d841bd3e0d1678b30e9c13fea3334b5abfa677e69ee6f64d5735faee1bb35b64

Analysis

user interaction
yes
max time kernel
1799s
max time network
1781s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LionInjectable.exe
Size 275KB
Sample260705-wam22aev9y
SHA256 d841bd3e0d1678b30e9c13fea3334b5abfa677e69ee6f64d5735faee1bb35b64
MD5 c434a2d8f65eb6b7beb1e8b3f44f9914
SHA1 e66bd5ab95f1f026dcb476b6288d208d844ccec9
SHA512 5f7579109e6c9b03497f15cb1611a9ebfb9929ff6dec40fd5ee81f624632ab350d3122ead9d22384e2def5c1d1fb68caac6cd5e6a0f8ec37919dd2368642c567
SSDEEP 6144:fs30FtPZiOdsa+xF6qQCHxoEwn6IjMMxds1oqMZHuAx9CnuFB2539kWQvNpuv22R:vqt5nlv22i8X
TLSH
T1B2548B1ED242296DF23B817DCAFB5952F9627C0C03D1C9CB13A199E81967EEC477A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
83	1712	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
1564	vc_redist.x64.exe
2704	vc_redist.x64.exe
5312	VC_redist.x64.exe
5804	VC_redist.x64.exe
3996	VC_redist.x64.exe
4532	VC_redist.x64.exe
1476	VC_redist.x64.exe

