hxxps://mega[.]nz/file/pWInHAzC#V_siI4oRmI626-oZceJyIdeqK-nDnP0yx7rpeVcsVr4

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/pWInHAzC#V_siI4oRmI626-oZceJyIdeqK-nDnP0yx7rpeVcsVr4
Sample260708-sbjt8agy6s

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279962307163658"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{EC7C857D-EA3F-4490-BE35-B6C8AB1053EC}	Game.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{8EEDF5CF-8F8F-4E93-BCD9-68BFA36E46D6}	Game.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{335B0640-4A6D-491B-B6F2-88A57200FAE5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{A87DDA9C-F673-49EF-902B-2FE57B9EFBD4}	Game.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4108	vlc.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2212	Game.exe
2212	Game.exe
4584	Game.exe
4584	Game.exe
2296	Game.exe
2296	Game.exe
5288	Game.exe
5288	Game.exe
5316	Game.exe
5316	Game.exe
5324	Game.exe
5324	Game.exe
5144	Game.exe
5144	Game.exe
5532	Game.exe
5532	Game.exe
6104	Game.exe
6104	Game.exe
6116	Game.exe
6116	Game.exe
5844	Game.exe
5844	Game.exe
1836	Game.exe
1836	Game.exe
3972	Game.exe
3972	Game.exe
5672	msedge.exe
5672	msedge.exe
6100	mspaint.exe
6100	mspaint.exe
4600	mspaint.exe
4600	mspaint.exe
3060	Game.exe
3060	Game.exe
6128	Game.exe
6128	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5900	Game.exe
5900	Game.exe
4180	Game.exe
4180	Game.exe
4228	Game.exe
4228	Game.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1012	OpenWith.exe
4108	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	5692	svchost.exe
Token: SeRestorePrivilege	5692	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2296	Game.exe
2296	Game.exe
2296	Game.exe
5844	Game.exe
5844	Game.exe
5844	Game.exe
4108	vlc.exe
4108	vlc.exe
4108	vlc.exe
4108	vlc.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
4108	vlc.exe
4108	vlc.exe
4108	vlc.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe
5216	Game.exe

Suspicious use of SetWindowsHookEx 58 IoCs

pid	Process
5868	OpenWith.exe
6100	mspaint.exe
2752	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
1012	OpenWith.exe
4600	mspaint.exe
4600	mspaint.exe
4600	mspaint.exe
4600	mspaint.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
5536	OpenWith.exe
4108	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4448	2868	msedge.exe	84
PID 2868 wrote to memory of 3360	2868	msedge.exe	85
PID 2868 wrote to memory of 2756	2868	msedge.exe	86
PID 2868 wrote to memory of 2756	2868	msedge.exe	86
PID 2868 wrote to memory of 2756	2868	msedge.exe	86
PID 2868 wrote to memory of 4384	2868	msedge.exe	87
PID 2868 wrote to memory of 4384	2868	msedge.exe	87
PID 2868 wrote to memory of 3028	2868	msedge.exe	88
PID 2868 wrote to memory of 3028	2868	msedge.exe	88
PID 2868 wrote to memory of 3028	2868	msedge.exe	88
PID 2868 wrote to memory of 2976	2868	msedge.exe	89
PID 2868 wrote to memory of 2976	2868	msedge.exe	89
PID 2868 wrote to memory of 2976	2868	msedge.exe	89
PID 2868 wrote to memory of 3832	2868	msedge.exe	91
PID 2868 wrote to memory of 3832	2868	msedge.exe	91
PID 2868 wrote to memory of 3832	2868	msedge.exe	91
PID 2868 wrote to memory of 1660	2868	msedge.exe	92
PID 2868 wrote to memory of 1660	2868	msedge.exe	92
PID 2868 wrote to memory of 1660	2868	msedge.exe	92
PID 2868 wrote to memory of 5100	2868	msedge.exe	96
PID 2868 wrote to memory of 1616	2868	msedge.exe	97
PID 2868 wrote to memory of 5100	2868	msedge.exe	96
PID 2868 wrote to memory of 1616	2868	msedge.exe	97
PID 2868 wrote to memory of 2568	2868	msedge.exe	99
PID 2868 wrote to memory of 8	2868	msedge.exe	100
PID 2868 wrote to memory of 8	2868	msedge.exe	100
PID 2868 wrote to memory of 2496	2868	msedge.exe	102
PID 2868 wrote to memory of 2496	2868	msedge.exe	102
PID 2868 wrote to memory of 4160	2868	msedge.exe	105
PID 2868 wrote to memory of 3528	2868	msedge.exe	106
PID 2868 wrote to memory of 2508	2868	msedge.exe	107
PID 2868 wrote to memory of 3180	2868	msedge.exe	112
PID 2868 wrote to memory of 3552	2868	msedge.exe	113
PID 2868 wrote to memory of 3180	2868	msedge.exe	112
PID 2868 wrote to memory of 3180	2868	msedge.exe	112
PID 2868 wrote to memory of 3552	2868	msedge.exe	113
PID 2868 wrote to memory of 1960	2868	msedge.exe	114
PID 2868 wrote to memory of 4160	2868	msedge.exe	118
PID 2868 wrote to memory of 4160	2868	msedge.exe	118
PID 2296 wrote to memory of 5028	2296	Game.exe	123
PID 2296 wrote to memory of 2212	2296	Game.exe	124
PID 2296 wrote to memory of 4584	2296	Game.exe	125
PID 2296 wrote to memory of 5288	2296	Game.exe	126
PID 2296 wrote to memory of 5316	2296	Game.exe	127
PID 2296 wrote to memory of 5324	2296	Game.exe	128
PID 2296 wrote to memory of 5144	2296	Game.exe	130
PID 2296 wrote to memory of 5532	2296	Game.exe	131
PID 5844 wrote to memory of 3756	5844	Game.exe	133
PID 3756 wrote to memory of 2148	3756	Game.exe	134
PID 5844 wrote to memory of 6104	5844	Game.exe	135
PID 5844 wrote to memory of 6116	5844	Game.exe	136
PID 5844 wrote to memory of 1836	5844	Game.exe	137
PID 5844 wrote to memory of 3972	5844	Game.exe	138
PID 2868 wrote to memory of 5672	2868	msedge.exe	139
PID 5692 wrote to memory of 6040	5692	svchost.exe	146
PID 1012 wrote to memory of 4600	1012	OpenWith.exe	149
PID 5536 wrote to memory of 4108	5536	OpenWith.exe	153
PID 2868 wrote to memory of 224	2868	msedge.exe	154
PID 2868 wrote to memory of 224	2868	msedge.exe	154
PID 2868 wrote to memory of 2700	2868	msedge.exe	155
PID 2868 wrote to memory of 2700	2868	msedge.exe	155
PID 2868 wrote to memory of 2732	2868	msedge.exe	156
PID 2868 wrote to memory of 2732	2868	msedge.exe	156
PID 5216 wrote to memory of 5440	5216	Game.exe	158

