7f5d09c223cf679e840fd10fd223ba55068209d3c54cce34c7399b93277d1340

Analysis

user interaction
yes
max time kernel
630s
max time network
521s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 1.4MB
Sample260722-zagf2athpf
SHA256 7f5d09c223cf679e840fd10fd223ba55068209d3c54cce34c7399b93277d1340
MD5 a28aa39dd7b3883a6f5a9bf2755060e7
SHA1 44dd345983ce5b159e8b73b60e5165c32cdc3ba2
SHA512 d6cf269ac820c7b77eab58f6cd3fb7deb5aa8d481d8bdea5f83e37b9a69324fa49dffe199e869e0351be888d35f6fc23629b628cd138f8270fe35300eafc9698
SSDEEP 24576:41VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GcrR59H7USvx9f0:8QdhZgEN6GnJl9pO
TLSH
T1AF656B22A3918837D1732F759C6BC2946C257E602F74E54A7EB8AE0D1E38B417D393D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
452	srep64.exe
4468	VampireSurvivors.exe
5276	UnityCrashHandler64.exe

Loads dropped DLL 18 IoCs

pid	Process
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4444	setup.exe
4468	VampireSurvivors.exe
4468	VampireSurvivors.exe
4468	VampireSurvivors.exe
4468	VampireSurvivors.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
209	drive.google.com
210	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1076	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292258570832730"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
6116	chrome.exe
6116	chrome.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5640	taskmgr.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe
Token: SeShutdownPrivilege	3700	chrome.exe
Token: SeCreatePagefilePrivilege	3700	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	VampireSurvivors.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4016	3700	chrome.exe	86
PID 3700 wrote to memory of 1076	3700	chrome.exe	87
PID 3700 wrote to memory of 2060	3700	chrome.exe	88
PID 3700 wrote to memory of 2060	3700	chrome.exe	88
PID 3700 wrote to memory of 3312	3700	chrome.exe	89
PID 3700 wrote to memory of 3312	3700	chrome.exe	89
PID 3700 wrote to memory of 472	3700	chrome.exe	90
PID 3700 wrote to memory of 3184	3700	chrome.exe	91
PID 3700 wrote to memory of 472	3700	chrome.exe	90
PID 3700 wrote to memory of 3184	3700	chrome.exe	91
PID 3700 wrote to memory of 3544	3700	chrome.exe	93
PID 3700 wrote to memory of 3544	3700	chrome.exe	93
PID 3700 wrote to memory of 4092	3700	chrome.exe	95
PID 3700 wrote to memory of 4092	3700	chrome.exe	95
PID 3700 wrote to memory of 4744	3700	chrome.exe	96
PID 3700 wrote to memory of 2880	3700	chrome.exe	103
PID 3700 wrote to memory of 2880	3700	chrome.exe	103
PID 3700 wrote to memory of 3672	3700	chrome.exe	118
PID 3700 wrote to memory of 420	3700	chrome.exe	119
PID 3700 wrote to memory of 2120	3700	chrome.exe	120
PID 3700 wrote to memory of 1212	3700	chrome.exe	121
PID 3700 wrote to memory of 1212	3700	chrome.exe	121
PID 3700 wrote to memory of 1320	3700	chrome.exe	122
PID 3700 wrote to memory of 1320	3700	chrome.exe	122
PID 3700 wrote to memory of 1256	3700	chrome.exe	125
PID 3700 wrote to memory of 1256	3700	chrome.exe	125
PID 3700 wrote to memory of 4436	3700	chrome.exe	126
PID 3700 wrote to memory of 4436	3700	chrome.exe	126
PID 3700 wrote to memory of 3520	3700	chrome.exe	127
PID 3700 wrote to memory of 3520	3700	chrome.exe	127
PID 3700 wrote to memory of 472	3700	chrome.exe	128
PID 3700 wrote to memory of 472	3700	chrome.exe	128
PID 3700 wrote to memory of 952	3700	chrome.exe	129
PID 3700 wrote to memory of 952	3700	chrome.exe	129
PID 3700 wrote to memory of 956	3700	chrome.exe	130
PID 3700 wrote to memory of 956	3700	chrome.exe	130
PID 3700 wrote to memory of 4928	3700	chrome.exe	131
PID 3700 wrote to memory of 4928	3700	chrome.exe	131
PID 3700 wrote to memory of 3372	3700	chrome.exe	132
PID 3700 wrote to memory of 3372	3700	chrome.exe	132
PID 3700 wrote to memory of 5128	3700	chrome.exe	133
PID 3700 wrote to memory of 5128	3700	chrome.exe	133
PID 3700 wrote to memory of 5668	3700	chrome.exe	134
PID 3700 wrote to memory of 5668	3700	chrome.exe	134
PID 3700 wrote to memory of 6048	3700	chrome.exe	135
PID 3700 wrote to memory of 6048	3700	chrome.exe	135
PID 3700 wrote to memory of 5244	3700	chrome.exe	136
PID 3700 wrote to memory of 5244	3700	chrome.exe	136
PID 3700 wrote to memory of 5636	3700	chrome.exe	137
PID 3700 wrote to memory of 5636	3700	chrome.exe	137
PID 3700 wrote to memory of 5976	3700	chrome.exe	138
PID 3700 wrote to memory of 5976	3700	chrome.exe	138
PID 3700 wrote to memory of 3260	3700	chrome.exe	139
PID 3700 wrote to memory of 3260	3700	chrome.exe	139
PID 3700 wrote to memory of 6116	3700	chrome.exe	140
PID 3700 wrote to memory of 4860	3700	chrome.exe	141
PID 3700 wrote to memory of 4860	3700	chrome.exe	141
PID 3700 wrote to memory of 452	3700	chrome.exe	142
PID 3700 wrote to memory of 452	3700	chrome.exe	142
PID 3700 wrote to memory of 5376	3700	chrome.exe	143
PID 3700 wrote to memory of 5376	3700	chrome.exe	143
PID 3700 wrote to memory of 5524	3700	chrome.exe	144
PID 3700 wrote to memory of 5524	3700	chrome.exe	144
PID 3700 wrote to memory of 1884	3700	chrome.exe	145