Loads dropped DLL 7 IoCs

pid	Process
5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
2704	vc_redist.x64.exe
5332	VC_redist.x64.exe
4532	VC_redist.x64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
90	2164	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5961fc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A32A96D37194AD3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD291DE62E978294.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A1C.tmp	msiexec.exe
File created	C:\Windows\Installer\e596224.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59620f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51F4162FDDA5A202.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF44DD7A7B18EA727.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6557.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF14CF002099B8AC68.TMP	msiexec.exe
File created	C:\Windows\Installer\e59620e.msi	msiexec.exe
File created	C:\Windows\Installer\e59620f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C02.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF252457296B1F88BC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5961fc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF646B4C0C9879A6BD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD92EAC259AE4CA91.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1712	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5824	TaskKill.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277470317594471"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\freesmlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\FreesmLauncher\\freesmlauncher.exe\" \"%1\""	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\curseforge\shell\open\command	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\freesmlauncher\shell	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\curseforge\shell	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\curseforge\URL Protocol	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\prismlauncher\URL Protocol	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\prismlauncher\shell\open\command	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\PackageCode = "51C7A0D0D899AA345AE972FBABA82567"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\curseforge	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Provider	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\freesmlauncher\URL Protocol	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\prismlauncher\shell\open	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\ = "{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}"	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\prismlauncher	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5604	LionInjectable.exe
5604	LionInjectable.exe
3440	chrome.exe
3440	chrome.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
5312	VC_redist.x64.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
2164	msiexec.exe
3440	chrome.exe
3440	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5604	LionInjectable.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
2704	vc_redist.x64.exe
4532	VC_redist.x64.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe
3440	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 5012	3440	chrome.exe	81
PID 3440 wrote to memory of 1712	3440	chrome.exe	82
PID 3440 wrote to memory of 1384	3440	chrome.exe	83
PID 3440 wrote to memory of 1384	3440	chrome.exe	83
PID 3440 wrote to memory of 5460	3440	chrome.exe	84
PID 3440 wrote to memory of 5460	3440	chrome.exe	84
PID 3440 wrote to memory of 5164	3440	chrome.exe	86
PID 3440 wrote to memory of 5324	3440	chrome.exe	87
PID 3440 wrote to memory of 5164	3440	chrome.exe	86
PID 3440 wrote to memory of 5324	3440	chrome.exe	87
PID 3440 wrote to memory of 5908	3440	chrome.exe	88
PID 3440 wrote to memory of 5908	3440	chrome.exe	88
PID 3440 wrote to memory of 5428	3440	chrome.exe	90
PID 3440 wrote to memory of 5428	3440	chrome.exe	90
PID 3440 wrote to memory of 5408	3440	chrome.exe	91
PID 3440 wrote to memory of 5408	3440	chrome.exe	91
PID 3440 wrote to memory of 5220	3440	chrome.exe	92
PID 3440 wrote to memory of 5220	3440	chrome.exe	92
PID 3440 wrote to memory of 2056	3440	chrome.exe	93
PID 3440 wrote to memory of 4648	3440	chrome.exe	95
PID 3440 wrote to memory of 4648	3440	chrome.exe	95
PID 3440 wrote to memory of 4004	3440	chrome.exe	96
PID 3440 wrote to memory of 4004	3440	chrome.exe	96
PID 3440 wrote to memory of 488	3440	chrome.exe	97
PID 3440 wrote to memory of 488	3440	chrome.exe	97
PID 3440 wrote to memory of 4688	3440	chrome.exe	98
PID 3440 wrote to memory of 4688	3440	chrome.exe	98
PID 3440 wrote to memory of 1920	3440	chrome.exe	99
PID 3440 wrote to memory of 1920	3440	chrome.exe	99
PID 3440 wrote to memory of 4316	3440	chrome.exe	100
PID 3440 wrote to memory of 4316	3440	chrome.exe	100
PID 3440 wrote to memory of 3032	3440	chrome.exe	101
PID 3440 wrote to memory of 3012	3440	chrome.exe	102
PID 3440 wrote to memory of 4820	3440	chrome.exe	103
PID 3440 wrote to memory of 4704	3440	chrome.exe	104
PID 3440 wrote to memory of 5920	3440	chrome.exe	105
PID 5920 wrote to memory of 5824	5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe	106
PID 5920 wrote to memory of 1564	5920	FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe	108
PID 1564 wrote to memory of 2704	1564	vc_redist.x64.exe	109
PID 2704 wrote to memory of 5312	2704	vc_redist.x64.exe	110
PID 5804 wrote to memory of 3996	5804	VC_redist.x64.exe	120
PID 3996 wrote to memory of 4532	3996	VC_redist.x64.exe	121
PID 5312 wrote to memory of 2540	5312	VC_redist.x64.exe	122
PID 2540 wrote to memory of 5332	2540	VC_redist.x64.exe	123
PID 5332 wrote to memory of 3780	5332	VC_redist.x64.exe	124
PID 4532 wrote to memory of 1476	4532	VC_redist.x64.exe	125
PID 3440 wrote to memory of 4028	3440	chrome.exe	127
PID 3440 wrote to memory of 3800	3440	chrome.exe	128
PID 3440 wrote to memory of 3800	3440	chrome.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LionInjectable.exe
"C:\Users\Admin\AppData\Local\Temp\LionInjectable.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8b92c728,0x7ffd8b92c734,0x7ffd8b92c740
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,14181647716989542946,2412966793661903337,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,17890645238731818041,4958184370188622289,262144 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,565151149117692572,15571055230370266371,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1812 /prefetch:13
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,9198822574636570264,16145486302875109514,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,15643956373596176335,7920403520569971916,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,16157984746051257921,9970720395502673922,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,14714881473909402911,1828440674494732881,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,14660080929033737800,13209327904317270779,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,8067706333158087302,14393168125929113976,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8828935144153366640,1894511312264313031,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5760,i,13106721498141316905,3689882604239748055,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3604,i,423522303046331325,6294834987493560134,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5568,i,17636173910147745991,17142532812268923477,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3308,i,3753305345005157836,14814454625121472259,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5940,i,10716959234157358462,16043607790659546205,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3276,i,8923541604738983858,9846972467058322796,2097152 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,4065924299082866626,18360876878217357841,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,5682640268663361516,12551854866248005921,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,17032000464554098876,11244866094583613785,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,8268228912421765142,4209260725932413547,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:4704
- C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
  "C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\TaskKill.exe
    TaskKill /IM freesmlauncher.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5824
- - C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe
    C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\Temp\{BD609931-F3B8-4278-90D5-B5BAD2238332}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{BD609931-F3B8-4278-90D5-B5BAD2238332}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=760 /install /passive /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{350CB323-24C3-4AA6-992A-3E81186F7B49} {AE98C483-5A53-4EC8-A8B3-B5F295EAF3E0} 2704
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5312
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{C8F3EBE5-2B7C-4DBE-B243-B4F7029C6ECD} {A49BB408-E2F7-43BA-80D7-1A94836CB8F8} 5312
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=616 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{C8F3EBE5-2B7C-4DBE-B243-B4F7029C6ECD} {A49BB408-E2F7-43BA-80D7-1A94836CB8F8} 5312
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5332
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9AC72100-0539-4177-A5E2-6380E8681F6D} {955D8376-C238-43A3-B3EB-5A25A7D176EB} 5332
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5692,i,6946451017128607745,9579848099408597962,262144 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1148 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,15956101635681510293,9531514749398278692,524288 --field-trial-handle=2144,i,11912762234630087046,13398908368867657441,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:14
  2⤵
  PID:3800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4852