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/pWInHAzC#V_siI4oRmI626-oZceJyIdeqK-nDnP0yx7rpeVcsVr4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7ffb804fc188,0x7ffb804fc194,0x7ffb804fc1a0
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,13251425920287244330,16518740457695160175,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6133532677584244336,11763939186120276868,262144 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,11529974298976320421,15399817617832976703,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,18032638114136312080,6666174718139886157,2097152 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7370783918616840323,6649197232052782688,2097152 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,16039249190827258356,2952488988990153771,2097152 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15860482786944325140,920462146470054541,2097152 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17159661839164309664,11881453940495013494,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4701371031902926298,5003229844346451945,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15008844498894683575,15017432674676235310,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15008844498894683575,15017432674676235310,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,5179447270282266411,6852782827560757698,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,887985306867996981,16808819332752051354,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,11939876221236071498,111603672564297976,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,10828943484731373601,15176722243508105428,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,2414751602922529022,9663340300027666433,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5292,i,9935665248821402021,6802526066357699091,2097152 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,6325264142811742141,7389497726437894508,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,8687881482055876142,11736856829860243820,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,3756046678859249659,11621052834919917735,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,13631464087021716527,5023106194291214553,262144 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4976646888795922433,2874353352879864302,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,625974919335891712,12668553167585348248,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3268,i,10303743078059623332,5574092107411967661,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10600983989569426570,8975323032898588776,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,2057984613031398032,14048503079791030322,524288 --field-trial-handle=2252,i,6442320254484765730,17674313066175025462,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4344

C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
"C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x228,0x22c,0x230,0x1fc,0x234,0x7ffb703e6ec8,0x7ffb703e6ed8,0x7ffb703e6ee8
  2⤵
  PID:5028
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=gpu-process --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=1848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13877934886798525190,11775000429694173639,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5532

C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
"C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x200,0x204,0x208,0x1dc,0x20c,0x7ffb703e6ec8,0x7ffb703e6ed8,0x7ffb703e6ee8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
    C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x1bc,0x1c0,0x1c4,0x140,0x1c8,0x7ff75bca1f30,0x7ff75bca1f40,0x7ff75bca1f50
    3⤵
    PID:2148
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=gpu-process --field-trial-handle=1800,3756064143742937110,11837972306051929862,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6104
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,3756064143742937110,11837972306051929862,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=1864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,3756064143742937110,11837972306051929862,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1800,3756064143742937110,11837972306051929862,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5868

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\img\characters\!三頭身対応ドア.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:5244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\system32\dashost.exe
  dashost.exe {fa24f5c0-d0f3-47f7-8015ad72ca62cb96}
  2⤵
  PID:6040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\img\characters\!三頭身対応ドア.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\img\characters\!三頭身対応ドア.png"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4108

C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
"C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x208,0x20c,0x210,0x1e4,0x214,0x7ffb703e6ec8,0x7ffb703e6ed8,0x7ffb703e6ee8
  2⤵
  PID:5440
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=gpu-process --field-trial-handle=1636,14265884237622086989,5719969842890633985,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1656 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,14265884237622086989,5719969842890633985,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,14265884237622086989,5719969842890633985,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1636,14265884237622086989,5719969842890633985,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe
  "C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,14265884237622086989,5719969842890633985,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\Downloads\Zin_Episode01\Zin_Episode01" --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

