372690419326316,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,8749937926581869184,6676174643317335951,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,6640011655838437425,16821893188596095176,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,3836029921685174597,7980895182801597779,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,258227953213378433,3061740321563469266,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,7221713018088397803,17693021841181561699,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,17089736190503061714,10391237453324800203,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,7281435126262972608,5898424435138931810,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5340,i,4595753213147160289,11243347937543407088,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5380,i,11603240136368893167,12552099557392958178,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,511428800931986830,17400001639086112890,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5364,i,17855359583462073623,4706582100836427833,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,9699641040044849243,9533856498621978035,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6008,i,9202241164913955760,7305256508155054654,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5356,i,7253122382568325243,1915206945385764596,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5792,i,14155894661521928751,10233270172702867763,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5632,i,8567988213809613308,588135630464421398,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,12818334517028792704,15768844451628366963,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,6412314356889022886,9037095111130849821,524288 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4704,i,10200459197541849983,7333266876613823265,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6216,i,15262535410733919089,2878549297365929215,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:9
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5684,i,6899918940072164397,955772253723490303,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5536,i,332663129859870413,3159019927751428411,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6012,i,2833908509254541779,10301259274368445174,2097152 --field-trial-handle=1884,i,7869675456926503278,4268063346344519010,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f2765bffed421f194baa053e79b5bf9effaa1c64bd792d3be1d01e2a541b7dac
MD5 7ab4a2cbc622cac6fc3c990f7a2f2f86
SHA1 4690bafcdab6c62c6e880131342e6ad6fdf6f758
SHA512 306437c9be02577072b4d7bbdf32eb9c1646a4a406722cf8117f50c2fca45afc0aa11c23b2b35d9904f04dc2e753be28b2f0baa8efb272445de2a81c402ee66e
SSDEEP 192:MRjk7t+v7ZAPRp2O98Hsb+WNnr4082VyIsnAUge:MRjk564Xd+ws0Fe
TLSH