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5144

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705184435.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705184435.log" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{31ECFBE3-E527-4806-80FF-E2B61FBBCE8E} {D844B470-BF8C-4CFD-B169-6FC716EED7E4} 4532
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596201.rbs

Path C:\Config.Msi\e596201.rbs
Size 19KB
SHA256 55dcc87df5d0bddc7d792bb30637600b535b504580f39150c040095d09f01a17
MD5 46de124c679be3f1f7f6d5740ba95aad
SHA1 2de94c642448a27ac8176ac581a4682b9b841779
SHA512 a67ad05377fe754125a9fc5a17d0ef537be99358467672d7230d29f0be2327f185c1df8e3c62855d04fecb52793cd7dd3161e99f4cbee7f6f519becfe580e94c
SSDEEP 192:3pRV1kR115dXcFUADIc1f+W+y4+ogPzh7:3pRV6R1TeC81f/cIh7
TLSH
T1C192FC52B680C9D2D8766B30CD671B693BB6DBD5A350438B50DC90308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59620d.rbs

Path C:\Config.Msi\e59620d.rbs
Size 19KB
SHA256 b8ed7e88ef1c4cdb33686f16e1c6b444c42421611a0faa9165ba780989b4766b
MD5 9960919f0c4151c96d3e4b6eb1768c44
SHA1 7f72e44af1057a00f812e25a5e87184e0cd2d530
SHA512 f9f83b59a450f1197e6c1fde079c8c0fd268fc3bb307229efc619d08a3f8557db03ea2562c25c7596032a9ffd6e950fc69aff89a1a87112d2d859fdb77d2b701
SSDEEP 384:3OOGnJXMjZ7Up+BFqiO6VngJq0uJq0GoaOD8Lfv/8c3zMZxq+nNwzQ6R:3OOGnJXMjZ7Up+BFIHqFqx
TLSH
T18D92CA026640C5E3D8A62B70DD4B67253BB5D7CAA355A38B41DCC1308FA77CA7F8D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596214.rbs

Path C:\Config.Msi\e596214.rbs
Size 21KB
SHA256 72a1a066cbedf5755f7aebe6344751cd280e0eae6ee92c018b9524231978fd3b
MD5 248216c360d032117481ad71daae8ec7
SHA1 00f6954b0bcdf49b04efa7be540433eb2a535c92
SHA512 408bab85b09462e62c1d16f7848c3d7a8af3a10a71c227dedeaf3baf10b5ab3e7ecbb09888155273c72722bb3f0352250894eecf85bcf4c698f0329984986e5a
SSDEEP 384:IUR3GR0nAKxNAUhUC7xJjrMNYPzIbSfA0ENIUf4BiTBkP:II2sAKhkmn
TLSH
T1CDA21F03768099E3C86627B1DD671BA53B73D7D99350434B10ECD1388F633C72E9AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596223.rbs