5992337e-11c4-4c08-a62b-ac5b71d34008.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5992337e-11c4-4c08-a62b-ac5b71d34008.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7a3e7d5da441b5fa54a24644e2f11ce0c553df1757a12a27e27761ac03f0d5e4
MD5 8237769d6d449088538ca5f53a908b5d
SHA1 b2c27a4af9d73a99ec0e718d042feffca09f2ca3
SHA512 ea6dc84fffad644981074b8a3c439da9e4f0c58c90bacf97bce46c4d50dd91c90ff038ccd51e90a7cd75773ee3af20afe8cf635f74fcf4431e0007e6b1636010
TLSH
T148E026E526EAC22ED600B4CB91BC670D83C23B1E93C86D4A67008C94F583990EB875E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 98078ada64aab9ef6ad2636a48269e426b9d348358c98ecbcccac0c5c9579995
MD5 d518d1775e473012b58a92e723e011a0
SHA1 6c37b6476340731c3a2a4cc3ce5fe22e30666f84
SHA512 cf841a412f1fd3725e62cd99890342bb0794d5c2bc2e0f64ea79558b1c9fe634259e9529f2f5f9b69958de749acb8c784e2056406ef212df3a6c6d303eb34952
TLSH
T1C9E0869417C9C7BEA744B54F81AC530CC2E23E2BD7C9798E27448C95B281544A7E35F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 613af315b6f9bd85619e57f93b4e71e5479d471a7b62e32402cafd676d2f50e3
MD5 f1c0a8e22bce71c92efad99fe772c34e
SHA1 4f51fb2693d518d202ca6282321fbab6bdb9004a
SHA512 13e6d8f2dee68ff2b79e2556c7e26e5afc440e54745cbf3ba5e61720edd696dccf5b9ef031567a3d881078c04bd2947345435f2c06e7c3a9eb27cb5789dbca27
TLSH
T186615D8545E27468F3703372E3D2220430B0C6DA4C038C7255946AFED6EABB6BE5DE48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000
Size 2.6MB
SHA256 9c1b653ef61cde065917db8f9e763044a7a7ef5aec3a19eaf6e62512e08b7b2e
MD5 fab33e93a069e7cd9b370bef44fd45c5
SHA1 710cb08787ab420e7c6701a6f08b0ebb9342cb7e
SHA512 bacd3f1ffb1fd7b750e955585078b22709b841afc197de6e79890ac59b40308fde4523fab374e8481db98623b8b10a1c60c8858f64af934eb1cbc918de0bc5a6
SSDEEP 49152:ANFF359YVJI/S8kuvhrC7DP3QRgcR8rBcAyQzZz3aaT3ILC:AzT90I/L/GDP3QRgcarBPDZGazIu
TLSH
T14BD5331581FBF956F0143876883BD40729EEBD2A11F64DD054BBB8D994F8283412BBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 8KB
SHA256 8e1fd4d7fa37ff121253bd34cf352e467269be29eaa32223aa2668da62237ec1
MD5 8b662a761959df9f5501bc2d4d853442
SHA1 72c232ba33820fa990a1acc076a23b5fa024f3e3
SHA512 cf7e48452a7126f0be663a459210a3ce4a130ce0f55f0c79d207d56eb3ab9bff03cbe98a30afee9794542454481a47805df61391b2cb25b56c553a07a213d65a
SSDEEP 96:O6ajNF951Jj1T1YbWn1Ho16TJ1+9eYEKDjdCu4D14dCu61EdCu2:OTNF951Jj1T1Yby1I1qJ13LD1BV1td
TLSH
T129027BABBED44C13E81A4A7527270FC55326AD507D89E41EF0CCBAFC917C651CF601A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 378B
SHA256 7a1b63038fc025b9888e4f906a4e33034867854617c12984a076b21ad265764c
MD5 3b4fd730477501950f5accaf80984a99
SHA1 2bd04ca160a73d2e109d2619d785dfa902a0bacf
SHA512 c3d523c28e4fbd32c5a48b0bfc61ac2d0b66478d26d275f4c9476204c9e28e4a9c85086d86d8c0b39c3b407798cf172699bb3909776d57cff3cea45a4f76b0ba
TLSH
T1F4E02B5452CDC51F66082457812CBB4CA2E73D6BE78A3C492B41D820B646050A6AB1A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 fa2e20b0148ada12c447f7dbcc07a48964879517f0ef15363e9d9ff95cfaff90
MD5 4989e78c848e43d9533c5a66dc79971a
SHA1 4b607bac5f78e4f34e7ac36a79e80828917feb91
SHA512 e664e924dc40497e3b9d226982f26b79dc95458e99e4bcbffea19c2eb69fcca968c421106058c010ce5e811c3189bb823043b4db9b9a8a928ee00ef7843bb13d
TLSH
T113E02B546ACDC11FA95520574168BB48DEE33D5BD7893C451B41C420B643050E6BB1A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 378B
SHA256 a6613c1fcad8a0aefc36429ad081ec824d50bf2b9a3665d6de42e84083108f08
MD5 1ed9a616e235c45ca1338e7f5ef35540
SHA1 ccc92a602b420088873a6e4292f9f8b4da6772a9
SHA512 c23ef4866c6b326ac173e288960085e4051634685f20dd84ac5b5667f09779fb050c6096268c1a5af89aacc9ddcff35c085f4bc56577e6122905d878cb4f4234
TLSH
T17EE0D15456CDC51F66183057422C7B48D6F73D5BD78B3D493B40C464B641054F79F5B2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 378B
SHA256 9e60569e2e573a5bca2793e6de51490a3af5fc2b0a0f3586469578246873c035
MD5 6a7187800d808a584b1fe1d673e29be6
SHA1 e9759c0d224e9254c8af0c4bbd7297518167e902
SHA512 9ea52486a7180d59784ddc1e3614cf56c0f5c2aa34fa9d63f40bb20508afc6951c689d0c21e5d4bff3c82c95db0f25ec7db43bf66e0971f6f4fe75106df42ef7
TLSH
T12BE02B9057CDC51F66182457412CBB4892F73D5BD78A3D492B40C464F643044E79BAB2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 364b6984c7041a45cf25233707bcd8146df25f6124e0ddd0492819ffea281e4a
MD5 148d74f0ddef619d89c43ad6742b7a53
SHA1 a1e986bb2c79c7c767304b5804baa5adf12545dd
SHA512 e2bd7efb136db02fa59419bc302d72ca407055075da9b92cda25bdd0143ca8b7fd42b755b68a678eca8d7ab89c3ef914e1e9bd06aa3801394ce967fb96ffb446
TLSH
T185E0C01085CCC11F564020D64424BBCEC9E3385FD7863D461F82D8247442084E47F291