T18022852EAD14653B5CCBD26AFA65B763D7F6103172902E44DAFCCA2C16E76CC212B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 8f5ac1599bfb240d947ee670a349b5d7e628d7abfe10b25df29c2660d67f6538
MD5 ba9c6fe72e1b275ae6614d5e91690797
SHA1 7b791224b4cb86217e98650c7cd05edac00a9571
SHA512 37135c76101a3b16dfb153df1a9cd677d6f936355f36c49016a59bf229058389db24c58dc888e986612df3b1dedb6835012fd46c2c0f5d641292f3cd83a067c0
SSDEEP 192:MRjk7U+v71APRp22u98Hvtb+WNnr4082VyIsnAUge:MRjko6EXC+Ds0Fe
TLSH
T12F32862EAD14653B4CCBD26AFA65B763D7F6103162902E40DAFCCA2C12E76CC312B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 72ecad7cc9d98392762ae8dbc5ae5720ae737e86e23831282b904d237b2e7067
MD5 68dc92562cd9bca1d640fc204f038719
SHA1 291d24296ea07d4011703108204b933083baf31e
SHA512 a6fc301dddaa14f2099af7b074b3c721daa0f5980421b721b3cb82fe6890304a45d2e954f3820a1fc6ff1d02f1730a5e3fa24aa5d01f49c0630babc35957c180
SSDEEP 384:U+jS97KxkXqKf/pUZNCgVLH2HfgslI1XODSd+ErU3vaHGcayz7ZiMV++YMMz:UOS97KxkXqKf/pUZNCgVLH2Hfgs+RO+0
TLSH
T10B52F827648C863F4FC8D54DDC17AF4FADB5015662684D2457FB9C0903AABCB121A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 dd46939ea05c6b82a1bcff5aec404b5e56da8d65c8007dda8cfe6dde4193bf39
MD5 7d3938d66739f0ed21d3b233cb851412
SHA1 c7bfb0f3f0f7b81b2274af35bfa5eb956f316c7f
SHA512 f1d3b41457bed54d7d708f04c0fe6a545ebe1bbeecb7b027108d50c27d9b933fed5ad72a51b8624069700a9932332009866380a472025101be2f2d7a2d3b7d9d
SSDEEP 3072:V9Khgm8GpzV7VwU+A/mGw0oEMgenrco8uBofRYp14+goF9:agSz/duE7egoXo4F9
TLSH
T1D2C302570D8B987F499EBEC33013062ECDA9CAAAD4437D7C91D09F918DDF346A213929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8e04195041233a8fd188c95375e4a3288549811b7a21d269520826ee3e581b70
MD5 2e18015f3cd9da86bb6dc9b3f715df81
SHA1 6c75f280a0770ef1dc84f633466ea109226a926a
SHA512 fb59f84a390836ca4b975b46fb7716f901b821b76c30ad25efea6e5e56d843aafa3bd4a49fea0579c3511a6f6a1dc8b9b511a4e04fa0fca79fb5916860779232
SSDEEP 96:4C6Md+pp4Cd1B3fkg2Xf2iRDotok5VRDDB6KzGyvhrL3LybLHAv4a:4CPg4Cd1Og2X7DUDzdzaKL3LybLK
TLSH
T182A13A31747D9DB715B9D488BA063A03DFB0A09BE611AFA4D8EC1F1C11F71E81352617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\CommunityToolkit.Mvvm.dll
Size 268KB
SHA256 3c7226eb2100b30a6a6241edbb5aa1645dcfea47e34b09f892fedfcac0c544dd
MD5 521733d64e9899defe6656eaf8d99907
SHA1 d96fc4662ca505b272d86b7ed7dad2d73834a79f
SHA512 7b9e515a862017726d48bcc642b2cfa2c6a1e12261657036ab5324ecf2b0be27f5125ee6eacd7f1eb0013dfaac0811be5643d72e19f0cde3a30ae46f5eea11bf
SSDEEP 6144:bBoNrVMRCDzk/TdLsv4+Sm5i0ofEtDdUd2k:bGxMRCDzkrdIv7Di09p
TLSH
T19C446A67A3DC4A07F57A81798363C203EB35D943A321D6CF02BABA941E87FC19E75512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ControlzEx.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\ControlzEx.dll
Size 532KB
SHA256 909c8d74d08ca5f5c5463221662068a38ff16a7fba1e6e529a3893e48682f6b0