Path C:\Config.Msi\e596223.rbs
Size 21KB
SHA256 f2f33f8f0a2947782d90d37e52a1a5a55938017f548309418f5159aa9e47be02
MD5 dfa7dd307122478cf8bdd9e73df79a18
SHA1 f96c6a1baa9bb3def0cb3e23dff0e22f54073c05
SHA512 58edf9a4ff7860b309241015d321991d7076018b0a342612f01e64c7f8dfad878fd0fb39e1d8f740525361f1b423cd25d4e3d6a55f47afa59354c316e1f7a731
SSDEEP 384:IrqvDIAZxEth/phSYjK4WbJGwazsalckU72eC6jJkE5KJJdUJdsr76c+0dWg:IsDIAZxEth/phSYujbJpTIo2r76/0dP
TLSH
T1ABA2FE42BA40D6D3D8A62B70CD975B2437B5D3DAA755434B00CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 1KB
SHA256 139114104a0e5bce1447f3c19fb1e52b278db8164074fd4379c8d027c21d6612
MD5 b13b7342519045244588771356d05ff7
SHA1 c58afa279ff906646d73a0af851b2d440b40238d
SHA512 f1ecd7dedfd5648aaae4b03678605f78d37bd90e2c536d0091a8754e160546a2cef5e5d0c4d1783be694819325b03f5ddbca1cd5755d1b63f0e5b2c97f281342
TLSH
T1C611AD215FE6501AF3BBAA3179F516281D7BF8120E35911D0082A18A8F33B50DD34B6A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1cf10765c09c4223bce407f0757bebb58aeb13726945db7f25435bc8271cf891
MD5 94c93cc15844c92eed30a8eed10cb69a
SHA1 a0c0cc207e8d44d3920df27fbae2128906d3c19b
SHA512 f91fbc30377e222ebe759bbdf5b5665b50cc2ef8385fdfe0b244a6ac443f60a67c34b1888830db8fb8f00139c1f01f8d8183657758b86d23e29ef556498d1305
TLSH
T1ACE0E5AACC349C7728F9475964544687E74413572A50489F3A3C85484FB5737458AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dcd6f999a8e3e473bf09a2977c0d0d51105ff0e7b42dabe5996243d24b2ad0f6
MD5 d6a6ae6d0492157b8e064e45c4eeed6c
SHA1 0e31bf212995ae5d02f3f30afb9d9e0bef2af855
SHA512 91fb9e23e0d0c0402da2d7bfc8b74056da2e2cabf25c9fc5e3b73ec331d8dd7f3b62803797180d76737c8a5e1167d6672faf788922f701408b892d5c862c11ac
TLSH
T1B4218C6D6243CFC2DF5807B4B4E61520FF2BEF1001152BED4204592676667B02313BF8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 53d8d87b361bdb9fe06a96cd890c206c383fb02117c888e4705fa24da53b1088
MD5 9e4c44afc561a93b7b6cf2a2b80e269a
SHA1 91d4a5bf36ddd70249bd6909a798eeba8f848078
SHA512 be16732d3ad811565b9cb32bc8cf5d9242f4a38e1c956e0e62e2b5712f52bca33e5c464fa1f65685892c9ff17ff1ddc12c7d301653728f27d2e890d65308462d
SSDEEP 192:D87L0A47JC24/KJt1LeDpaIjZc61WaPhI/IEIKEFzI4x0v1fPT6NPGr7Dr81eSKV:D87L0A47JC24/KJt1LeDpaIjZc61WaJ6
TLSH
T13F32C2F7C3E8C56D891156F89B256F1FCE1A2A28432C3D2AC4D8BE4BD3E1471D215A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a714aceb2b4dc7d66f6566214b9b38bd6c74eaae66c0a9165b2d578da61e6b95
MD5 1f04404d746c72d12ccb476777b01739
SHA1 49587922a532550f0c82fa9fc8421523c75c8a17
SHA512 03c179f923c33faed65172b3ddfbea24db5e0bacc1437c3e4bb639dda55d6aab817dbd97b7a45af3ed63867c9d48649fdf75232e23ee365d4c2c2bb48dafdc0e
SSDEEP 192:D0u9trQJJMA+Z3Jkd7eqwfjaIjZEd1WaPhI/IEI2SkZu0vqfPimNPir7DrR1RNK6:D0u9trQJJMA+Z3Jkd7eqwfjaIjZEd1W5
TLSH
T14E12DDF783E4862D891156F4DB19AF2FCE2A1624032C3C76C9D8BE1AD3E2432E15575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 a92653b8625bb662c9b81fca0b810d9b9057a557748bb356cd6321e1335cd1ae
MD5 c10f6d3cefe838c5c2c4b15f69546355
SHA1 748e8fca2b82280381fec33bbadfcdda8763146f
SHA512 16d47116b3d79e482bc24d6cf2ef40de41f7cd0684de70dbaee12aa51e912c7b2276f8fb9756d39f42152f7efcdb5f96e7522bf92c04f13bb7200d5385471417
SSDEEP 192:D87L0A47JC24/KJt1LeDRDaIjZc61WaPhI/IEIKEFzI4x0v1fPT6NPGr7Dr81eSP:D87L0A47JC24/KJt1LeDRDaIjZc61Waz
TLSH
T1C642B1F7C3E8856DC91156F89B256F1FCE1A2A28432C3D2AC4D8BE4BD3E1471D215A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1484543b8e9a2c6493fa18b663b8819269860652c63df05c5cb3d18b88520feb
MD5 35d2df92c7bafa795e157e1e15ac51aa
