0ff09f4ac062ebc47f837e83cc06bb702fb09d7df1b25740dd6ab884c1958c4f

Resubmissions

29/07/2026, 04:23

260729-ez4bwawwez7

29/07/2026, 04:07

260729-eppqqsgl4x7

Analysis

user interaction
yes
max time kernel
519s
max time network
434s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2025-10-09 185700.png
Size 214KB
Sample260729-eppqqsgl4x
SHA256 0ff09f4ac062ebc47f837e83cc06bb702fb09d7df1b25740dd6ab884c1958c4f
MD5 32cb9f3088c086e558bb118e37e94a3c
SHA1 b14d52e9790b2d521e58a24c8566999d633d6f2d
SHA512 054db80eb38e8787531e2b8f4a7dbbf00b645406070af2543a67da6d757af38fadd465d7189e747e3ae11f27a84a79480faa25792757830827a07d67afe4f0c4
SSDEEP 6144:wvpmEsJdeLVRIv2sZIukmCxj5arsSRYweTO:wvpmfcLbIv2sDWaQwyO
TLSH
T1332423417D873F869CF2064E8078F1A71C74A6ABCE8D1C867DB490D49D42487FF85AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 18 IoCs

pid	Process
3056	Stardew Valley.exe
5496	Stardew Valley.exe
5500	Stardew Valley.exe
2516	createdump.exe
6248	createdump.exe
5920	createdump.exe
2964	Stardew Valley.exe
4792	Stardew Valley.exe
1680	Stardew Valley.exe
5260	Stardew Valley.exe
5336	createdump.exe
2252	createdump.exe
4860	createdump.exe
3964	createdump.exe
7512	Stardew Valley.exe
4956	Stardew Valley.exe
1300	Stardew Valley.exe
4244	Stardew Valley.exe

Loads dropped DLL 64 IoCs

pid	Process
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
3056	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5496	Stardew Valley.exe
5500	Stardew Valley.exe
5500	Stardew Valley.exe
5500	Stardew Valley.exe
5500	Stardew Valley.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	chrome.exe
5900	msedge.exe
4496	msedge.exe
3544	msedge.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stardew Valley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stardew Valley.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stardew Valley.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297716543032541"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{DBA4BEEE-FA89-4D46-8DAF-8A2BE0094616}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4716	mspaint.exe
4716	mspaint.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	7zFM.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
4732	7zG.exe
3940	chrome.exe
2856	7zFM.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4716	mspaint.exe
4716	mspaint.exe
4716	mspaint.exe
4716	mspaint.exe
3056	Stardew Valley.exe
5496	Stardew Valley.exe
5500	Stardew Valley.exe
2964	Stardew Valley.exe
4792	Stardew Valley.exe
1680	Stardew Valley.exe
5260	Stardew Valley.exe
7908	OpenWith.exe
5056	OpenWith.exe
7512	Stardew Valley.exe
4956	Stardew Valley.exe
1300	Stardew Valley.exe
4244	Stardew Valley.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3860	3940	chrome.exe	95
PID 3940 wrote to memory of 640	3940	chrome.exe	97
PID 3940 wrote to memory of 5424	3940	chrome.exe	98
PID 3940 wrote to memory of 5424	3940	chrome.exe	98
PID 3940 wrote to memory of 6084	3940	chrome.exe	99
PID 3940 wrote to memory of 6084	3940	chrome.exe	99
PID 3940 wrote to memory of 6056	3940	chrome.exe	100
PID 3940 wrote to memory of 6056	3940	chrome.exe	100
PID 3940 wrote to memory of 3420	3940	chrome.exe	101
PID 3940 wrote to memory of 3420	3940	chrome.exe	101
PID 3940 wrote to memory of 5372	3940	chrome.exe	102
PID 3940 wrote to memory of 5372	3940	chrome.exe	102
PID 3940 wrote to memory of 6020	3940	chrome.exe	104
PID 3940 wrote to memory of 6020	3940	chrome.exe	104
PID 3940 wrote to memory of 5244	3940	chrome.exe	110
PID 3940 wrote to memory of 4092	3940	chrome.exe	114
PID 3940 wrote to memory of 4092	3940	chrome.exe	114
PID 3940 wrote to memory of 5328	3940	chrome.exe	117
PID 3940 wrote to memory of 5328	3940	chrome.exe	117
PID 3940 wrote to memory of 5488	3940	chrome.exe	118
PID 3940 wrote to memory of 5488	3940	chrome.exe	118
PID 3940 wrote to memory of 2700	3940	chrome.exe	120
PID 3940 wrote to memory of 2700	3940	chrome.exe	120
PID 3940 wrote to memory of 4752	3940	chrome.exe	122
PID 3940 wrote to memory of 4752	3940	chrome.exe	122
PID 3940 wrote to memory of 3960	3940	chrome.exe	124
PID 3940 wrote to memory of 2060	3940	chrome.exe	123
PID 3940 wrote to memory of 3960	3940	chrome.exe	124
PID 3940 wrote to memory of 4088	3940	chrome.exe	125
PID 3940 wrote to memory of 384	3940	chrome.exe	126
PID 3940 wrote to memory of 4716	3940	chrome.exe	127
PID 3940 wrote to memory of 2732	3940	chrome.exe	131
PID 3940 wrote to memory of 2732	3940	chrome.exe	131
PID 3940 wrote to memory of 2484	3940	chrome.exe	133
PID 3940 wrote to memory of 2484	3940	chrome.exe	133
PID 3940 wrote to memory of 6016	3940	chrome.exe	134
PID 3940 wrote to memory of 6016	3940	chrome.exe	134
PID 3940 wrote to memory of 2140	3940	chrome.exe	135
PID 3940 wrote to memory of 2140	3940	chrome.exe	135
PID 3940 wrote to memory of 3188	3940	chrome.exe	136
PID 3940 wrote to memory of 3188	3940	chrome.exe	136
PID 3940 wrote to memory of 3504	3940	chrome.exe	137
PID 3940 wrote to memory of 3504	3940	chrome.exe	137
PID 3940 wrote to memory of 5232	3940	chrome.exe	138
PID 3940 wrote to memory of 5232	3940	chrome.exe	138
PID 3940 wrote to memory of 2856	3940	chrome.exe	139
PID 3940 wrote to memory of 2856	3940	chrome.exe	139
PID 3940 wrote to memory of 700	3940	chrome.exe	140
PID 3940 wrote to memory of 700	3940	chrome.exe	140
PID 3940 wrote to memory of 3908	3940	chrome.exe	143
PID 3940 wrote to memory of 5540	3940	chrome.exe	144
PID 3940 wrote to memory of 2832	3940	chrome.exe	148
PID 3940 wrote to memory of 2832	3940	chrome.exe	148
PID 4292 wrote to memory of 6028	4292	msedge.exe	199
PID 6028 wrote to memory of 1516	6028	msedge.exe	200
PID 6028 wrote to memory of 5900	6028	msedge.exe	201
PID 6028 wrote to memory of 3824	6028	msedge.exe	202
PID 6028 wrote to memory of 3824	6028	msedge.exe	202
PID 6028 wrote to memory of 3824	6028	msedge.exe	202
PID 6028 wrote to memory of 5748	6028	msedge.exe	203
PID 6028 wrote to memory of 5748	6028	msedge.exe	203
PID 2380 wrote to memory of 6412	2380	msedge.exe	210
PID 2380 wrote to memory of 4496	2380	msedge.exe	212
PID 2380 wrote to memory of 5856	2380	msedge.exe	213