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0b5ff4340c26152078d0ad1644f56d292c52dbd355a6c31b34daa557085af33d
MD5 c4f0693c3b03f8c7dfbc1bb56616aa86
SHA1 69ec04a762c1eadee6317fa9cf697f62143e1330
SHA512 8597279bbf39ebe31239b3e0a4b2c6b16afcc1fb89b1c260bf7d46454b6b9a059fc13b682c6aba6963842d1c0e01db0c4c9eed314516feefb18089fe5e813a94
TLSH
T1CF319EF783B185AEDE1195F0AA14AE1BCF5C011653AC3C5A86E4AF17A3A3471E101E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d8f8226beef407ae2aa08ee3d4d01a5005c847eda2472b091691754ecc33e3d
MD5 c700419c1ed4fead136bedb641a3c6b8
SHA1 ad91bb60e52a3743bb59270a2d6a159b6a2baeb1
SHA512 77cc37d89f1f13bd94f9859ff96fcf782d114a1968c409cd0f5e742dde334738b0b8f8bf104fede080fb0772d2a4261cfa90f00a6c0bcdf9b1d5a592396ffdb4
TLSH
T1C631BEF783B185AEDE1156F0AA04AE1BCF5C0106439C3C5A86D4AF17A3B3471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8dcc3899ab6b810f17f42b4e02b2a3db73b58f999b5cd9601fb02b2279ab49d7
MD5 c24335a21ed5b166d75136669bb77a6f
SHA1 67c945d9f16456131ef5f7b0e9f4959bbfe76a82
SHA512 449f1e24a2f3fd8584e17b0f97d3b5dd7353f3da7e861411afc1fa0a14bd8ae6d8250429a12055da10a60a027e3c169b4a17b78358a56de1f7601570b8fc3101
TLSH
T16231AFF743B185AEDE1192F09A04AE2BCE5C0112435C3C5986E4EF1793B3071E002E5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32f0b1705771d39287591cd2b9ebe4d719ec3095111ff325e1cc1b10315df201
MD5 24154cd3d611c83aa24a145eb7ec957f
SHA1 4f9d24e6ea55605976cd70355b9b7b6868752636
SHA512 2543cfc3a1265b05807118afd79ef34b9e582a68193bdff5200bf4fe8935a0ae6ab28a501e9e8318499ce6882371460ae1059c42cbcede0cfb6327840e744a01
SSDEEP 384:sxZ0n1l4Mvf/fPzsQLj0z7QbHb3R/QDoWwYx9:suTn/f/P9HbVu
TLSH
T15752E9126A349977CCDBD209B945BF93D5F94563A2900D44AAFCCA0C05E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b2eaddf6da830f169f4435d72cab0416fa85b62b4bf840f8a28760806dabe0a1
MD5 657afd387223acc5a8203fc5768242ec
SHA1 dd749a6227fe1f2ba9ff56d7074209782c0b9181
SHA512 e5fe019eb0d25c4cbf1a8ffff2cd0602677856547baecc7c6e73ac03cbc7e0cdd5a37e0f97920e0baba27fffeda2d07662b1e7a6d7ba5cb55b21c879209ec52a
SSDEEP 384:sxZ0n1l4qvQvf/fPzsvu7Nj0z7ebHb3eZQuDHXwYx40:suJIn/fVJzHb6R
TLSH
T19162E91269349977DCDBD209B945BF93E6F9446392900E44AAFCCE1C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0512224977f2706a3d01f6c068b0dd53dfbea5bd6e5264e98ed75a634e871fce
MD5 8a2d9d11d924a63b84eb02c39f2dc3b2
SHA1 fde29b5753feae0db6530147fd11a8b2a51b3b11
SHA512 cc1c087cfdf0c2bc008b8579aadd8ee900c9209e949f8c88658705386b3b4cc503d5026073b162c2c345b40a097b7d83fcc13524251421580ce275ffafae7e8d
SSDEEP 384:sxZ0n1l41vf/fPzsvu7Nj0z7QbHb3eZQV2WwYx40:su2n/fVJ9Hb6c
TLSH
T18152D812AA349977CCDBD209B945BF93E5F94463A2900D449AFCCA1C05E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 3d8ad170d4740fe77db525875e4bf85657cc2f5d90d2c319e7f3479e7cd11960
MD5 6ac9a8fe4b29474f8aa557b3d0c8a662
SHA1 f2b35aac05076364fac2c0130d946f9857716ee8
SHA512 82584eedb356ee27e7fc55f90c2cd3f2fa8b432e140cc278f40aa42f2c4042b0edd8ec4b20bfc2c25f37ba7eda9813eac2399f0be26e4d0f95b508fa524d3a76
SSDEEP 384:sxZ0n1lPqvQvf/fPzsvuy66s8qMpRiYnazAW8pZS15posJWeT+bL+Nj0z7ebHb30:suoIn/fVy4Mnc7WeT+SzHb6D
TLSH
T1BBD209069924C8779EC39D19743C7E73D9EC40526284CED91AECCE0C029E5FDAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 324d4137debbb3e4c13ed6b8c6f15195fbc5547549018f02bd11362c9d14e880
MD5 dd8c3934fd1e1bb98a54c403bb191ecf
SHA1 569c0d87ccb596689fd26c5ac44f3f25a354ce13
SHA512 2a9b7ddf93c388197c2a0a2ed3b6412cf59d1b31bb12dc0211762540420856c847cb02180ec8ea69505fc1b158609a158cb018748aa7f35340565ab8184bb06f
SSDEEP 768:yos6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNproK4:yos6pD1WvxzWju1jahILIsNCK4
TLSH
T1A6D20A3B680CCB7E4F840E5CEC2AAF967DD801CBAB98895447FA454C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7dbccb9f66d01340f0f00d3c197314240bbf244c2232e966ac59c9b05d492f22
MD5 fa2296379b4ea0608501cdc3de57e120
SHA1 c66d5b87bbe61ae73e5a92edb3191e7665fdbe73
SHA512 1fe12453cfb3510d7c22f7565d08cd531b0ef92f89ff50dd78555245821aac3be911f123b8f4365f1e7ea9ac450ae4fad6fb3b9c017df65e25c43cb515ee9e20
TLSH
T1C3E0D8BB6EE76820ED6BE3E7247194B50141381C8805BC4F586A96C350B13557846D65
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 9KB
SHA256 b5dca1db2e3924a8827330a3ea48cccbfc67e2a65759d7cd88d75d7d89e406c3
MD5 da77a8a92583dfec42a1483252e54d5d
SHA1 84ee30cf5a83e2cd52a4761eaeae8f3b8e37eb48
SHA512 b13784a1434b4500037d74a35ea54ceab6335d68c497dddad6839b3718583f8973c2228cde7e9256b0a6b714e3b420e5d0402dbaa254791edb9aa7717a6f4dd8
SSDEEP 192:0Wh3gi6qTDy45eyHLhq/c166UZsHnsQkZ9d7g6i6Ixob9:1lWZGnsQy3iEb9
TLSH