SHA1 4cc4e6d9c72b1d5eefc4c27dafcb33960acdcc81
SHA512 ffe22e15fefebfb6731a920e48018ae2abb60b17f45927f31590970da5d488dd86be63b7372b9a86f8b326ce9978d1871cbe285d91672163f0b348e8115e855e
SSDEEP 192:D0u9trQJJMA+Z3Jkd7eqwQjaIjZEd1WaPhI/IEI2SkZu0vqfPimNPir7DrR1RNKs:D0u9trQJJMA+Z3Jkd7eqwQjaIjZEd1Wp
TLSH
T12312DCF783E4862D891156F4DB19AF2FCE2A1524032C3C76C9D8BE1AD3E2432E15575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e101df5994a69fc32e8329791bc6629317a626e0d1619578cacc564e47829245
MD5 46070025c3062e3bcc2cc4cc9519d2bc
SHA1 664947568d478ad3bbdb5bbf99e678d8cd3e261e
SHA512 1f866977e4a3275e99a4d1e68ff86de761268a8f39d26b849359203576c72c9fa7ad0c5a52f302d3fd35e576049eb96d9d3925844b148c34be65ea1cf3cadc08
SSDEEP 192:D87L0A47JC24/KJt1LeDpaIjZc61WaPhI/IEIKEFzI4x0v1fPT6NPGr7Dr81eSKR:D87L0A47JC24/KJt1LeDpaIjZc61WaJO
TLSH
T13D32C1F7C3E8C56D881156F89B25AF1FCE1A2A18431C3D2AC4E8BE5BD3E1471D215A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 bbb4240234d4019995264776826af096e2d650d7d9ca216d6807c4d9b83efd00
MD5 c7742eb4fec75ddb67f18df9e017a118
SHA1 ee41e2579a60e37a64a66289945928a5c7da77e5
SHA512 7b0ac66a8e5efb09804c0bdebfa50a975ab34b06913ae218144b2dae0c61d8bade487e5c77f9ed7f4bd0432469927c76e9e0f79b70122c9ecfa6bb7499cf3c88
SSDEEP 192:D0u9trQJJMA+Z3Jkd7eqwQwaIjZEd1WaPhI/IEI2SkZu0vqfPimNPir7DrR1RNKA:D0u9trQJJMA+Z3Jkd7eqwQwaIjZEd1WZ
TLSH
T1F612DCF783E4862D891056F4DB19AF2FCE2A1524032C3C76C9D8BE1AD3E2432E15575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d20b1cd00130cffe716b6ef10d65b0f0cb5206f2966ad2a5d51e8d94b76b84f9
MD5 f7856b9edf70756b08174c979b45c4a1
SHA1 923d774979d407fb5c10fc454d68fe6d4e8dce27
SHA512 0e5558e6f36ac452a3cc856e86b5f97fe6decf09da650d545b36494816fc7ea75cb3617420ab80984745354cb381c6fe0f6a22450d9478824ff39b8d19ea6252
TLSH
T16E2178A7A6BFB41B207C496F1D147D091C7BB43702519CE9DAE6C26DE0C60FF1B260A2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5df4afb1a7a9d9760dca501c5058b04e9e5a513fbd9d222598c162d700f3e3e8
MD5 1e7983a8d7a7f192641419d1c5882c9c
SHA1 15753af0d8d6fc85fecd504f8b2cfb4460a4ce4c
SHA512 99805b4646f9662473f92937d7db8db9b0dfb2e5aed6af4a184c6f80cf9aebfe351152fd2e2cee8f792c7fa44d095d8d3353b1f0064e4a00938a36ea2e01f2ae
SSDEEP 192:ORAMNcBzu2ZTOsEGzz2GrHXv7+pAPRp2/dm9wHsb+WNnqe4QQ2ZELBkwKlVyIsnH:ORXNmzu2phEGzy4/6UXlOwzY2mVE8
TLSH
T16652F92FBE64663B5CDBC229FD25B753D7F1102121941E84EAFC8A1C25D7ACC222712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6ab2363a84f0f9d3dfac702c9988191a3a90b2cf8cc60c6de6e1d56d7b2fa0f7
MD5 ebc9cde76a3185699ce3011503cfc1ed
SHA1 4451988d28940256dd63b9c793d513f24feeadf3
SHA512 754ced94f3bb6173be9c9d61cf8aeb0faa06681a56faa6e1365c52743cd5125ab32c19f9e34d6e98af068258798ae15ad12755057546abca68e1cb8fcb262299
SSDEEP 192:ORAMNcBhu2JTasEGzz2GrHXv7+pkPRpi/Fbt9wHsb+WNgzjqe4QQ2G1KELBkwxlM:ORXNmhu2ZdEGzy4/6YXKOweY2G1LV9e
TLSH
T12B52E72FBD64663B5CCBC229FD25BB63D7F1102125941E84EAFC8A1C25D76CD221712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0d880ff5656c26c3b19f5f9b0afed55019c1bc3b4c1aa594d8377f93b65ef209
MD5 e02a8a45ce53636f4d970cba55fdb450
SHA1 605c1b38450a28f3d4ce321f10ff7573d4766d00
SHA512 604327d8210a5a181a3e9327f1681cf7c0efd09be1b05292f8d349d55ef742b979e9797d9887124e3e56561d58046520ac585b20eb3600cc0dba7627c2e5df7a
SSDEEP 192:ORAMNcBhu2JTOsEGzz2GrHXv7+pAPRp2/Fbt9wHsb+WNgzjqe4QQ2ZELBkwKlVyt:ORXNmhu2ZhEGzy4/6UXmOweY2mVE8
TLSH
T10352E72FBE64663B5CDBC229FD25B763D7F1102121941E84EAFC8A1C25D3ACC221712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0ff2f532cdb1e9087e32fa99e457172d3b7516d1003f7ed10570e3bba49fceb4