MD5 2b5fb689b1f778e338453822216498ed
SHA1 a60fae13caf62451a445b4dd7e0d90eac48d4355
SHA512 0c375598b284371f285ce40cf7af5a015d61d5d68c5216c2303b87bd721bcab10155de08bec2bf308a297ddb11c2c472548f55d1f174e19eaf188d359a0cbb46
SSDEEP 6144:hghgECPJgXzVSRS0Kn58bLUZIKIsus2DJH5u6YAZBYmR8OpY82gb7gP2rxp+7vVS:mXCPJgpScb58WRhusuJBRTxlBz
TLSH
T19BC45B3663948D25CB3F86FD86534101D3F1A9425330DACB8586DF99DF8BBC2A73216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MahApps.Metro.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\MahApps.Metro.dll
Size 4.2MB
SHA256 0c86b725ba0c0666dc731a12127e816a0285fe8f45ee1a248b1ebddf34ce62b8
MD5 6f48acc8de7939601f34d13e9ce0a1ba
SHA1 a2cda7f89ac39313976909a17b7f07de0c5a0a51
SHA512 42a30a95b9ddbcb7fe36b7006e2c02ce61e451585baaacac6a93fc8389be0bd95f9b6dac1f724c73c6ff1d2908b1f5e1d55c5058bedd79fc045d98b3cb8b91eb
SSDEEP 49152:qgM2bq7mTv+iru6gaDFHCUljX45t2gQl:q51+KsDl
TLSH
T17D26D724C329C123EF635D791F5198E45D2028E68302FD8B1BFD6B3589C5B9A36BB523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Memory.dll
Size 76KB
SHA256 95aa5c51c12ec302ce518cd7597f664cc03f3552933730ff44a63190abf6d1dc
MD5 9ef0b37d64dd068adf27f50f5b8c1efd
SHA1 822a1a9f7c0494f459d8e0fc88af7819ee0c7ff0
SHA512 67b3fa85c37b10f0d9edf77f49f9c145d9727ea28608642aac1fd228fbfbfb1944cc19284deb9884cce74c6f507651d63cea1435a4d4ee3775b9cec9a4c5c8e4
SSDEEP 1536:gD4Osvc1mxHNZJNAvGegOlcLOu7AHD1OlZJbuF:gD/svcwRHgx/lcLOu7AHtF
TLSH
T158735B62B7989123E77C8F3DC80A4911C1B0F4962B52D9DF80C990EA2FB6BC7A771552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.Abstractions.dll
Size 36KB
SHA256 291bc2422c78bb23137fcc25fd3ecb1aa3a36aecdaa248a6be6a9806430899d8
MD5 be1836ad923b8e043a2d83590952bf50
SHA1 31c98d4a78521e93bbf384156b01df6afb0edb23
SHA512 96d56a811815dc6f6d0df38df917314d7c0d112033b00a4d7b0e7f79aa3f15e13a9e0c3570fde8ad574d36270015675e25429f19ec7d70210dd1bcaf17a6525d
SSDEEP 384:fWsfNWBfMNbcpMOibVa/i8lv3VlO91vv7VVmJ/50kv96TG/FwzzRjz6qMvckxuBC:lcfM1cSOESlnO9V7VUJ/SkXZpqoRH
TLSH
T101F2293813AC4732E57A4A7BD8B34D049E72F8636712DAEF959C260D0EEB7C046B3615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Binder.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.Binder.dll
Size 76KB
SHA256 95314b2f54737c1bbca684cf207d694ec645e30f029aa856482e844d00700af8
MD5 bf21badb4ee6c6f2ce6c4c2cafda4bed
SHA1 60e9e13930cfb2f63cb3de892715357f703e2a66
SHA512 197e29f0b7f472e27798dcca8db2fec7bc40d7a514e31d34822077d9799e015841f2b8d181dde8601bf29043177b5804806f323b147e640b94588163d7cf77c6
SSDEEP 768:5U+TxTQY0X/Vdrx506GZPM2BmJHfCJpfXkPubIQGxbNjyQV2h:5ULbXbx506gU4mJHfkkEIQGxFyQV2h
TLSH
T19D736B0673E48A25E2BA0AFDE9335849C6B2F5432325D5DF095D890E1F937C0CAB2767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.EnvironmentVariables.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Size 28KB
SHA256 02fc1cf8a84970519accbda29a947e60fc6060639cfd1dbdbc6e8c341124269e