T186123B4EABB5303286235A39CB9FE1123D37610B2446BA09BCCF93586FC437557E96A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 aead664a3b5dd8af8ae60842b88a1b4b1e5ecb0369a0727077584699fe9f813d
MD5 2aaafac17abe9a9ec2f791646122373e
SHA1 5aa7b34fd7797c8f34aeb6fd012b451b7131c556
SHA512 493fde768d959f30db0efce10b9b9e3e64c4e9967934674db28cda29827d37a9ee18ac7e6ac042dcbd58aca131f6ccfdcf2b9317213024c80e4fed7e1184ba5c
TLSH
T1E5A00230094DD033D4504774666B5D8137508851020A1649C5E094DCCCE12C0664627D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586675.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586675.TMP
Size 48B
SHA256 ccfce930059f0f2c914796484319efc99195739e93ed7af5976afe5bff6bad38
MD5 65fad17ab378c6cef3ea95c7b9564b0f
SHA1 11abceffe728234b73271116d271f37e6e1a9ef5
SHA512 81c967e0483ed705440390ef9c47f704d347062045a606f124aef4f6c0a2e8f92352a90495483cf61e0ec8f09794a87727e2e46458b9172fcd7d40dd2e77eb12
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e381ae588661a8b0fa81085331cbb6a99a4920a39fe7202afa9da8999292b45a
MD5 1ac5771c9305620acec76894dce6b8fe
SHA1 1100a9fdfea0c9430c889aa30ac0ed2c8ccf6caf
SHA512 c2e2ad266206c18dd45fc0ab982d1b777679b6a7c6e2e0afb1a827bf1442d8c03e2fb1e3fae76283d07e17c10a62dc8f6f4672b6137ff9f9984e23a6d0dd18fc
SSDEEP 96:KUAAKtePCcAKp26OhOKiApKIKbq66aMKrKZwRwuw/wbwe:ii7r9tX3wwRwuw/wbwe
TLSH
T163E1241232BB47522C7E390DA35487674B42F6633014E82B77A920B11E67E744DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f4ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f4ac.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2b361384dcd95b923e4823495bb71e1016d0e086d9743b96b9a764d07de75a89
MD5 07e81d913d5e742234c1355cc5f88c06
SHA1 af41efda785178dfb42b0433fe786a6dd51aefdc
SHA512 cf416e9025d10517ced0f712567b097ab2a96bf1f5016aec13c3188328e9d0fabbe02f6f65466ef07ed0b0ee0829d82a82e09600186ada038a8425eb4bdfce14
SSDEEP 384:qYzaSiFVtNn/s3n9SnhdysNm68TUNTUlIlc7fbUq5+6zWuu2qa9DO5MzYzJr3OBU:IFVj+9pUwgCS6hOs8h+R1jhk
TLSH
T1F6C2F7F258D78976E9AE8747A77E2E128EBCC063B5811A40B7985E0CCDC71BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebdeed6486a6b546660dd9b4280450f5ae693d658f9c8974d82374e7d3139f9e
MD5 cb9c65bd9f83ca80c6f3d35e2cdadbad
SHA1 a1272797924365038ada971bfe80c503f08cd4fa
SHA512 4886e0995e1c605b22ee49adc69e3cc8d62c149b6f34702ae6f97a4fb2d567455196cf8b73022f116bbc940146d1ed37653800d3545136520f98e67cedf750bc
SSDEEP 192:qONx6O7+3hQmiUy0o0UGttb0CO2b6h2SUgGBbZU6:qONx61JvUGt9DO5MSaBVU6
TLSH
T13D02F9356D686CB75EF2AE06BA873B235FA5103BE9952F81D6EC1F0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 47c373516fcd54b37c2883e2d4c43d1160901a5094aca9ae7147c7e3b6095d58
MD5 3b4c5ed9c619677b6dc2beaa926506dc
SHA1 419245dad13fed0c3b28ce384d46972841115e39
SHA512 e6bf57a85251424d2af227670bbfb7c8c66b332a97460e1f2395dadec4987cf22fe901f5dda359af05eef0e489b67f4d6af38be49cc2958d781f013610563587
SSDEEP 384:SYutNn/s3n9SfsNmiQ7fbUq5L6juu2qa9DO5MzYzJr3DBbScjmwVw3IA:Cj+9Uda6hOs8hzR1jhk
TLSH
T18E927E336C289CA769F6D146FA473A57CFB8407786851E80D5EC6F0C02DB6AC1357D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c05d555aed72dfc60b85d0ed1bd3a3e947a7fc0ceee055aac4b9765715b83e71
MD5 7c498f8c5b291cce05e2102ba4d305ae
SHA1 e0991cb213db50d4492d3126578dc5a3b7b56532
SHA512 5063e0a5e4e3248762537a0e3e219b89f38da45a8ed23e801ef74a5e1097ab6c281b504752fe59d06fa625b536fd03f6716c79597760b437884976dbedce8386
SSDEEP 384:SYgtNn/s3n9S5ysNmic7fbUq5+6juu2qa9DO5MzYzJr3DBbScjmwVw3IA:cj+9D5N6hOs8hzR1jhk
TLSH
T1D4927D336C289CA669E6D14AFA473A57CFB8407786C51F80D5EC6F0C02CB6AC1357D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8d594694ee436366c873777005ca52acb82e000a1b353554cf9bfba8abdf9f81
MD5 15b6d0603e928758f02ce08b96afaf1a
SHA1 e0bf6411af0763e063993cf2d3a9b2fd4acb3153
SHA512 43c081ce9d7666b97bd378754b8d5c82d1910f682343a19ad8301394afe033d5d981a6bda46fd1d678f432f83d61ea97db4e6ad85b4da68b7ea91e149e037f94
SSDEEP 384:KutNn/s3n9SfsNmiJ7fbUq5L6juu2qa9DO5MzYzJr3DBbScjmwVw3IA:zj+9UOa6hOs8hzR1jhk
TLSH
T1E5928E336C289CA76AF6D146FA473A57CFB8407386851E80D5EC6F0C02DB6AC1357D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4306c787c70837283cdb6f964641ec985e39d4494c71afd1d98d3a3c71caf713
MD5 85f4607e9ab793538adc81991d91901c
SHA1 e7a2e7b246f00af5f2a9787fc361f36239d05d9d
SHA512 560b1f56429bf2793f5414561e72676693e45049358be45d454932324103974da80c1a41c4f5629c8b201f29b14047112de3a20907d8d50a1841dd95b0b1b115
SSDEEP 192:26ONKf6O7+3nhQmiUy030U22ttb0CO2b6h2zcF0SJr37cNBuqFFU6:26ONKf6F/JEU22t9DO5MzYzJr3gBbU6
TLSH
T159120B3678689CB76DF2E545F5873A139EA50127DA8A6F81D1DC1F0C01EF56C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