MD5 e08afa3663735a2b8901a5efdae8ba21
SHA1 fd94f2d78f8f64904fe474e4acea0d88a11263d7
SHA512 9eb84e854547c960c650077108ef7fa8f2a7c0b7d825171b7cebae828c1d4e4ec0c7e2dc6e53c8eeb5814ab14014182438103ca47d12e03d3e69669571686183
TLSH
T1D4B01240C001A542C00A02F4194218CC72649F20D70A174143F0A92288251508324051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3c6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d3c6.TMP
Size 96B
SHA256 e15935218196457c5f171eda5f3e6113e92b804380f98c1021108a2f5d0950d9
MD5 500b681b8b5b273cf70004e2ab65cd1a
SHA1 1f2e16b29ab50ad21a52401256eebe253182bf85
SHA512 11f54bfc18f18c80374f87d8fcc36b342a749ba7ab7d72cfb78bc8e61f2ead5bc39fa56323170852a509bd189daf316dc03da2fc4f50526b23e2a3b13a8ba173
TLSH
T11AB02280C0022222C00203B2A88088C83020CF32C30302838AE00AB2CC282B002282A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 92d6e1884437aaa24723d8c5875e18551c23a1a38edb273d41fa989e1a67de36
MD5 047e87ae6e242722609289508a3b0ab2
SHA1 6a9b9f408ba631c74409bf06aaf278c4ff4648ca
SHA512 3946c9de6a063b7c49abdc27e05300d98674654701a9b6c1e87cf9c1869ecb9d6904c0c7e1898386cc8c0250595dbd04c704de2e705b1e30dc5b34fb1ed6011c
TLSH
T114A0021002C04D01EA4427B5128255EA77A44C115746A35F44A49384DD726467747604
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 74722f8e6e94a389dd03bc25ef4d518774ca25b93b1179d8a4218882bdff70ec
MD5 672448c4903e610cc8c20107205b75a9
SHA1 e968a4d895496d792117e757a419fc40e3b11585
SHA512 1825fe154aaab085111e53238cd72afec83fd93f9e51e4af4a16b6efc625f5f119cfe522f70613492071abf6194846f496d8938b1e32f145f660ddf39c207bc7
TLSH
T148C02BE31831808F0730F9D9101C751DE02F451D8CD0CCE8A404004625BC9338441FB9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590bae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe590bae.TMP
Size 157B
SHA256 01296f3012e14a4c33029b9a9097ec8d835db947ef743998dd0125df801ec820
MD5 fb8d48e14dbb6e8acc12addc484d5e5d
SHA1 30072e1853476b8fe3043047e90d3fa22058a3f8
SHA512 cfb605740fbd40509a071e60da1958ed9e80379ace3e0947e7b8037d0b921dc3854eb8be9067ef60da46a9b0a115b139215e1e95c6d32aa9a15f8cc49c00fb29
TLSH
T164C08CE31931408B4731A5D51028750DE46F4C3E8CC0CCE8D405300625789238440A79
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1e2d6d9a19756594fcfe5ef07cc67872e503bdf8839c26c925efd6b3b6512d0a
MD5 ee9d560ad1b69107de896819ab0f1ed5
SHA1 304e70adf3ae099448db908b159b886321e9f590
SHA512 c6e6d272f6127503be67f99423f7293af8178f43a94ab18d702cb43cdc67dd0d2a4408e56098c9934bb6c9ece0f744b88ba8f60ed1019166ad9b95691525ff77
SSDEEP 6144:96P8pYw80nubFS/sBNxqWDfxA3OnjrYQ9EU0/hEr:96ENBUDZ7Dfxjjs+Ck
TLSH
T1EA3423913C25BE7A1DF8FE68BC013E6ACFA45C598143EDD36AD81F8D20F524921789B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 a34d352e0c3ed41656e850521aff24cb7aeff3cde63b4cb2bcd6dc91c13580c1
MD5 b74d05ff34bcfe3c2a43f8fb216df8c9
SHA1 c69cab1c228973eac7e5c38e11173d5c32704c99
SHA512 a53aa83e94130660760b9b107df4773ea9e4f9f8e0519d39265ea307cf6f6b67e6c90bca32bffcac69e20afc99099824ecd848f4508443e87f44f1aa2d15da94
SSDEEP 6144:mGP8pYw80nubFS/sBNxqWDfxA3OnjrYQ9EU0/hEr:VENBUDZ7Dfxjjs+Ck
TLSH
T11D3423A13C217E764DF8ED6CB8013A6ACFF49C5AC143DDC7AAD81F8D30EA1485569870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 2e598106317e606351537da9542422ac6b3779a476dbc7250a1e5c8a6f6b9e18
MD5 628c4823535888839ddc3c782c3a9c51
SHA1 86fc5b2f3ac33b5df0f5222dc44452b38949533a
SHA512 2574066fbc11ad29c00dc62ea196adf59de3950855e813f3a5eb84f2874aa0482a1cd80d97313567bc2d6322df03ea05dd5cdfce61cdbe1542b13d381216e2d1