MD5 f2326cb984605ba7aef286ac5c303d12
SHA1 c075ff21dbce48f037ff53c079b4172031c302ed
SHA512 77a314f913ad078e4308e86992968e374d3c0644ac62ab37981c7c203328f09387400dd6bddfbb4dcb2c1ca9995bed051f2d991eb87e83f88c3019baa281582a
SSDEEP 384:CKWUPeWDvkx8myx3r4WMsvpiW+K0ihWQStktTn:TD4vYr4rsv5PUp
TLSH
T1B9D20A0597E88711F3B62738DAB75D2A9972F9025B1299EF001E410F0D5BB948AF1B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.FileExtensions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.FileExtensions.dll
Size 40KB
SHA256 892fc208754e5f0eb3d3af4461c764106f5080f7d978003b2eef07017adb7eb0
MD5 50f951ee1e0054ab552f81f0928f2b13
SHA1 4a16d55eb010cfe4668e1cbf9a3a6bdef3c83963
SHA512 feb6ee8fdbaf15dea0623ce61bc3cdd569a98ecea60d2a89f38f06a7451f79b1c749cbd57751c30813d098ad7038a59f2ec095e8ea666d4e48583c4a40471cdf
SSDEEP 384:nqWqf6WvRHxusqkI9BABlCoGrNqPmfeWnhnU2cR4UCdKetxyFCLJNsLgA1ScFV:nEzdx9YOlC3ZfeOhfcR4lVtfMDp
TLSH
T1DA032A2697D84322C9BA477BE9B36848C1F2F0432791DADF448CD10D1F973D499B26A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.Json.dll
Size 40KB
SHA256 30058af593c58214725aae4b9811b9c99c2cb2ec1e70bad87a363f8239e36983
MD5 a3162552010db3e44140181be33596ab
SHA1 9625a5f6f45413faf35cd3d5e49c78b8d534d6f7
SHA512 1f0e1e0238a58a3ad51c6de95d7c8d8eb14c236d99c6d40771f534184aaf727ecf9340ca1404fa116fb3a9e1bb24094c2c6c808dbe69725444850572a0531521
SSDEEP 384:RWkf2WY5CZuHA9je1l6If2a69ex8TyegFMvqofOZv5:DlZQGjhIfJF8TcFMA
TLSH
T10203F72653944326D9BA8BF598676E48D6B9F0435723DBCF045DC1CA0EBB7C04BB2226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Configuration.dll
Size 80KB
SHA256 1a184163dcea1952cdd3d97a5504f62637e2bcf1806a1db4f702900c99a2aae3
MD5 88fb4ffdd9a92a59acf24d0bb94e3765
SHA1 ed2c37a53967f6dd834820f6a051737663570fa7
SHA512 4cd7608739e50b8baf1dff38f0ccba93353d83f9a71084ab1270688d89597ea391b6cae5c84c7e5f4d646221f519d0100777a7cf49a9b859b4b24bf6bcf87ef8
SSDEEP 768:LZpXz8sg0I0wRFlTnGeZrVap3Wx6M+jVnrI/yqCtHUafO+ukuCNJJnK7Ca:LFgX0w7JxrVc3mt+a/AX2+uss7C
TLSH
T17E832AB973940A21D67982BFD5A39C08EEF1F0435332D2EF891F664E5E973D05A72062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 128KB
SHA256 8a65b3644cdaa4f65ed9c17a6f7e259ac86b07a1100f48a8932d0e4e38540ad0
MD5 f708f04a1f5a585394ba6d0be35ab494
SHA1 0ad83a6fff1b6a1532ec8f116421f0473a153023
SHA512 a892e66ea4588e1bcb193d7ae56b4e860dba206e9d5a81d2427b71b20f2bd0276441cc842fff737d9625a471b069d661bea44d5dba3105e52d93a988562f7610
SSDEEP 3072:okNTBs0Pmm6kCD9TmFfR1hAKuj6dW1OGbiKtp:ZLs0Pmm8D9TohAJ6dAHbHtp
TLSH
T100D33914B3E8025AC6BF41B895330E63E0B3E55B1361E2CB146AE55A0F83FC5B5B1EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.DependencyInjection.dll
Size 196KB
SHA256 b6ed1826e918570c8504fd34d24566cc50be05ffe8c2fcb629e75e3418fd4223
MD5 f57933357abdf89abc966d9b49244210
SHA1 4490d80ab54333f54ccdb28746d90797c4e263d5