682e359a-9783-4ea3-be6c-bc09d92cd949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\682e359a-9783-4ea3-be6c-bc09d92cd949.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ae5124e8dfc266bd580c2f5542cc738a5c9988dd0a46a1d6e60e62cc6f625d75
MD5 28856e870f274724b4ad469dba60b43d
SHA1 b3f7c686a0c152c744c40691cdf669220b6ce87c
SHA512 e8c52ef24a246b4c640dd1aa537207aa3ca2f94e89e1f2ccd250a00cd86fd819143633147d1173e14cfb7c54b95107473dd1d5b26283d034af803c25d6800017
TLSH
T197412998A6F91148B3B76F06ABF7696E487B7C772E06945E10110E4F4A63F40CC62B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 58b31005c0a1c0f844c03605d7920607a20fbe505aa972e8500f055b7d6f201e
MD5 dbb8342e855d2864c0021e5a40747136
SHA1 a35015cc436e1f13b700011665c4f739bfb61852
SHA512 a5dedc6d8880d28cf98ed18a1f69356e6fe2db67a0cba9ac3dd02fc28784c32d268b70e4ba7aa975aa0997c89d5a09da328c232a57cc1f6fb6c8ed08a460c22d
MD5 SHA1 SHA512

Submit Download

0988f833-c548-4ec2-8db0-baa890306eee.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\0988f833-c548-4ec2-8db0-baa890306eee.tmp
Size 6KB
SHA256 b47b723c6d51b3fcb5b458e351bf3823d10d2a11a3f2032984ef4cb9316931a7
MD5 68bb7d21a6ad952ffca3ab03e61874c9
SHA1 0bc3b01d0558385335e27905c64eb1e6c445c80c
SHA512 1b5b9a14b3b9b31f05851ff300be60a671904b00ee363adb979def49f595e7af1974a3a5455ac25f6a0967f28fc56e8b89c75658d0501606ce226b190c50e35f
SSDEEP 96:m7Zrze2NXIQKSFI0rF7PaTLChIVrSk6zqoEtDf2Vi4FbYYuK1q1W9:cze2N4QKStJlONAhEtDyi4FbjuKh9
TLSH
T1C5E109362D4DDE723F94AF29DE7A7F928ED6016666709D288AF409CC03D22DC01532C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09acda7d-d8cd-4aaa-bfd4-d046f71a24ac.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\09acda7d-d8cd-4aaa-bfd4-d046f71a24ac.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36577f2f-d804-4c81-a88a-ae9b8cebe439.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\36577f2f-d804-4c81-a88a-ae9b8cebe439.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Cache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Cache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Cache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Cache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9609ae6a85080f980c4d9ca1c344f20d41f5088ea49832f30acb0e2429dc6878
MD5 aa990f1324c48e0394c20fcc4d656d71
SHA1 37bc78f3ef00b8d5ea7b94328e286a3a81929d9d
SHA512 980df913dcf8a78beda2406af2e21be80fe04787e5f3cf54f3981bbdf7d0cddb5205ec518c48a70a8b34b49411e64b607a877b02662c463bd8ff9bba1465e178
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 f48adee508a97a62e792693b339c6d1d18a67899ae6997210da69f466a5d202c
MD5 020b83d23f6fc4816d731006fc43e87d
SHA1 6e25d89c8a79ded68cadd2dd37a1c945bf39396b
SHA512 1396a3cd086e375fac1f6ce5a395f69dba9a73b252d82fc3dc5d9993ae5155dd1c96c7252854bb7655b6f3b272e1d1fab39f3a89639b9970d8fceece8d0e64b3
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Favicons
Size 28KB
SHA256 3007d3d6679663a3de3b172bd80487e3176d602e779d3d774c49919ed125e38c
MD5 45872ae156c638389d4afa8a23ed2674
SHA1 93ab2558d0a606906d88e7da853160ed6e694fe9
SHA512 afca203e72501825357179da9beaf8fe2500568ad74112a49ec4fa58ec312d0a80e8dfd208dd5a02627636c1ca5d32a8334e937de4dfcac26b293359c2eed00d
SSDEEP 192:MNpGEc/MjncWOtxJ+RIxo66mtmAodWDQzexaczp6a7ilqwvxcGf:cgu2tximIADQz1wKqw9
TLSH
T199D2AE0A4B347226CF950E39201E5BB0453F566F4F5B6E8521B02EB50AA1EC5D13D6BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\History
Size 116KB
SHA256 32d9138f567228a30461d467c016c359b16f31691ef86fef5f2b5748c1b8aa4e
MD5 08a61bbc6f787f6091decd2b186811b4
SHA1 3545df64fe181a72b43fa101d4094b7818f15e8a
SHA512 af8c5191e8b135e7e363e715da560b2e3e11b71eeddaa07c42a02ed5ab33183a5066ec93a5552ccfe9ec319fc5183ed78c53e5fd71aa5effe1cc1c60397d55ec
SSDEEP 96:F/cCBPU+bDoYysX0uhnydVjN9DLjGQLBE3uKG:F/1K+bDo3irhnydVj3XBBE3uF
TLSH
T1FDC3F40F4F283612C9BC413764EA46731DBEB03F8753698618A12475DEE2A16B01D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Login Data
Size 40KB
SHA256 9f37c9eaf023f2308af24f412cbd850330c4ef476a3f2e2078a95e38d0facabb
MD5 81db1710bb13da3343fc0df9f00be49f
SHA1 9b1f17e936d28684ffdfa962340c8872512270bb
SHA512 cf92d6c3109dab31ef028724f21bab120cf2f08f7139e55100292b266a363e579d14507f1865d5901e4b485947be22574d1dba815de2886c118739c3370801f1
SSDEEP 48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
TLSH
T1FA03E10F9AA86007C8994636BDE2D4F31F7C61294F72EDD2F8B04475CE6A461F52D0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Media History