SSDEEP 6144:+GP8pYw80nubFS/sBNxqWDfxA3OnjrYQ9EU0/hEr:tENBUDZ7Dfxjjs+Ck
TLSH
T1203413A13C217E764DF8ED6CB8013A6ACFF49C5AC147EDC7A6D81F8D30EA14855698B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 60777de6d3f7ae4263d4bcf4b7dd1475c1f25ce6decedbd24aec79b27ebdd91d
MD5 e37cf0800d2f0e3507df2208ca8d572c
SHA1 deb58bb80daed95ae70d93033486a3e6b234021a
SHA512 d94951282a813721a8e69deb943c3b3db3bf51f3a14f0859e502093609d5569ad94ec86b81d7c8f001a41a050f29ae73ac2152077e69f2357e9661fd880f8811
SSDEEP 3072:wzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:eWDfxA3OnjrYQ9EU0/hEg
TLSH
T157C302A15D39BD660CB8EE95744C3F60BFF4AC9A91879DC362E91B4C24FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9997e83247c7c23c6daac645c81e250b867e1e1ba4187b90567075d40e29f5d2
MD5 74c98fae9af3c85891b63156d33a8d73
SHA1 df4178731e4a69ba75f53ca49d1fdcc4bc6d1629
SHA512 22bf79a03f49e7715a38f54380c074036aa2c3e994f29da6359aef32b843a65018845b62c9e31265f0672e72c76b11612c9a89168dcb5ff4b82cbd06c903eb1b
SSDEEP 6144:56P8pYw80nubFS/sBNxqWDfxA3OnjrYQ9EU0/hEr:56ENBUDZ7Dfxjjs+Ck
TLSH
T1043423913C25BE7A1DF8EE687C013E6ACFA45C598143EDD36AD81F8D20F924921789B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\uninstall.exe
Size 140KB
SHA256 d1943c1e4f72ea89927d5daa37c4807f8a0ec8e3f077cb54ece8e581ac01e6b0
MD5 a7f28268da74a382911fcbc0dfe1484e
SHA1 2a6e56e93bf14b8a722b97aefb688eb7b1b937de
SHA512 cd570a859e6f2ca4412802e02b274b792a380b0f6b3f00a2f7d39fc51989db857b542553d4518d6775b1514689cf391ef291b172f42fdee1dbce1e4bf5c8a11d
SSDEEP 3072:Hfr3k+o5buDC1cuMXw0eAWrsXVeyLjki7glok8melSj1:HfY+onA5WIleqpkln83lY1
TLSH
T10AE3CF18B3D0C425E07905309AF7CBF36B72F56116159F47BB50A72FB8A1A45EE2A383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Programs\FreesmLauncher\vc_redist\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260705184435.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705184435.log
Size 19KB
SHA256 f451da96ccbd24770cba93f65c9afd4df3d0f5d830be13c261879f3de523ced2
MD5 c243821ee4c1a7974fb9c6318375e419
SHA1 dd7c54c7e77df695613e190de338affcc5659275
SHA512 7dd844ba4bdea832c8649c32cda735476ef26e162ae39684a2a165d35bb5a439a18a7051260f8938ac33ed3fb74f6cfe6081c6012e7133385a3caa507821b475
SSDEEP 192:oCBbEizxJ7BqzP+3nnQrG1JV1Jb1JY1Jk1JL1Jx1J21Jq+q+QoRd2GOOJa/azzLT:R9JH/yLlb1flhCnFGhrvWLy
TLSH
T1F0924213B5B4D53C2C91869594EDE9A2D3A4B088AF0411B077B5534C83DBAFAE7CBCC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260705184435_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705184435_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 e05b7840609fac237ef5a5cee30d46ca806592771e6615fd7ae44a96c20562c5
MD5 805a04ce5eb4dc7a79bb84c6615ba881
SHA1 66b367a1d3f579f536f36a6a739857b7e662a353
SHA512 bc6550ed7a576234e8eda5e596b2fdafbf183e0b16c201f1afef43a3315fc7172d3cba54bf65e7a3e9ae96f5aa2e499fa665c0101660dbcf69fb1a56ae860089
TLSH
T194413D651AE80A07F5B757879EF7C0921F33FDD2A835CB0C5385421A0667C05AD7C76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260705184435_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705184435_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 377620f5ef0578730852850941848ad690314fd32b2e081a097f7beb19c17cfd
MD5 70bed29c2640b6940c852ff347abd687
SHA1 138b34fbe7397d133488a429da6a8af1d1233adf
SHA512 e3c0f3c495eae9b4eacd11111b40806e8266ef0bc4fc02f1230c3fba92d48e4f979e78dc3478da4f9d7ad465c01198e9733004ef8c4ad3544be4e34308871014
TLSH
T18941F6151AE80807F6F69687DEF7C0921F33FDE2A835CB4C6284421D066BD05A87E76A
MD5 SHA1 SHA512 TLSH