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc5d83c728,0x7ffc5d83c734,0x7ffc5d83c740
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,9052831277161487256,12437511043542094390,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,13244365573700606232,12433525124809936425,262144 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,1688734372461924705,7367763026048557452,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,5745131954855642085,4885897926247767711,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,13013888147253252430,7676884749191266692,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,2460886462475510602,9482546284973281962,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,7229017200210242728,16965893174971794064,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,16942983492295695021,6928218348724306063,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6072,i,11054005086755630188,5316774952895342434,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,11781473074209806380,10964139944016731483,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,17996958436864949277,8879683783215322105,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,2970147920373384400,14184710652816097667,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3516,i,14910549571760971592,13979954824991534444,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5956,i,5968890014061053605,12555294651143486667,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3480,i,17832145704262807368,8025857960049786061,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3416,i,3359715652215936842,5562589278407079366,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,9409483319176980436,13153591683893477604,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6180,i,1417533177210478904,13248418127967402886,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3532,i,4520688420520143774,10091264837016805532,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6468,i,3708088859777789945,18212141215024169692,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3392,i,17189405300658973232,18382759629457623042,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7036,i,4479127236960652395,5443554265826348049,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6204,i,6983852549119269231,3050915775601735591,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6492,i,12366630125442608110,5904900484315337145,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6696,i,18217815181418698827,15092721522283357074,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6328,i,14806405870221723556,11531589184420679013,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3516,i,14463867860025879863,12943535338477042131,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6696,i,10723503864889078341,10867074493613098488,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6504,i,5607861441732934728,2987302045656466083,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6672,i,11767123531873075036,6190054289715461362,262144 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6796,i,3113429327330787488,5021727966731641380,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6112,i,2858640988566942367,17139204770396324090,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6688,i,9896178177166113892,14029973571776088505,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6288,i,4394121396759276748,4419208367795054583,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3280,i,6050019394301147280,4213413591680690027,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7088,i,16636981620454276265,17846151083348475282,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6200,i,14309636313950121748,15406609739988234381,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6500,i,7303032531090004224,2866380958589311399,2097152 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7296,i,12975446751077067479,15139462985732928805,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7308,i,165620037549395773,12939491852652195825,524288 --field-trial-handle=2056,i,4423635241729485390,8404165531124366231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:1072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\Temp1_Vampire.Survivors..Oyunindir vip.zip\Vampire.Survivors..Oyunindir vip\setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Vampire.Survivors..Oyunindir vip.zip\Vampire.Survivors..Oyunindir vip\setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4444
- C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\srep64.exe
  srep64 -d -mem30p -s --
  2⤵
  - Executes dropped EXE
  PID:452

C:\Games\Vampire Survivors\VampireSurvivors.exe
"C:\Games\Vampire Survivors\VampireSurvivors.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4468
- C:\Games\Vampire Survivors\UnityCrashHandler64.exe
  "C:\Games\Vampire Survivors\UnityCrashHandler64.exe" --attach 4468 1480258162688
  2⤵
  - Executes dropped EXE
  PID:5276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x500
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UnityCrashHandler64.exe

Path C:\Games\Vampire Survivors\UnityCrashHandler64.exe
Size 1.5MB
SHA256 6502f860ce481a4a95ee38488f84dc7d8a17623aa9f65bd8638a826ce576e278
MD5 e0821efb0e63567667de29151fe4668c
SHA1 b61210e5aef65d32dd71620682b5e37f4d1c23ae
SHA512 3818e6c27faa54aed16372e3fde40bbccd66da1c2ee241c62bd0d595e6eecd829c164224d205268f6e963d3aa6cbf63f7e1cd7cffb69183267f1e0e9112e2798
SSDEEP 24576:0+IE0uR+wg6obOgIOv9tzoxz/y/N9w/X/y:0+D+wg6SOgIo9lb
TLSH
T1076528292D541DCCC426843DCB838A9FD2B2BD5A1FB14B971BA17BA36E320D01E7B751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\Games\Vampire Survivors\UnityPlayer.dll
Size 32.1MB
SHA256 a181c9e0f270e41cb90d761d9248210d3fe9ea764d0f0e416410290d1b1341f1
MD5 c9561de012df96d84078c25ddc0734c6
SHA1 564e66bd2f37c5f4a242b6069f04374bd2c05f79
SHA512 f840bbb2e0dc5a89d80548206a92a864c265ca30e2673d624368cfb6e1db905ba10c50276b0fcacebc45b1bff20aea9a03e57afb4384c20b4af0811ae2a724e2
SSDEEP 393216:Sn8TC7tx0YyY2imB6KV52B8pzO2RDid2kSemCkO7a8kTBxB7R:SEhi2kGOc5R
TLSH
T108779D56A2B940C8D47BD038D75BA91BEBB1344503318ADB52E14AA96F37FF02A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VampireSurvivors.exe

Path C:\Games\Vampire Survivors\VampireSurvivors.exe
Size 656KB
SHA256 7776c3eeef4b96f1981ca4ffe71ce8c1f7d238b47e159d96efc2e01cb5f2412a
MD5 bef5e629b0815698213e29d81090926d
SHA1 cff48a5b99bcdd4c824dcd90e605f7856b0a6774
SHA512 c3b52a5829c4e2e798a5886756c67003fe0fa4ef9c6b30d0c329c09fa508c314c1153a8eccebfc583d1c6a9702fd49d32deb664e2ed95c3289acbb0c288c5be1
SSDEEP 12288:62NCDdJr3d4+uYN86mqVp1hAEsNfbQlF0nDW:WjXuYNBmsiEsaF0ni
TLSH
T124E4E6794A78D8DFF6663B384AE8E73B602853F42C1AD20963213898FE55FDA1CC1574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.info

Path C:\Games\Vampire Survivors\VampireSurvivors_Data\app.info
Size 24B
SHA256 f66bc9fde69467329a4b64e25421cfbe1811a138bd62b6a6a63bb778fefc4376
MD5 c14e2263ec448c351543c353d80a4e36
SHA1 98960c8a18136e76dd5c04283b7d9401227ab23a
SHA512 99b84eeb8bb81b931bca12e27fede2c8b3e5aec4539183c2491822f3497799b626daf70a11da40df900939ec2556ec8f047d2b743a0d1a8d7d1b432dd7afc14a
MD5 SHA1 SHA512