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Media History
Size 76KB
SHA256 c6db9e65f0678241a593f15a438b305bdb5341d71ec11ffb654d412d1438f998
MD5 329bd081c651af92aa9de24e5d769eb2
SHA1 43c17a2d26fd02e1f3a7d1216a5fc0f29d216aea
SHA512 c45fb7db02bb1436736c26715175bbc1efe9f897eb1564d0bb5c948357a4cbbdf8d3d8c32e54580c8fbbb45bdf4f33f67b4943eb109bcc666c3aa345c5ae5e24
SSDEEP 48:TG5o7JWFFZ4AvfMN3dSyUuHFucFiT8tfx+aLJ5nSalokU1cFB:LafMJdSIHfFZx+haloaH
TLSH
T1B573BB1D2FB8A425C0A9C339BE732D610F7E161955A3ABC06CF0507A4FA2752A05DEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Platform Notifications\LOG
Size 142B
SHA256 a5ea8d914cd21ff6f6a550dfc4a814c6b6d035fd754c3e3606093bada068dbae
MD5 ede92f76070136c1020823453b40100f
SHA1 e8c0d16538200730236523338d0fa68a25a3aca9
SHA512 4b55a478561e7d79466393949f90b6bdd42c6ce66985d7d13a3f3c0467decf2cd343451dec375edc2eb09e39b3420ad02c42a11d9260f9664c30e6443ea75335
TLSH
T12CC02B182BA5C6632594841F53B0A30EC3F5780D5FDA7D0F0B40E4941241008A9832F0
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 1c9344a943ca9be5591a6bec61112057929982518a8aff2e21b62dd1f189f346
MD5 839b4fecf5a091982e5becc50b5d9cc6
SHA1 7d20cb41ed65822f1c06b82603bd3d132eb1f951
SHA512 843b31a23a76ed7f8c718757bd827666d19d9e1d404b490136517cd2b535fc914d9563ae817995ea172cda907888ba6a25e0d150428fccc1f4b310ec985eed0d
TLSH
T10061C74B5B14DCB74CDFD618F90A3D82D5FA105049D11C849AFC5E5C0EDEADE225782A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 8c7b425bae635d7288f2f4d0840c1401bf64ba6889852ccd194de343bf6cccb8
MD5 b2f6707bdd3d8ee0fb0a8c04d5e2c24f
SHA1 d289ba6fea83697ed963b560d5c116d2f34a001e
SHA512 977cda0bcf795996ee4ce04a68d6ee2564c3e98369c1fae05aa4d7f383ccef48d9286030073770c447523fd398dcd8c638a47259ae9e4ce99f54111bcf7cee7b
TLSH
T14861C74B5B14DCB74CDED618F90A3A82D5FA109089D11C849FFC6E5C0EDEADE225782B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 98f98955c1d5c2957e7a816abb639700a4d2194c624601101f29d40caaca6d24
MD5 0fa277f7081e0f843657617d4bc67e28
SHA1 6ccf7e497363b835f1328d5b4dd24b11b882dd89
SHA512 2cb35dcf235a7f8010883d0df82770732be9e34358fffb4bc7e72a18011bbe2c20314aae1edeaba9627df802af4e7b95ee055cc3624e0c9a234884debe1afc1a
TLSH
T16D61C7475B14DCB34CDFD628F9063A92D5FA10A049D11C849AFC5E5C0E9EADE224782B
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Secure Preferences
Size 6KB
SHA256 07262c2f296a21ed6bcf5b43abff28fb51983fd0f5cdd18b06c456476643db36
MD5 a8a621a01f5268a9abdd70b66fa4844d
SHA1 d85c9539bfc4895a6c8d69d0d9144a3ad61c5361
SHA512 b88457cc85fa110eef886b2ca7d7ac81a68f008876116b6e4570e598f64f53c781c4e1410759b439533e7689edc0389812f3ba80c0bf6a019848d1590bdedebb
SSDEEP 96:m7Zrze2NXIQKSFI0rF7PaTLChIVr/YkOf1oEtDf2Vi4FbYYuK1q1W2qg:cze2N4QKStJlO/bkuEtDyi4FbjuKh2/
TLSH
T16BE109363D4DDE763F94AF29DE7A7F928AD601A666B09D288AF409CC03D22DC01531C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 a06bb0c794c51146ad61fea4b1f41d0712255ee948c409664838ea0686c11933
MD5 9ea6040fb38d15b1d1b35cd333c0b246
SHA1 49317d6878c59f608b0233c1aff5aa0b16acb9ba
SHA512 eaca124ac1af4ef11a67a6b6a40317b1dc030d6e5fd79f9e11311b3f7c17f9241d11724f41dcc1b374962484850d663a3e199e5fcd48161214f9a2b05e8f6d42
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Site Characteristics Database\LOG
Size 149B
SHA256 dc836ebd63592f6679dcf259a010ad33ebb77093ea1e2e21a027ac065c628757
MD5 07219628385de4edb58997644b6863e8
SHA1 74ef8afd2078ef1e3da6963ffba10a4540158521
SHA512 68a44aaa846990db06a7b2c49082e618dc57f83f2f53b2969dabe55dfabfc47996cf94bc55a0e0039143eaa632a0c8f1832f3a714743136941b79745692bc282
TLSH
T158C02B202BEACB7B214E401F4334F30DC6F6780AEED926161B44F674230950871435C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Sync Data\LevelDB\000003.log
Size 122B
SHA256 a705d9d26ed11df2f38e6c25557ccb83916b8598fe92d2ad25868f9ae89844f7
MD5 0d9f70652007603a81c7847dc3cee8da
SHA1 4a7c8341cfd657f31314690bfd9bd8f51030c5b5
SHA512 27e34f4b5077a9bb58f30d2447c43d2ae877495bda975b33f405d5d08d03a009bf67bd24abcf70838934f17f1ec66ed1b98429ad96997cae68d0f1e0bf9ea4cc
TLSH
T1EEB001FBFA145032D1479DFCC478A3407330B94D2024C2D68390607439603CABB5F95E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Sync Data\LevelDB\LOG
Size 136B
SHA256 274aeade8b939a2bf22ee9e13c90fd2ad45e18f6cba54ce58dd104dc77525c38
MD5 189d84969b2610a00ab75b2e91de48e1
SHA1 f57eb377b58b56cf2965aba3e395e03476759557
SHA512 0ae543d2301106f601d9d41d0b6591379343966309ee6368643905e9eb0768f6d8c08d9b04f7c9303fd7ff997b50dc1367b5b779ee5be0a41e74e5d359a28451
TLSH
T10BC02B301FE5C2331484C00B4330B30DC3F0BC0E4BC5360A8308BC94320000871A24C1
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Top Sites
Size 20KB
SHA256 4c9116561a1f9ecdc29ac7bbc525dd8a6f2f8ae844302cef59a9d9ba7e18fd95
MD5 344863de20cab27bb70ce070a81ea864
SHA1 3b8dad3335a472ab216cf490bc1ed6ccb10b84e2
SHA512 9a8d271c48a461781eaf9f58464533da4d210396087aaf815cc03f4e6a88395c56d305cd952bdb757e30fd2a448319eea4232985e1165c7016b42d6578d109c5
SSDEEP 12:TL1Huyq1YA5yEHFxOUwa5qguyZ75fOSCccog2IccogL:TLluym8I6Uwcc25fBa2oL
TLSH
T1F1929E972F242833E97C8B7D6297C1E84D7FD53DC686EF55909948211EE09C0529E0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 ccde9019be50945c9020a3b9c2136abbd765d47dc23693fd3f2424f784d06b1d
MD5 5c76b4c6fc756c0c67b241719b96e517