SHA512 44453f3ae396f16878e7e82422f2b70edee27a431ef0258d586a598931a90aceec211367c439ad73de243e213a231352b1d4a808754608877b33f66d525a2eb6
SSDEEP 3072:W5fx8kFfKlBTOn1b3XmgLjOEO2Y3sr1tHC0/hwjUvZEmKFdJ33:4fxftKy1K1EOqCqhwINI3
TLSH
T174145A2653C89A13E77F417D8613C200E7B395172B13EACF0D9A99151FABBC1BE76221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 36KB
SHA256 cad41fbee65cac39e3d75ebd6b59dd416d40fd49ab9dab5159df3d05374022fe
MD5 40ef122fd2fd2598b20eab4444f686c6
SHA1 ca9e4b19e9213c9bf1116df02352fc287f3437b0
SHA512 c4316fbb6a8cc30db13e5f792bbc8c95ffe5627659c6d2550cc994a2d4ac1e6809a902d534cd376dcb9a8f9ee34c459a97444607f62e3e673f61cd4481598b48
SSDEEP 384:WWOfRWlIjc3R4Vb0i5B7TGPdQbtlrjuV5vE+YlOjqmfASfRJUn8:MLZVIib7qF2CV1Zh
TLSH
T148F23AA0A3FC9336EAF90F3DE9B245058272D1576711EBDF498C410D5F63BD084B2A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Diagnostics.dll
Size 56KB
SHA256 1e9e35cc3472b16afec613b53328060a3a52027862f4e06cdf89fcad9447f8d4
MD5 e9ec1650f1eae5ff4da8ef9de9201c99
SHA1 e4c3c3769ee233f33b5a3b9752474839c30ea8f8
SHA512 174a0db24387bee42509fa90a43f7c2b691dc80266979ec09011c528fa9212cd416e0cec668c5eadd5f9e81ddf63e14674b2e4a6c63f6adc4a96aa51e7a0abc2
SSDEEP 768:BzgCKL7csYuPoRQCOH+WNtrb6OYK3/uT6BmOq:Vtk7cqvC+rK0Nz
TLSH
T16A431929A7960316C6BA85BC85A38C05F272F4436311D6FF0EEC9C9E5E9BBC08671735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.FileProviders.Abstractions.dll
Size 28KB
SHA256 671f81bbe32e7b39d0a3fd67344636211eef3a0e268ab0154987941e5d045836
MD5 68483ab93ffb477d6551816ecb9cab6e
SHA1 150aff46bcdd1405bb69383b516f18562dba7d20
SHA512 8618ccfd89b8829be86b2d25a2b8f64df78e2460d65275dcde9de451058e1f3b33ebb494b521086862f1c84ae36a6e605e7d38a8fc9cf4c2ddd0d9b512b33382
SSDEEP 192:fWs/hWXtt/KKUwRQxSJMHNfaM8/KZwRLbv2mQeu6pG/tnsD+UMXZjO56MXqdmO+6:fWs/hWXt4KFRMhNf27tv2So+MVV1KA
TLSH
T1DED22A25DBE58335D8FD0B359CA74A480236E76A8B07EEDF4548110A1EB3BE89572B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Physical.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.FileProviders.Physical.dll
Size 80KB
SHA256 3c830697e9bbf1f296e1d11655490424774ef97f5dc68696d9e811a5e6ee216e
MD5 e43e1dd453892ddf6368c357376fab8f
SHA1 d60c84adc135e9ea0d6f3d7a31fbd376962fc56e
SHA512 0c9399303eac394f4a9e45815f4d444e8ec51938a6a25ddfb5be45de3a12114d6afde8a42f73c7af5e53f0ac25bec04a6058a693dec7a887bf8be0cb050843c2
SSDEEP 1536:Xm5McFmP9oUkVTdE8xWWaZcnuHeIpdtUxdZ0sp:XuMW3PzaGyeBZ0A
TLSH
T11C834B1173D84612C5EA86BCA5B39987D235F0839333E6CF085959CF1E837EE56B2076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Hosting.Abstractions.dll
Size 68KB
SHA256 760c45fd1b371faca2c9ea374a1f875eb3c8202f21912e65572be5b9dcc65ee9
MD5 453fd26cb55f9a8b5905c25a1023052e
SHA1 caedd4f0fa448f4e310ce4bcf62d98d09ef404b6
SHA512 6037ebcf032ead3b46f11e867ed478feec9850ef34fe226ed4992077d8ad58000fa34a7a289e6b6931d60ca70af3f079c3cba7f93fc8af7c33dc5638f3a02048