Submit Download

boot.config

Path C:\Games\Vampire Survivors\VampireSurvivors_Data\boot.config
Size 156B
SHA256 135e82bfb216719e26e4fe3e2acfae1b8bc5ccfbc9d933156968ba9def82029d
MD5 21dd970e9aa352bd6792361fc3ac4e5a
SHA1 3e28226bcaa21b9ba6e7ff48e8624d9c2d11cc8f
SHA512 88d03a4e4e65738b4181ae1b6b4389c9ace012a7f2e112fd654e89f442b8c7c12544ac548055e6096296e074b20a302c39ddcc44b9ac4fff42ac58959f984fe8
TLSH
T15DC08C01F1FA2A89E284C40564AF6EE6E9B386A944A229E9F6D51058363C85A5B024A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9ceb3cf2f448fd93bc5187f7b54c9ce570e363e5453919668a622fa010959eb9
MD5 f13deb0ed1457c52533a006d645c5120
SHA1 8b9d8389d8a239fcfefc9b567a916040ea3e78c6
SHA512 48c43636c56ba9ee2a1a219f48bb6e51844eb2d9c01815e6962d738b7682088a2fb52ac948305d60d246b1126c2d8cec53b25b914371e836b188d71cdf9b7a18
TLSH
T18EE02B69CD22DC371DFC271869654709E751131767409D4F373D410C4FB473A469689C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 21KB
SHA256 827c2a2effb07cc4b1c55258223ce5af3e42f35643f91893b49ef2d8e16bbddb
MD5 a862dcce22578fc885f0d8350012e9ad
SHA1 c4c70bf38b6b83ec579d61b5e36d739928b7d80c
SHA512 8639a7c6ba1a99f394a2d7f9f7f5144affac8047a34d8653a1d2e257415177828ed49b36b33d062edb7cb9e6ef89bfcbcbe717a69c3120744c2db719ba451df4
SSDEEP 384:ncS/kaADMv3H5OuPEjUAFH0cythGyUCS3OEigedJYCBObMrvoFGt4lVDotOqInx4:ncAn4O3HE8AFkddci5dJtMbuowt4l1o3
TLSH
T16AA2D07D3903F1609FF9906846FB9A2F437C7D1E07A0D9925C6B98234D3F2890D629E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 72KB
SHA256 352d8065d9daf5577058c801b9fde8865deae60e0aab039fb2be5fd753d1cdf9
MD5 c17b71648f362502f3d2a91f5c43b7d4
SHA1 58f6aee0cf1310a995cacb570518c27fc1812794
SHA512 316b44060efda518622c8de47dd69fa89564aa66733aa24d4219be254694b00db0247b66be21b506f6fcd3906d5116e174c1ed1fcf60f093ae285ead141ca299
SSDEEP 1536:SxODPiVesipDxQJHVSZjHNeakRhIN7yaqi4FNRMV8qn8xviol:WODhxPjtedDiyaNcNRMV8g8xvBl
TLSH
T1977302F235ED314BE94239822245FD4E7C8B14D5C683836922CFA8D907B8FD56A6217B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c684716132ab03cc692c68d61a86b17b43acfb4903adbc27e1f58b773fb7c72b
MD5 45315d662207db2d735c24d3336c66c5
SHA1 b718bc591981a4cd16b0a066903fd89cbcbe670b
SHA512 615c405b808016becc17d933d4a57a2d719c7c5b320d049607c34845f741fa608a846173c51a781bd658644f24df704b0e57f599049fb7473dbbb0ccf0dc4443
TLSH
T11061891090E64CB3CFB11A7CEFA6688470A1B8A749930ACA6147A11573CE6FFD5E116B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 42252bfb3aa732c5f8a6dbc76fceb09b58dc6e5403d908e5168cfdd657b17a63
MD5 a23a3031f2fb7a0fa3e7af571af25e42
SHA1 5d6460ec8f035968fa69e62d73fb7027a4aec06f
SHA512 0e6481c628952f958d1b7d87c65035a75b4f4e400bd48dd558f1373ffb380c53b33024e88ee9dae9aaf817a1d38af84963f3f2d57c2a2d298ba274e5b347e63a
TLSH
T1CD810D1951D34CB3CFB0197CDEE6284434A1B8B749570EC6A107926072CE6FFD5D022B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 535cf30e3afad883b1ff2dae0ddc59eb506374fc0ca999094c1bd2666e76215e
MD5 634edd85db8964620e4135aa45db07af
SHA1 ce1db1947eb7d50be51cc178be9040b5d74ee6a4
SHA512 60af8193937a87af4ecb8e58e940a7337b9f23a8e3a782a11a310e4abf788b83cefa07c4a5d1e59f2a42b7bd26347294e37d7b4970ebfb48c7211afd6175b463
SSDEEP 192:Dx9gTj3a3J/tsJcQaa3PRO5x+wvaPRWkQvKfP/NPQT9IO5IBIyIy:Dx9gTj3a3J/tsJcQaa3PRO5x+wva5Wkt
TLSH
T14B029CF7C3D8C52D881166F49B257F1ECE2D0A28022C3D27C8D9BE5B93E28B1D25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 772ff244d13dbabaa5a08e76964239b2249cabee229ebe7a86aad5415a36cd15
MD5 e22ef5ab30f52826ce41e103cae819be
SHA1 b5336fdfe02363992535f7f184a72fd306ef6703
SHA512 f0276f6b2dd9a03cf2f14f0341f686d10f5ea687b785fe086da76c48140824f503a013a98991d6565d6c2749615dfa1d544a66c839c10397ac2bc5aa5d88546e
SSDEEP 384:Dx9gTjEauJ/tsJckLJ5YnPzq6ruAnBnvbSIb32ss3Taa3PROjwva5pIXIBIyIpJv:VIqUYaNmDDNCYNE
TLSH
T1E9C27DF7C3D8D62DC81156F4AB156E1BCE1D0A28432C3D26C8E9AF4BE3E2472D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 eeb7c0697d0a211f7508d4d4a69828d1041c591c50edc8164bd4a711506ff54a
MD5 5cac5b1c2b960f851640dcbb937045f1
SHA1 771b88b8ed02d890779fafa38aff7e534ae12684
SHA512 3dea44cc897981e0e6263e6afa687741202fe02e1e3d338b1f5fd59130cb86da7b22450b7385b15b098a7a47f00f43b81ffbc9cfc42b7c2605a26bf435d68fab
TLSH
T1FF517D97C17EB8571039596F3D04BC057DF6A83402A2B8F4DAAA85ACF0C5DF35B128A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a6013a624503539ddb621bade744860cc43e6ed1ac853160398578aa479897c1
MD5 293409b26b4a6e56aaeb5bea4a5ab655
SHA1 c9c77863e28a81e0c697fe33a1b3ae12ad50a27d
SHA512 fbc2ce30e6ff3c569f4bcc115b367f0ec0d4e00a10f310214bbda72e07cd4e58e462849a99b79d87db698abaa8eeaf235faea85f015d1e89782c87a57b1ddc2d
SSDEEP 192:JR4cBhbyfgBH4omB8v7MF+hKPRpAzSn9HHsb+WNnG+zqoLeshtefnrPa2VyIsnAq:JR4mhbZBgogoCXX1wbLeZnLaOe
TLSH