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2025-10-09 185700.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff988d1c728,0x7ff988d1c734,0x7ff988d1c740
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,16785364813490872829,223250324706316086,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,12267621519979127407,4306107496350330977,262144 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7950095348751595102,2502043648907054408,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,8516792483537148283,12998538493077214634,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3472,i,4110019178164145063,15639960794762175937,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,15671555292895768446,14070575782678202575,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,13532799758768764949,354503485117843651,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,361532736605760168,1345033918347336936,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3092,i,18179569917950258347,1199373400067379962,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3276,i,6014839716078062696,12096406355083658644,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3572,i,8136030192462882257,14343011085075476461,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6384,i,9422284446693783995,16985219536631848732,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6524,i,15886237474346969316,15040695276059216935,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,573671544404562862,12242785229710404864,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,2815422523534235960,7669343036042734457,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,11798002082368634696,15871005047696240098,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,11482303459207942685,14525300808071158385,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,11372871583009183130,6799788312189720336,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6276,i,16871377851553978395,7295205901913359544,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6864,i,8062931691239667482,17588900169852400193,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7012,i,16199351066805643400,14937640277197963388,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7128,i,9847648465135967492,9426372497914243770,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6888,i,9770998704465764762,4395591428730473802,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6916,i,17637961415567354856,10909499491273887684,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7452,i,16104692087868725279,11975475435357531954,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6896,i,2354742671802753398,14589828525662698680,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6924,i,6319660642746023538,14504156905094915822,2097152 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6504,i,660401082956010329,11526260321353953421,262144 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,14078528931674347387,5398180019663791083,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6988,i,10939572175171854132,16918147343301047812,524288 --field-trial-handle=2040,i,16086803401252620289,5167568748986557623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:2832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1376

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\" -ad -an -ai#7zMap15176:116:7zEvent9258
1⤵
- Suspicious use of FindShellTrayWindow
PID:4732