SSDEEP 768:5SBb6KoJ6yxUQE6xnU7GjPb6vXCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt164yCc:5SBb4x1nU7GjPb6vxWFvTbTTR9l
TLSH
T14B63A50563F84225F6FB3B38A8F659148A75FC51AB36EAAE054811CD0DB3B80C9B1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Hosting.dll
Size 140KB
SHA256 c4d6b65a159234b3788949a04a1b9019d343a5b377c21b96f8c06431a4ee47ae
MD5 57e385e1e31a442bba3e0a0864091de3
SHA1 3807a0f535cedbc323bf66471c6bdc0bc0efd773
SHA512 8b438ff903aa5a4e16a8ff1446afb99b24890cd14b0f392fe4dbb6b0f8c9ccb977aa77d50633c238eefd8abf821ba45ab84cfa4bdfc2950f85ae9e5816fbf27e
SSDEEP 3072:hoLji/F0ouGIwkZixcP2oRaubbaECE/FVebKx:KL4swkfOooTuF9
TLSH
T163E3056793E80712F6AB83BCD5A35D11C273C5920706EACB098AE55C3E877C5B732297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.Abstractions.dll
Size 132KB
SHA256 4f77f38cfb355d9bbbccf9a3bd912c756417e18ae06403161770f0c4e86d9566
MD5 d72e5821b3c4546c9f8acb98684eb76f
SHA1 4ae0ec66c0a24fb2a723372184c3e50f43484bc9
SHA512 b6c4cca0f81b6f522d65e6f996f99b8b9da90bd510bcdc8381d3b55e44f5195a24a062847dc0b21cc924859f43c64025dd114784baa6b87b8966413285695abb
SSDEEP 3072:htY9M5VSf/aqVpnhV9/Fe/jtRHVoz4MRjG9l+A6XE7:L+M5yn9myRjRD+
TLSH
T1FED34924738C4363C3BE95BED5139A42E6B3F1765302D2EB18CC950D1E4BBC4B676A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Configuration.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.Configuration.dll
Size 36KB
SHA256 bc0257c424a1747ddb81b53a784624e186689fa63ea5c708c3d2a4edb9150326
MD5 76a69addd276658b1be188a492f66f0a
SHA1 d64fb65160e48533e12030f34c962e04ec82e817
SHA512 2ae5d5f7e7b6b531b2ec741144938d7c5705b785d2e55acf290ac6a0f1f599a059f378e1cc37982336872741ed030d1c73eb39b64dcbb111905e3689820677d2
SSDEEP 384:vWxsdU7RWNEcgW+uWZ25YKkOrZyhZGMjK4fCYOgmpIb6mioBx1BOr8vMB3:7dU7qLgWBWoYKkOrZ4GMjvJbPx1BOr8
TLSH
T1EEF21B1153A44735E5B647BAEE624D0CEF35E991D2A1A7DF09AD640E0DEF3C08B72321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Console.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.Console.dll
Size 140KB
SHA256 9c9c80d009d7cac6303a3b5279d809582a2cb55cdc03dcd26cb264e7553d50dd
MD5 b4ac06c9ef32e512370c448d775dff93
SHA1 ff94d904cc9a8d9f9bcf74e90f581cb99689811a
SHA512 8c627c008ba3c3eca7abbdfb5d0645c5e0c6d4850c3fd971abf80ff068b2a9b59c2164b224252c501701576afb59f69f125498230df511bed7692a5686bf6c02
SSDEEP 1536:VY9z+q2682RlzZxA7gsnHZtcsMqiHZ+TCIXdayA2cs14UJGyhTRthBo48bjs7:VAza6807aEN8ar2cs1fGyhdthBoC7
TLSH
T17DE36B1997C802A6C77F867CFA638E01E6B3E8934311E6CB0944DD4C1F67BC5B672626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Debug.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.Debug.dll
Size 24KB
SHA256 81d1c88022748590d89b7b58d36e3ce2ee7a65998c5211d9d25cedff757e1382
MD5 8876ae59dc4ca130ea297f2c03cba138
SHA1 c7e4bddb32ffc9e46653499bb874776fb49db4d1