T11052C52EED10297B6ECBD219F926BB53D3F5102161D42EC4EAFC8A1C15EB6CC2217067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 496586d795c66cf06ab26128cd6936445ac313c1491fd896234940d44481a114
MD5 90cc7762354d1c93a50368a8ca8a73b2
SHA1 aafe306b77c9c212cc8835c33995d91d99ea663c
SHA512 835a46b48356a4bd53f70dc977998ed85e14239c85233003dba01616d29c91304b8b367fa776b54836adcefd4010fcf1e95531dbf7dc864907796009bc1397c5
SSDEEP 192:JRQbyfgBH4omBIv7MF+hAPRp2S9HHsb+WNnG+l1tefnrPaSVyIsnAUgraJ:JRQbZBgUgo8X91wblenLaSe
TLSH
T15642D52EED11697B6DCBD219FE26BB53D7F5102161D42E80EAF88A1C15EB6CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69ec1f442454b689ddfdf4c8a9796eda4e301c936bc3d2102a574486c363b1b6
MD5 fbf7bb78fc04899e076bef625761c45b
SHA1 df1ef18a4a689de0cbcc980c6b87c305ef5a6371
SHA512 55e421167fe8d7947a0a4b7025c609e0e870baf0ad17bfab6a7ab069c6aa5839dbb84a3c3cc3fd1d81de217b04498eea9488273be16c2269c9a1745cad16dd32
SSDEEP 192:JRQbyfgBH4omDIv7MF+hAPRp2S9HHsb+WNn7LnXd9utefnrPasVyIsnAUgtaJ:JRQbZB2Ugo8X91w7TXd9XnLaI8
TLSH
T1A842C52EED11697B6DCBC219FE26BB53D7F5102161D42E80EAFC8A1C15EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6c415bf797415748f44d78c92cc7f525e45b1e9d46d5d872d965f1a0ca3d1588
MD5 deba6c1c990f6cb979f081fdf717841d
SHA1 373fffb7d3cd77045d6e0f684cf22c9ba2abdd63
SHA512 1cf237b7eaf298fffaea8d783187f577d8d4d9959d1325caed47d9b5ebe9c81a77f81363f3f34c81f035dd8bdc909255043508b2cc91378eec9fc08ca7436f5d
SSDEEP 192:JR4cBhbyfgBH4omHkv7MF+hKPRpA9+v7bW+yamSg9HHsb+WNIu9phQlcG+zxN1AO:JR4mhbZBqAgoCX01wI2FAr2XnLaOvL
TLSH
T1AD72B56BE86029BB5EEAC219F921FB57D3F5102191D41EC0AAFC8A1C10EB6CC6317457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 ed5ffc27d4a2d2fd9cd10f48c74742b37c6c3b546fed435a451db388be299966
MD5 d6b0ecb9da264c153f7ebc9a22f188d7
SHA1 0c1d7b5e4901cc716e70fc7dbe206a8dc7890d62
SHA512 97d089e500df5dfe1a3392866928705278a87219226a49f388e6d74c97a8182a24117f74e90d2cc4e2aec06030994a4b4cc80432aa1c91fe24626efa1ad1a6e4
SSDEEP 192:JR4cBhbyfgBH4omH/v7MF+hKPRpA9lv7bS+yamV9HHsb+WNO3pXcG+zxN1AB282K:JR4mhbZBqXgoCXP1wHFAX2ynLaOvL
TLSH
T1B562B56BE82029BB6EEAC215F921FB57D3F5102191D41EC0AAFC8A1C11EB6CC6317457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b7dfe45953bc1b9f5c90e30378530543dac7bdf27131ff451b14be6d28705e8
MD5 5a0d7db38c7364fea000b4d9cce859b2
SHA1 1c5729066ca1e15808f089263851f551e38655bb
SHA512 65cf11c2ab0fe6b5555d473cf4a72900e5ff6f00dc8d4d7e2f4ab3bda668ce9b3e5e251f88962240e814c2e44971bf8d13cb5c4e81041c2472bcc2fb48db1656
SSDEEP 192:JRQbyfgBH4omzIv7MF+hAPRp2S9HHsb+WNn7LnXd9utefnrPasVyIsnAUgtaJ:JRQbZBOUgo8X91w7TXd9XnLaI8
TLSH
T11C42C62EED11697B6DCBD219FE26BB53D7F5102161D42E80EAFC8A1C15EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 c73e200222c95a546417ff48dc8629f9e0db9123c654f069538ee585f433ca71
MD5 b3134a819c3181dd4bbc3bd5b8215952
SHA1 b364b716784bba1a3618cc15beef708acfa3a8d8
SHA512 ded0eceff544d8203177b3e4a28d1b73c11c09b22d3a8c010c35edcacd928faabc8d46de39b623181e3d2025f1055e0bf64d92eab96f20cf8f861d20c735f697
SSDEEP 192:JR4cBhbyfgBH4omB/v7MF+hKPRpA9lv7bStyamV9HHsb+WNO3GcG+zxN1YytefnL:JR4mhbZBgXgoCXi1w4FYjnLaOvL
TLSH
T18162B56FE820297B6EDAD215F921BB57D3F5102191D41EC0EAFC8A1C11EB6CC6317457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 af41a3d1e2a284a57cd9865907428caf4f035bbc424485232a453a42ade964f5
MD5 9c1c3c08a20030038a35b8fa8defe458
SHA1 a2126bd3ffc2cfb8ead254d86b54abad5df40094
SHA512 4ae9756f5dea32e4d6ce4e625e5b22b5c641828e4f68f16188828a7611b3b4e346d4cc9c95ecfdb4d419d8a8936bc61a8d6e1bf7b588347d0f368ba57cc29f87
SSDEEP 192:JR4cBhbyfgBH4omqkv7MF+hKPRpAWy8LvSl1kE+yO3mr7g9HHsb+WNQjphQcr2Kb:JR4mhbZBHAgoCXJ1wM6MFAuoYnLaOvL
TLSH
T10772936BE96019B79AEAC225F821FB5BD2F5202591D41EC0AAFD8E1C10DBBCC7307457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 181fbf8cb06d7eb53b3c6b23c97cf0d676c777118aec5b70977dc4bb0230eb5d
MD5 4b9ef8901bed5b742ae0da7f87eabe9e
SHA1 15614f82d296a6862dcbaf04e7fe8371ff42cd0c
SHA512 fd94eb80d380de77a68eb0af9ec006d018b0e49ed5fa6dd5c54b27b7e7dec86dd7b6fff7399ad1f28cf47b6919a0347c90401b0116512688d783edb86cc74cf2
SSDEEP 192:JR4cBhb2fgBH4omqXv7MF+hKPRpAWy8LvSl1kE+yO3mr7g9HHsb+WNQjphQcr2Kg:JR4mhbNBH/goCXJ1wM6M9MAuoSnLaOvL
TLSH
T13872A46BE96019B79AEAC225F821FB5BD2F5202591D01EC0AAFD8E1C14DB7CC7307456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7420467b11a4a0223800f923b2b3d3884e6358fd6a917df313e89a35ee73c2b6
MD5 5a5850cff983f8fc5dce428c446555b5
SHA1 ff13248b78de81aedf33adc6cc239f0395510dda
SHA512 2cf293679f43a0e56efd027ecf3024c5f460b4bcb2010bb48714649de1482b78d6319bd70dcdacb61ce6bfd540ed6bc4e8fbd3a03867a9477f69c09ecd52533c
SSDEEP 192:JR4cBzbyfgBH4omBIv7MF+hAPRp2zJD9HHsb+WNnG+z4s27tefnrPaSVyIsnAUge:JR4mzbZBgUgo8Xo1wbD2InLaSe
TLSH
T1F752C52EED10697B6EDBD219FD26BB53D3F5102161D42E80EAF88A1C15EBACC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e369711e5910bb1dba52687bad0166e0c8e783b61d795aac554b31b5fc4d5df2