SHA1 8f68930d7bcdebc183e4ef938b00e506bc62bb0c
SHA512 f1b0c691ed0f22d302767420db175a3c8296d1359a359a7673bc2cd28805ace204368538441692907b7545efc661d614d92303dca05abfc522c90512000a7dbf
TLSH
T18FD02272016EE833207C09690F80AE066F7AF23801C254F896D2462D904806F6507423
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Visited Links
Size 128KB
SHA256 ad0479ce7e65743f1f29955185d1715f7564d6067b898df243cec0994936e0e4
MD5 1d984d0f5fc88c2008128a07b0cb0bde
SHA1 891f52a1fbb0523aabd578694e47d7dec323f86f
SHA512 af908dab514d680a033cdc6780d1905071998782f1289c7c69304f3961df51d4e1234755c8fcc922bae6a45b195afc2c9cb7811456262f4cb7a17637bf893638
SSDEEP 3:ImtVuocGaSIalX:IiVuoc
TLSH
T16DD304C41143CF10D14C4434DC701D0D4430C00041531043133F4D035CC11017103C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Web Data
Size 72KB
SHA256 593d9de27a8ca63553e9460e03fd190dcadd2b96bf63b438b4a92cb05a4d711c
MD5 72a43d390e478ba9664f03951692d109
SHA1 482fe43725d7a1614f6e24429e455cd0a920df7c
SHA512 ff2777dcddc72561cf694e2347c5755f19a13d4ac2c1a80c74adebb1436c2987dfa0cfbe4bafd8f853281b24ca03ed708ba3400f2144a5eb3f333cc255dac7ce
SSDEEP 96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
TLSH
T14473520B36B47002EEE8EF712CA150AB4D3C613D4E46D6D42976609C8AF7953627D8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\GrShaderCache\GPUCache\index
Size 256KB
SHA256 fa7b0efca9712de238e97b7256f7fd7edde4a7810b06aebfb1b49c6ba377f0dd
MD5 257518f2645ed8a3c5c0cad4b611adf6
SHA1 be455b082b008c1a22247baa4598bbda95e855c9
SHA512 a7002015281be0105b4abaca5d10de3659bca13aaa99d1f0af59402af5906945c1a6c6650e36baf66d7af33fbe52e2fe45708eeef1bd73ed4e986433289169fb
SSDEEP 3:LsFlnllllklkXl0SgUs:LsFflP0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Last Version
Size 13B
SHA256 02e71eb4c587feb7ee00ce8600f97411c2774c2fc34cb95b92d5538e7f30da59
MD5 c422f72ba41f662a919ed0b70e5c3289
SHA1 aad27c14b27f56b6e7c744a8ec5b1a7d767d7632
SHA512 86010ed2b2eebdcc5a8a076b37703669c294c6d1bfaaea963e26a9c94b81b4c53ec765d9425e5b616159c43923f800a891f9b903659575df02f8845521f8dc46
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 feecdfbf40588f37bc826f52f79875e9e6f3013dbece402a0b0878895259863e
MD5 30a2c1a565e80023d19eb05a3767572d
SHA1 e8b6ee897dcf9e1b6be3fd2c071dd809874499d6
SHA512 210f119e5e2cf89f006c1f59c1f9c11583ee23be69a4bd21cbcc12a935d90020bfb99a63058e4cc5c9d9a9ddeed4554695126e6712f16d183276bf700108aa50
TLSH
T15B61877A61998877BEE7E445F9433A13CE6D102B7A581B80C3E90B2C429FADD1397137
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 6f1051a6eb445262ffd7ec9ac281f2504493e06ff9cea37bee55111346596da3
MD5 001a33979437d3fd434c95aa5c5bd288
SHA1 a3479427e913b6d9e2f1c5cb2514fb1e4511eb80
SHA512 813a4fc24ccd4eb15eec42dfb679874d89f8244fa565f9c5fd2a040b81602fc3f559d7239192d59cdc6d189a49f37db393715aa5ba8fed060b7677674b26a869
TLSH
T1CC61667E61998837BEE7E085F8437A13CF69106B6A581B40C3E91F2C419BADC1397527
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 858b1805668801bc8c64bcfa87c464209fd0d1c0fcde490e9fa3d25c76504bf4
MD5 547d378484670952cf48c10b1eca16ae
SHA1 236596ee80f64fd4b4a9acf781b68bc05758ad10
SHA512 ae1cd7709e9392eae532aace2b158d7dee5df43bc6b6b24f61eec1240c073281bc9073dcd32260728de2c30bbbec72edde0ee9ed22fd534a50d7e42c9bced8da
TLSH
T19461866A61998837BEE7E085F9833A13CE6D101A6A581F80C3E91F2C41AABDC1357527
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59673c.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe59673c.TMP
Size 3KB
SHA256 4a2c2576978bcc0dc0e978a56fc6950a25410bc41e7ff290765454712a6a0348
MD5 ce95f16d6d3bc4d7bb79d49d7578a9af
SHA1 b71832919eafa381b3a4020182a4dfd7b6bbb668
SHA512 e563acca553fc8cc43f3db3f20076db175bb7d393d7f507dfb71a7425e3a3d7977283a8defa3b9d2323e1cfa9ec896e355c86db3524c6bdef5ac9e93484f49c8
TLSH
T11661877A61998877BEA7E445F9433A13CE6D101B7A581B80C3E90B2C419FAD91357127
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\index
Size 256KB
SHA256 928bd2e508a5b54ebe702b42113030692b9e1e19a4769e724075ad9750eb5f5b
MD5 9ed23fa759e1f72cda25a76b07ff4fe7
SHA1 25f90ee4b928256c164fca23af6fef8e842355ff
SHA512 3e8e9a2c8814031bff86439d7c38963ae26ffc6e8eea7729243c4ef79eec385fec3d879f7f4e03352afb53d0d44ef731e72e3eed5c2484a1f415e0a1788c019a
SSDEEP 3:LsFlnllllklkXlVl/:LsFflPVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3060-1125-0x0000027282000000-0x00000272822F3000-memory.dmp

Download

memory/4108-1007-0x00007FFB71F80000-0x00007FFB71FB4000-memory.dmp

Download

memory/4108-1006-0x00007FF7F8CB0000-0x00007FF7F8DA8000-memory.dmp

Download

memory/4108-1008-0x00007FFB6F8F0000-0x00007FFB6FBA6000-memory.dmp

Download

memory/5244-991-0x000002364FB60000-0x000002364FB61000-memory.dmp

Download

memory/5244-972-0x000002363EDB0000-0x000002363EDC0000-memory.dmp

Download

memory/5244-976-0x000002363F760000-0x000002363F770000-memory.dmp

Download

memory/5244-983-0x000002364FA40000-0x000002364FA41000-memory.dmp

Download

memory/5244-985-0x000002364FAC0000-0x000002364FAC1000-memory.dmp

Download

memory/5244-990-0x000002364FB60000-0x000002364FB61000-memory.dmp

Download

memory/5244-989-0x000002364FB50000-0x000002364FB51000-memory.dmp

Download

memory/5244-988-0x000002364FB50000-0x000002364FB51000-memory.dmp

Download

memory/5244-987-0x000002364FAC0000-0x000002364FAC1000-memory.dmp

Download