SHA512 1c3b19579391258ea3eea604d355017554c5bdda6f0aa28dfb8141e38db9cb90c0bfea3b7246f7829511065aa25b595a69e6615c5c6725706f7472bd47f2af61
SSDEEP 384:OiWJlVMWFgWuVBPkHCuH8PLmBjhhhhhhhhhhhhsjhq:CnQPWC1TUjhhhhhhhhhhhhI
TLSH
T186B2C601EBA842B9F87D4A3DDEF37B04A635EA41AB13BFDF054842050CA77D485B1755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventLog.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.EventLog.dll
Size 36KB
SHA256 736847fd1eed9c1dbfd4ce8a74646a5b880e4f01a66e2b460c1c6b5dd8f75772
MD5 7efd7e5bd7a90dc131a66ba976322d20
SHA1 3a456c96788c8e0cf46f5bf2bb5b3e2dd882fa49
SHA512 4dbe1911843d3d2492873c4524e0038292d5eb63f73aa6e2a5710d5058567fd49b9ca47879d7894fd797184b598a635eed1b926631781004d74122a968818e25
SSDEEP 384:EW2fFW8MGsI/7gcT6v3tj3n94RmjszWA3JdOBBgCV7VwelCbn:6nFT6PtC1WAXEB6
TLSH
T1E7F2291593D4172BE538C63ADF736E14AE79F6879712EAEF8A1C7A0D1E037C08031169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.EventSource.dll
Size 52KB
SHA256 951100120b9712529ad787d91c98924b303f9cb9450eced997960d592db56bfa
MD5 b45a7d188d131dc84b60bb12e6c6fe36
SHA1 6adb9bb3cc677f62dcc47dee747637f0ad19c7e9
SHA512 04f5b36b898ef6dd6175dcef339d898c52334739695ec3419044a527db5a75129754fc4f2baf689bdfbd28631740792b94e71975779ec069bffbc58be5de47ab
SSDEEP 768:VDNFyV80NtvPNRHoEs2qpl5yDje9oZXWNQajvSMwQZz:RN0hBoEs2qpl5Gje9kRoJwQZz
TLSH
T1E8336C2063C4674EC8BAC67CD6575D54D1B6F9A72732D6CF4908819E0EB3BC18736A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Logging.dll
Size 84KB
SHA256 9860dd4d25c39caca890fca54716c038dd2da5cd608ecd3292af554fa31f87a5
MD5 8b8931de68d77665aa7630dfaac174e7
SHA1 0e0e880af4e0b6c4cc015b0cb3426f03e55c61ac
SHA512 be438dfc004afc81e375f1f791760d9209c250ca933443e2526c9878b06027c991bd674b8af71ba40106c90e7abc02f177f198068b9fea5d4ff264f0007bf7b7
SSDEEP 1536:Jf5EIe8Izsy9zEzzZAbLCh+K3q8+EY1o/d2d4ImYY1T5DP:Jf5EIebzezZAa7r+EY1owaImn1T5L
TLSH
T170836C1073986312C66E86BDE7E3AC49D670F562A723D6CFED6C509D0F93BC08171296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.ConfigurationExtensions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Options.ConfigurationExtensions.dll
Size 28KB
SHA256 1feacc8259ce57bb7993dbd1cc03cceb6af2285a667147473679ad11418963fb
MD5 5fbcb1b2b7fbcb2f1bda0be01c99aae8
SHA1 cbe3b61447e3e3eab0a0da7eb75f06c50774e20d
SHA512 62e7e37c8243799c8a39b48a54d6170d032c8bfab5fa9f5bb5f5451602c12fa13a207e2fe98bcce9fbac48874566118248dfe6e27a8e8f98c5e9594e6d53c543
SSDEEP 192:tSzWzP0WolYRuUZpPeqCrtYUKA4HUywcA7PaRoCrm/kXxnldfeVa/VphcAaiY:tSzWzP0W4nTpYUKAX66KxTftYA8
TLSH
T1A4D21A18A7984332E1B786B4DCB31805CA73FA519705AADF44CD910D0D577C2FABA36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Options.dll
Size 124KB
SHA256 7d73beabce73bb6f158608a31e83ac4e9da4d09f5af4711a648f1fcb54e24522
MD5 3e6792ffe13324a11a09d4b7e3883322
SHA1 c7860a43b49c49af7349623dbe09898f5b9b9fcb