MD5 bca7146904e1d13e471e733b907013ec
SHA1 fa548b9d848b5c0aced2542747125653e70cb9cc
SHA512 674f069a72fe4921aac7b547e09b4041e92b5a813ba7acb611198ccad6671b500f9b20079b21cf4548e6974cc7d2a1038408877727aac985ac7c54ab8f93bfd2
TLSH
T113B00295C102A213C05213F425D5A6D87164EF65C6032273A3E01AAAFD256B28525165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a14609053b9fc7eb49e8e71871c3e1c8ffeb2d12efa49a79b4e90c3046e63b03
MD5 6752fe76f79598efaf37ea66daca0607
SHA1 f4d5280e3f320c804a733d1fdf65b4f7b5891809
SHA512 2ea48ce554fb7fa596811bb6c91e1e6b928b50acc7a9ab1b7bbd61144ef48977809f3c073907eb35c08f634b32449e620a8b5929925f129f5665bba0968e2f2f
TLSH
T1A5B0120180016101C0420AF42192549871246F10E64E670183F07D33C8391618034062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 513bf064e365c93755141e832775931c754639cf783cecc3a1b7e509982e55e3
MD5 e110ee0e22dbee8715d7effe66bf003e
SHA1 718b635c50533e89f4f62e0ccbb1efe85d5c2e94
SHA512 b95bd460e13cd235eca394b33188c44a52709c5719751f912820914a44ee1016b9b8dcacf73dec5536cbc139de2d4b0660fd2de998cc64ade3d54c544ad73d25
TLSH
T1CFB0026152141263C1081BB1DEE392D073245D215BD3A751C09D049D9550AB56117883
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a4f6b1a3650cd50c3b309aace7387ff32aeac1e7d95ac26c464007ce631bd18c
MD5 65d790f2af470c8deef75ede48d8dcc8
SHA1 18dd39bc2bb5353223ef0697af1a91da3fcc1731
SHA512 229a57494bb066181b547dffe0d534e3de1d4f44b96d920f03a9102fd12442bedfaadd3e7df871ca5fc252b64c95859d83a1b5659f811037d8f33c497ff9addf
SSDEEP 6144:bwNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bJ6bPT+kJJp9oBGcAo2
TLSH
T18834123A5D703D798A7CEF09700E181F6DF247539D28C9D6D4C06E0CA7EDB88690A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 4f6662bcce5b6bdbeebc8ab1432c51507738879781690ce264b61dcae08fde44
MD5 6d767dbacd6474abc7054327601df9f6
SHA1 dfad74ffe6afaff84e6e23f9717d3d772afff73a
SHA512 c1392f997d77b52b9486bb88ed618e6a12527869dd62553ff3370ea59d3d484c50f642f392e35465a4cb2af25175f8cd1b82108c5ae4defe750e0c386cd5cf5e
SSDEEP 6144:brNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:b+6bPT+kJJp9oBGcAo2
TLSH
T13634123A5D703D798A7CEF09700E181F6DF247579D28C9D6D4C06E0CA7EDB88691A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e5260a57fa3f4303be0bae258efc3eaeac5383f3642e746b1c70d32b6f95453a
MD5 028a94b4e98d01fa3fcabc4e2b645a4a
SHA1 0e52c2ba1bf520aa05ef6bcaedec23fca85dc89c
SHA512 8853588cd03ac693f501d634f1d9f9385027e0d061fcedd9d54a2da325997b417665d220378fd4b7ac326cdbaf44fde267fd530e96611d342cf54d4705abdf84
SSDEEP 6144:b6NojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bb6bPT+kJJp9oBGcAo2
TLSH
T13834123A5D703D798A7CEF09B00E181F6DF247539D28C9D6D4D06E0CA7EDB88690A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 298KB
SHA256 413a2423cefa09e3f77692e2aab78586b83901f0d0e1fffacb8f553815875861
MD5 fdac5a7bd2f390920736f2e1102433b9
SHA1 bbe1d4d000a8581fbf03fd23db4a2f57dad06798
SHA512 63fb12378082e783a6580539004a11149eb39a1cd2e2272b2cac618ae0f27860ca5c489e21529a22a97e08f87dfc69726a225cfdfc2605a6f2f24d2d2c72e1ac
SSDEEP 6144:Tyl3lJudpgsojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:TSlJoI6bPT+kJJp9oBGcAo2
TLSH
T1A05413365C202D3A4A79FB1D700E555FBEF24B53A938CADAC4807A0857FDF896A13439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 39e8e44809d6dfbf1dad0aedb9ea1c752189c1e22dda42135096e45e89bc7e07
MD5 694f330b18508ba5fa65e45948ff4c89
SHA1 d7eb0b36bda1efcd79573c5a24e9ef354be3cdaa
SHA512 47349ae4933e6b59bd3e402a4ccc35ab4993b1ab26171b797a9874394a41430817086fae564a69788efd3fcb18b04bd7a6b2e6ef1906a65eb1e4e6a0012368d1
SSDEEP 3072:/zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Km7Rkm1tYpBeh2BAoM
TLSH
T14DC312275E75E8375978BB0EB08E0B1F1EF14AA6C830DE92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 448eba61adfbb086e7ba7a2f034881f39397deb510eca30084a6887f0b2fdfb8
MD5 e3eaef4a094115ff27158f5540c32da5
SHA1 903fa61d5e6ccd55fe27d321cd6cbe38c3d03dbc
SHA512 cfe587f2b6182717b6d153c85616fa203eeb362d9996c23688634b5685363933a3e5fd74673926967bf96a6960533f710c4e25b5e13a00f794b1e7646a8c2a7b
SSDEEP 6144:byojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:b96bPT+kJJp9oBGcAo2
TLSH
T1A73413375D703D798A6CEB19B04E485FAEB246529C38C9D6C4D06A0C67FDFC9260A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 38359ce54cd7e7596734e05635a11bf08dd199de33e6d99ac9f9c369db73742f
MD5 80b1eef408160f9af97f5aa7ba635b00
SHA1 01bbe80c8bc5fae546ddea608b1934cf5e213ea0
SHA512 c7a0aea45cd2ee5687e45f4099fd8b0067df00cfa4314bec62437ae5c57e0119433c7422129e8779784d380dd78c73540aaf2d1610015d3d83eebb747382e20d
SSDEEP 6144:bSNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bD6bPT+kJJp9oBGcAo2
TLSH