Submit Download

NScurl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf110E.tmp\NScurl.dll
Size 6.0MB
SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
TLSH
T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf110E.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsf110E.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf110E.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf110E.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe

Path C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe
Size 27.5MB
SHA256 742f073b91cd54709edacfbc17655c7605664d047ac7f412d7d01c5e62bbbc1c
MD5 56cb5ff4c1968c94f8cf37de5032d9aa
SHA1 43230c92b9bafae3f963604e2fc98cce161f6633
SHA512 e1b37db3bc05665da91d40dfd7d584537b0b6c95a23c913980378d04e4b3b4afa288e1cb8ea59e38c368c7f0ee656687e0cf1d988a613a80131df104889fbc87
SSDEEP 786432:/5Ig7KyB9dhizk8D9CcsaH0hSxdLIwKpeR:/ig+KGzjgc4CKwR
TLSH
T1AA57330DDA95E391D50C4D700B775BCA339E90A565EB2777BB702A353282623C2B1BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\FreesmLauncher-Windows-MSVC-Setup-2.2.1.exe:Zone.Identifier
Size 1KB
SHA256 b3175aa7d858c0cf33cb429b84c51a326888739a11279f04c6ea9e0167296184
MD5 50f5050b01642ae94964bb4e7cc12e5a
SHA1 becfc1bf1f91e8ecc082d0442bdb59900b399827
SHA512 14c58b2c6717803a8c723933cfddd76500df3441421adc3ca51d97eab33901fe6d82c8a4115ddd7efa4ea3b79b0b88eef471e04bfbd5221ed0fce1cfcca1c503
TLSH
T16711A5E7E02A681E6B266951958DC9EED027B487874A050D0232D18CC2840BFE0F683F
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{8C8325E3-82C8-4315-8480-04DAAD0C57D9}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{8C8325E3-82C8-4315-8480-04DAAD0C57D9}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{8C8325E3-82C8-4315-8480-04DAAD0C57D9}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{8C8325E3-82C8-4315-8480-04DAAD0C57D9}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{A5BE9B65-E74F-496A-9AC6-DD236126DA43}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{BD609931-F3B8-4278-90D5-B5BAD2238332}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-646-0x0000000000CE0000-0x0000000000D57000-memory.dmp

Download

memory/3780-643-0x0000000000CE0000-0x0000000000D57000-memory.dmp

Download

memory/5332-645-0x0000000000CE0000-0x0000000000D57000-memory.dmp

Download

memory/5604-654-0x00007FFD8F460000-0x00007FFD8F4EE000-memory.dmp

Download

memory/5604-655-0x00007FFD95B50000-0x00007FFD95B5C000-memory.dmp

Download

memory/5604-656-0x00007FFD95CF0000-0x00007FFD95D0B000-memory.dmp

Download

memory/5920-458-0x0000000073930000-0x0000000073F40000-memory.dmp

Download