SHA512 6ee9908279144fb5feaf70ca7e539296b3e89427c9685b1d1162c0bf8bce0132b0b6517fca3ed145fcb9512801a4b68f6e16c0e31e693a8fab0114210b755283
SSDEEP 3072:ycem5zI3bWublEiUKOz9xoyrGwsQvhwMEAWnsyh:fem5KvFUvf7hRjByh
TLSH
T1D1C32829B3884751C6AF813DA5079F20C973C262A35381EB4A9DD50E2F777C2B7B6523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Extensions.Primitives.dll
Size 72KB
SHA256 e25328ffd434c109f6634f4dd2a56fdfb507a35bfcab9a4c9a3c7dc866fd88a6
MD5 e8f0a666ce7b8f2a01b1be165b2043b8
SHA1 32be71817280c8ae6f7670cd5cde6cad4bc7fe13
SHA512 1553aa746ed1ad39cfdbede776b684848b2dcefda6124f92035f116b8637b041ac460931c564e530eb80accaf3aebbdc559d72c6e74337ccc552415e4e5211c2
SSDEEP 1536:L9msL84urG29Ibtkwsg/gaag33ttBOP7yVfHTuia+1pPRz+MG+rS9:L9msA4o9IJkmNag3lOP7yVf6iaEdF+Me
TLSH
T1717348A033849333D2BD8679D5938949D238E1957B63DBCF848C990D2C63BC1A6B617B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xaml.Behaviors.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\Microsoft.Xaml.Behaviors.dll
Size 352KB
SHA256 7b2868c0babbf090f6a286fb530bfe4c318dfba2ba9e1ffb03e14c87c20b9e07
MD5 0c5821753627c11f00c69f1fbeee9f93
SHA1 23a4e2f6a182de21247578e986ad5aad075babc4
SHA512 0f1a99f1fa694c0461d1bad71b6f15aba0601f95f7064cb91e51bfcd24f95eb13f207df39bda38f71110e2103fa5953184276658e073daab74de248302ac7efe
SSDEEP 6144:/mRQcGd8M71vyqA/oQxMfGNF9IzTsnT8RuDaYT6s:/PrOM71vyqOo2VFuzgnT3l
TLSH
T193742924D3D46901DB7F913CC2938214E071A6A353D1D2CF4AE4DE5A9FDBBC1B2762A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Management.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\System.Management.dll
Size 812KB
SHA256 fa2dda07f6e09ff70aaa1f38c4f3a8c3493d1eaa56bb55ae1ea2fb87f5286c0b
MD5 a6bdc9910ef9f159f5200724f42a9e5c
SHA1 d66392bc031da4c1026455e40db96784833ef1e4
SHA512 c232ea419877dcadd89d29d509b05d2fc1a00023cb01e2a84a5f5300b5218b8a47d36be1395b474dea6f2c93adffc512603e8a4cc9b5f91795059e63f2a25e12
SSDEEP 12288:QHiDARR7XoBkadMwcn8/zUJkDI+FutfbJcMFUYNLPmBzwHdKIUXwyQi/:aP7XAk0Me/o/+FutfbJcMFtmVIUXwK
TLSH
T1460539185BE00955D33E9B7CC1268403FEB0B95B533996CF4890FCA92B977829277A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yeahgosuckmydickwiththisblacklistshit.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forza.Mod\Jz+Xozt8lQ2Ytq0Cw5KypiadaYqR4+o=\yeahgosuckmydickwiththisblacklistshit.dll
Size 952KB
SHA256 3f185c4f587e367dd50afa2b919e3535818e3977a46e9d7dd203b56a72086dcd
MD5 37410f637e7c1a26e6d24c5b80168c27
SHA1 5a0d9eab4489be243e368d19a1d658bd635490e4
SHA512 cdc63b4e0fbd850a709e515a3f9d2869a32e836056a77c01ad3b67f52380582ecc70998b276a89a5de9bbf4fa26aef036c0989f57929e0bea4efa9785aafa3d9
SSDEEP 24576:vQsZrr9Aez0jJXhw2SxH58iZH03saA1V9xZ4aZz:Hrr9AezSJ0H03saA1V9xZ4
TLSH
T1E1259D0963600E16CF2FDBB9C2264829F672A1075B39D2CF45DDC4ADAF4A7D29376213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4984_1862899668\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download