T1B434123A5D703D798A7CEF09700E181F6DF247539D28C9D6D4C06E0CA7EDB886906938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 67be665d31aad5e3a2bd00e921de17733449affc9f9b574beefa7558de679bf2
MD5 4095ee9caddd09734a4cf03ff906b97e
SHA1 16852bde10098b5775d66484c143485dbea2fe54
SHA512 6e283391d9daf3c2c0ebfcbcb461651a933991571ab49b3a0fe2ce3b0afd8ff2e9820f5182d13c1c4ab9f2052915cebf0bfa281489cb09fe4057caa83dd156f0
SSDEEP 6144:bgNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bZ6bPT+kJJp9oBGcAo2
TLSH
T19734123A5D703D798A7CEF09700E181F6EF247579D28C9D6D4C06E0CA7EDB88691A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a0769e715e8c1a886120950ba6ec7a6bae8b628ae73a19ad8bd425047d66a405
MD5 25f913d27b8f25a9fc6e6188c16fe38b
SHA1 d2b87678e9e04fb37e2052b0cca6d0c05bd1a69e
SHA512 f87ddbd84943d0d59c4d342db9a6779661abeac3f2ff1dbaafbee785abdfc8eda2d59e5e9e16dd48ef502884e913ca21ad2dd1810b9e52315756fb2bacd46b25
SSDEEP 6144:bpNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bU6bPT+kJJp9oBGcAo2
TLSH
T16534123A5D703D798A7CEF09B00E181F6DF247539D28C9D6D4D06E0CA7EDB886916938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a4644f8d46a4f515c9e606b8c5dc1a1dea769ec79a5dec9d5cc07202e701fc53
MD5 00a5b7a4691264af0bacd0cb61d5beb5
SHA1 8a1290d95f19c8423e306d229b23a7899238b950
SHA512 80de900b96182309bd6d502429ddfadcaf85a5c98640accd21120384c94e37cf53d6d904cc80bc5be5a3d3bb036cc7414d3f9969e05307a0a35a051962040525
SSDEEP 6144:TpNojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:TU6bPT+kJJp9oBGcAo2
TLSH
T10C34123A5D702D798A7CEF0DB00E181F6EF247579D28C9D6D4D06E0CA7EDB886906938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 826b41f59e9b5714aa26df36a97a6a254835650e0bd67748f3efbdbc1062a2f9
MD5 8f1421d713485ab2b2490555a53e4cf0
SHA1 1f93d6819b0bef17d9ebe1a770381b67915d62c3
SHA512 c07075a3818aee026ca66c5589fc9384db223304b88036235455a65ea9b8059aa397bac4d6dcfb6b353905ee547eec28dfeb6c25ff7e1bc526e99f998327a2b7
SSDEEP 6144:eyojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:e96bPT+kJJp9oBGcAo2
TLSH
T1BE3413375D703D794A6CEB19B04E485FAEB246529C38C9D7C4D06A0C67FDFC9260A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 87797c07f14e082ec133c655a1e76ea4a33ab1cc86f42d5e580bffc08e46e481
MD5 bbe426c24be83cea275962736ca33fda
SHA1 3c31c10349642ec6c387a3707cf361e7bcb19801
SHA512 9fb6106825bdc71d186bedfa5928cdf665ca1bbdaea078e0ddcd479606c067ae899e94a22eaf829c8bd3b83d39407ae4b1784e3d3afd75b6a5ce739e9137145d
SSDEEP 6144:b8NojdDx6bPYMk43/mkBOECo+JBm7Rkm1tYpBeh2BAo2:bF6bPT+kJJp9oBGcAo2
TLSH
T10B34123A5D703D798A7CEF09700E181F6DF247539D28C9D6D4C06E0CA7EDB88690A938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 d39d05f87f982b0606fae9512829aa67a7d179aaac554109060421203439164c
MD5 4377ac6ef1686d251f4084a2d01e1a3c
SHA1 ca2558ba7bf9a5a29790db3212bbb47590cc00c9
SHA512 e3e37ef128ee830443980032ddad0ef33f7ef4c9463599c84fe4d2b80b1d93ae5505b343a23b6ec3565a64cc367bfc1eff752e6e8ba2168f3b35c66eb55904c9
SSDEEP 3:MsEllllkEthXllkl2zE3rqQql:/M/xT02zLl
TLSH
T1EA440405FFC00415CD3310354111C35473F0F510051F5F47347504175CC55443C00105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-MSC.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\CLS-MSC.dll
Size 334KB
SHA256 6d3d6b0ff25fd2ac2c8d478b068af55cb053d9b2c08c53964d6559c7c8b8047d
MD5 67a3a34ecafc68afdf05f71657ee0009
SHA1 2ed842e3244992dc2d5d36e5c481d048f433329a
SHA512 a673ff2c79d59cc2c02ffc79269bf4ea019a19f5b7766f375ccb4d5cda68335ea1f36c4875ebaa0f390f1abb37494cb13c075359a1735982621c61e42f34e3af
SSDEEP 6144:vsh4MeMBtdQg19DA+G5lskemd4n/NIM61O+VNk:k2nM1bk/LnO/NIM61O+k
TLSH
T11074D017FAD24C72C1C22A350839A6369A7EBF480B1F45F1E7CA9D58BD2DE803559393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-srep.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\CLS-srep.dll
Size 85KB
SHA256 af4379f3d8e12938a2f4e6d8f7d8f135181c415fa6c443b27eb44c3be173b2ef
MD5 522d2fe95820798431e59bd982c373c2
SHA1 e04def966208b662eed6b548d2c5e0c4d9e84bcf
SHA512 9e2afd800fcae018ed6ce3ccb32a9f73c2874a8cd5133112c346feb5009829dcd1b0be3d13dc0be046b68b40bf5d11e4165f6bab736588bc6e999fe9f4f2a6fa
SSDEEP 1536:OCLIaGSA3PDerNRevadEbvfOPlklXFMGUMXiw1o+9sbv8RlwzJ:56SAQduvfajGUyiw1ogRY
TLSH
T1F5838D20F2C2C033E45559344878D7F39A3EBB369C79D1877794267DAEA1AC08B29367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\ISDone.dll
Size 452KB
SHA256 bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
MD5 4feafa8b5e8cdb349125c8af0ac43974
SHA1 7f17e5e1b088fc73690888b215962fbcd395c9bd
SHA512 d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
SSDEEP 6144:QdFS9nBbvESTi3qakl6j+vn+nLE4FZZHYnf9ketkqOGzgsgmInbAKf3:R9BUqmvLE4FZKf6eDOG8sgmInk4
TLSH
T147A4BE23B6D2C572C00B92308D16D7F5A679BA209F2886C3B7D8DF6D6E351D05A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

callbackctrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\callbackctrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

cls-bpk.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\cls-bpk.dll
Size 227KB
SHA256 20c1c8f1a70470e18c898d35136fcade1fa1cabdd069c564415debfd1a26c403
MD5 d31067a2843518379a3166d031be68e5
SHA1 555646cf61ca4beefc0aba44337c614154ebfef8
SHA512 102ec7aa932a6ada90a167a5c7f32ba76b693ed5b0f57923ffa23b833e42146aa890092b2beb6ffd0cb51caea09179b1d7fbc1b2336f50acabc03d4da1f72701
SSDEEP 6144:YYhzMggeKCHD78GcvNzH1zFGLUMYOo5rwvdGyjzDB+:YYh378GGeoMYOo5U1Gd
TLSH
T1B7344B80BBE6C270C85A0D347139FA17DA78380C5710D967EBC49C3BAC6E3515AB7799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cls-lolz.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\cls-lolz.dll
Size 16KB
SHA256 87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061
MD5 9e1e200472d66356a4ae5d597b01dabc
SHA1 8d93246907a422d2333697cfe999cd9aeaea764c
SHA512 dd16e9c0831e72d19b1bf1431a2c8c74bcc183cfa16f494b5f11f56168209948744e0add7f2afe62db7f34adddf940fd570e28d60bebf636e07f57a0bf0346cc
SSDEEP 192:ViqxKy8IfoIqixWXFHsR61Ane6cp0c5ZJBG5LXYd5qrGmbz+q:cOcbXQqA645LXYd5qrGmbz+q
TLSH
T18872B6C61FB54061C09166B4752AAA37BF39641EF3C90B6697028528C63BD4CBE1DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

facompress.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\facompress.dll
Size 355KB
SHA256 17a9ffdf381f7a9f6cdfc85b157fc6cf80cd4b45ed8ad43edac73008923501a0
MD5 d43845f28651a42ba2105fcfcca5253f
SHA1 9aa415b9e8039caf6e07bc074185d5e8a9f486ed
SHA512 16ac57254b81d6cc26c8c07ee07ee9b648c2b2b167c380da2fad87e3af9e85c7dbb0795f696ea5083f06af424ddb6c319eec5799771a9a7887cf02116e7737ec
SSDEEP 6144:9tT8Mz2xqbg0bQekauOR3RKZylxx6Cp3Dp+rI5b:9lznnRpln6CF9Nb
TLSH
T189748E50F6E340B6D0971D342597E733DA3E69210530ECA7EBA86F2DAD622C07A3574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

facompress_mt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\facompress_mt.dll
Size 204KB
SHA256 7eeb2c50920e30544e2f180b0c39488501372a8f8bd8393bcb095353e9114cde
MD5 002508839634e56d43e4fd56e3df2757
SHA1 0cedf5289c102e75554c08f56361a294767b8fca
SHA512 2f35fe7e2ceb64fa7fdda0db704067ab7144a62709044b88d2f203b48046a8aaa270673dc14c1c61d1b961e03874c616f21df1bee7ae104f19eb6b4330e31a0c
SSDEEP 3072:DMukVxipnnjmchYh8BME3NUtelyZNVRWfTDL:IukVkFnjghjE3NUt2KGL
TLSH
T171248EA236529037F0AB283835D6A772697D3D110270CDABDB940EB90E513B87F75A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srep64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\srep64.exe
Size 497KB
SHA256 0a5c85eb11dc7130c4191b9899a4f06889861f80bfb104fe167d01a52d04c755
MD5 09b45cc49abceaf93e249e837a2b0a6e
SHA1 09c94106f140264ce0950dd6c28c8484a3295fb8
SHA512 cf838168588373d7d99c8e93037c2c0faa112125a0f3a976927a86b0e24cd515aec54811b9efae1e4781bb0e45321256082e307c148f0a836dcb9f507eeb8d93
SSDEEP 6144:mDJlpiyov0NLio1objLkv+TR6ub/YFq34rbp9W/ZEhInBuJfU3v:Mfiyov0NLlEfkxQb4rbro/8c
TLSH
T110B43A1BF2A212F8C66BC2748767A333B931B81811387E3E5B54C7312EA5F51676E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unarc.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\unarc.dll
Size 320KB
SHA256 89952411324163a635942db33dd0087508e20d112e1e75403dc1d5e852927dd7
MD5 2ced17f02b24372c166faaf7da2dffb3
SHA1 8e2e6d6855095cc032eb5a9c8e1ed975d60ea5df
SHA512 8aadcf0249ef17519c329ce586a2d29ec7dde7898bb2b88650312ae4098010cd351bb45bad703ec69a14507ef87fc37317b9d8eb8a6068fb61fd15255807d4ea
SSDEEP 6144:+wANmVlIjvd8bucF9go9PYEPGIB2PxO39sQ1515cvKvSfto31BXWEPAENRNG8:+wAUFmo9PpGPxO3fZNRNG
TLSH
T129645B54FACB40F2E4070D7090AAB33FAF3657098038DE76DF88AE55EA73A22591D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IOAKN.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 603382d23628c9af410331226ed6cabdf84ada84cf7669401b7f36503c98ff9c
MD5 2aff1a30a4012b0ad1d98022e46a93ae
SHA1 7576d74a2fa0b44fd7942d82380abc6b700d439a
SHA512 9454a67fa564dae346506ac7e341c96ad8bff4fdaa026020b0ea7b86e09e9e6f4e772ff3658239f91b05816b02acec707a666db6d54c210c52ef5c49d091107c
SSDEEP 96:5sgskObBOJXFrJKwqmxs9JFhx0wvxs9JFhx0wvMsNwa9Isgpwk5W:+DP8LKwq3ywOywVNwISwT
TLSH
T1B722F4613BFE6A12F2F78B35A9B13350AF39F8128D05A90E62C483440962F146959B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 7ed42f2e971003648b384056cc7b56902fb5944f9bd246594e53f6a0297117c5
MD5 a56f889593fff836872816ae836120f0
SHA1 985961db785fde94c7df5f21d88691364282c203
SHA512 e4ec27631ffccae4625e77a7145f88f4889e471ba4f5500da48284fd129c787304202bc1d1227b0cecf00f96e833fbe04b40afe0db2b82d2a95119b16a7f8fe1
SSDEEP 96:DsON1+TwvrsgskObBOJXFrJKwqmrs9JFhx0wvGsNwa9msgpwk5W:IO6wYDP8LKwqBywnNweSwT
TLSH
T17812E2553BFE2A52F2F7CB35A9713350AF3AF8028D15A90E72C443440D62E105A59B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 7ee8a472415438d92be1f7e709a14ca94b42ffc329f938e70e33eff4d45a37e1
MD5 643fe215c6cf4fd0353a0a151754a70f
SHA1 20191c81d025a6fe420e1eacda2e5ffcf3522c9e
SHA512 9340a830da6ddab083a3fbe1af4e66e52fc8980e46471b739f94fb321fa192d5fa6e9f80f0a3e3a7f29367817d2f73525ff226337e467296aa354a3b3da7cc39
SSDEEP 96:1y9TFFewvis9JFhx0wvHsNwa9Psgpwk5W:oowDywkNwhSwT
TLSH
T15702F2513BFB6A06F2F7CB35A9B13351AF3AF8028E05AD0E63C483440962E14595DB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 06181269b50641564a031506488d16dc6fe71dd8064e2f6f3138dac647152d4d
MD5 5eb66a9fae64b3c4b5f7adcaee183157
SHA1 7ffa8b4c475c8d7e65443c1cce9332de1ca66558
SHA512 180f666d94a6000acc667b5c0210807ab4e00a6365bde3065eb116d4f7f6d6b4cc49a5c82a1d7c6a0c317aa5dc2e411f955b57c36f5150e5748cb987e123985c
SSDEEP 96:Dsonw0rsON1+TwvrsgskObBOJXFrJKwqmGsNwa9msgpwk5W:Ionw3O6wYDP8LKwqqNweSwT
TLSH
T10A02E1553BFF2A02F2F78B35A9723750AF3AF8028E55A91E73C443440D62A105A58B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filemappings.ini

Path C:\Users\Public\Documents\Steam\RUNE\1794680\filemappings.ini
Size 32B
SHA256 fe5ec454246b1ef562536be0f61ca6bf160a8ed5c426a8ff98e22f4ceb06ee3f
MD5 c8c2eb914b2531d151a35db971e9f251
SHA1 116479a2c5a213360f7cb121f947d5690e45ce89
SHA512 e17a3fd0b0f0141e045a85712e8bace6d32adcc28c080efbf8365215994436c3af8bb94992cc408fc4bae7f4236a53c843ca3303c6eb6c5cc018b9ca4bfd8362
MD5 SHA1 SHA512

Submit Download

memory/452-3632-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/452-3835-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/4252-47-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4252-46-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4252-1039-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4252-0-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4444-1315-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4444-3629-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/4444-1265-0x0000000003560000-0x00000000035D7000-memory.dmp

Download

memory/4444-1264-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4444-1297-0x0000000073550000-0x0000000073557000-memory.dmp

Download

memory/4444-1266-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/4444-1243-0x0000000003560000-0x00000000035D7000-memory.dmp

Download

memory/4444-1267-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4444-3862-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4444-1316-0x0000000003560000-0x00000000035D7000-memory.dmp

Download

memory/4444-1317-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/4444-1319-0x0000000003B50000-0x0000000003BA9000-memory.dmp

Download

memory/4444-1318-0x0000000061080000-0x0000000061115000-memory.dmp

Download

memory/4444-3627-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4444-3628-0x0000000003560000-0x00000000035D7000-memory.dmp

Download

memory/4468-3875-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3898-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3968-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3959-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3940-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3915-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3888-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3882-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/4468-3872-0x00007FFC5BE10000-0x00007FFC5C0A4000-memory.dmp

Download

memory/5640-1081-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1088-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1080-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1086-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1090-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1082-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1087-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1089-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1092-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download

memory/5640-1091-0x000001E902DF0000-0x000001E902DF1000-memory.dmp

Download