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5500

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:2516

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:6248

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:5920

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2964

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4792

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:7324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta9e3961eh01eah49c2hb0ddh5d8bdfac2000
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta9e3961eh01eah49c2hb0ddh5d8bdfac2000 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff978d9c188,0x7ff978d9c194,0x7ff978d9c1a0
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,18015858650555279228,16629431200304430797,524288 --field-trial-handle=2252,i,4209733500783008785,5612371264477709604,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,5445015950776890150,17759486907576057555,262144 --field-trial-handle=2252,i,4209733500783008785,5612371264477709604,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13272991433269552984,16497553693938310418,524288 --field-trial-handle=2252,i,4209733500783008785,5612371264477709604,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
    3⤵
    PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5339b1cdh92b7h4ebdh8226h5e921123a2a5
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ff978d9c188,0x7ff978d9c194,0x7ff978d9c1a0
  2⤵
  PID:6412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,15029694104074141188,6999322744599923592,524288 --field-trial-handle=2332,i,15285370843539819952,3684674992385160919,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,2132481952672033670,8805074475818368168,262144 --field-trial-handle=2332,i,15285370843539819952,3684674992385160919,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,12373421822616915735,14854059559164241593,524288 --field-trial-handle=2332,i,15285370843539819952,3684674992385160919,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Read_Me_Instructions.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4bab8bf8h0041h4c10ha48ah191135a1b52f
1⤵
- Enumerates system info in registry
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ff978d9c188,0x7ff978d9c194,0x7ff978d9c1a0
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,4438046414146666057,7010364386410315656,524288 --field-trial-handle=2260,i,7177599967171854701,2891804838216764709,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,1448626373931440911,4680054495494894390,262144 --field-trial-handle=2260,i,7177599967171854701,2891804838216764709,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,11106956308792192545,132835273312272646,524288 --field-trial-handle=2260,i,7177599967171854701,2891804838216764709,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7908

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:5336

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\createdump.exe"
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:7512

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4956

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2856

C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
"C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe"
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 b332adf64013d477b2521e271779151db15170176493e6c039eeb24bc858de90
MD5 d5d73756fd25c315cd9280eb1c1dbcbf
SHA1 b9774d02b39658bf3d7918fa94d86dd291340ff7
SHA512 720e5b60cfb2e8d7f4fa6e3e75b3fda2d00d827578b7593041fd324007fc2a303ccd9632bdc7c0927cff1545077cd8a8f9cdedcdd5d2c5e1dd39fbfebea6af1d
SSDEEP 6:u/MTPoVNA4g6/dRQP8AlaWQltOB1UmE5+S/StWwvlkPvl+OdD/rpj32Oe/El/fhT:uCPqM6lyPfU8jUmEKvi35/rN32ZElh
TLSH
T17E72927E374D4E46C1A02F38C6EA070A776AC5B5034011DBD6E66510CCD2B585C990C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 571e8fdab6e4a852b56f29311dceafc434aa27b444a071b346d7c929568e57e3
MD5 b70de9b954ca9fd2e7b88c6a92e103c2
SHA1 bac2207a303de408c6af4142f3a573f347b3070e
SHA512 9cb51b0a184483489738471ad36922d668624eebfb2efa3d8ae05a4198c189dd95868c546e20e8eb0d48fd0d170da6e23518f60424188e2fb579dd61ad8dc72a
TLSH
T126E02BBEC975DC7708FD071D60604B46E655171B3741444F3A3C891C4F7423A429A85D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 916ac5d5b06a7de7c2510a60a60ef42f2b8cee6260fbe33f8ca8a9dc64d7aa28
MD5 857094cf117e9620cdc442a6587b8a26
SHA1 bf479d213d32b1f56bd661af3c975d13e46beca8
SHA512 09f23ba1b03325d308f51af3bb2acdc82489c78bec47145bbc058e75a12a6f67c4852bfd91f380e79e6380681d6f12aac6e4f197673f72e7c71312499c3caba6
TLSH
T1F351BBC2D1F081F1DFE4D47084E68E88A56861391C8F6B87CE62559B392FBD44417E7B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7c99e3f561f782d3f27f30c6c3ac9d8dc8d89eba2dda4a3f9c55066bb35d8ca0
MD5 83a7cf40a6e619da0f1df8530c884f17
SHA1 a06d03a23c3f27a7df9c1c9066da288983085e35
SHA512 c833621f9805684eff6cd0b7ea40808cbc5be3c6d8f2a0451fc175e627a2a2847796a4cf3472576f2ac216283bb2baab05380ea5e1c6a93102c8e3b980e3221f
SSDEEP 3:MsEllllkEthXllkl2zELOHHKl:/M/xT02znHKl
TLSH
T1DE4404C47FD00415C50070347113C3500370D5100D1157433D555C33FDC5F410D00440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 a51f3962cddf5bb2792c7fccca939382aaf689e1081a1ca1f17dc64be23bff7e
MD5 122481e8cbfab106252a7d2e22e2685f
SHA1 901fa0cb17534ce01a5049de5d5f5cce073530a1
SHA512 6f4671293a7d980ea1e35c832127c5d9882e3cbaea2250cef0b44f776c38d652856e17445a49fd1fdd322e0540af049ad4d10e5bfa91fb8841f983de16e9cd92
SSDEEP 384:DAHQKYeJoVsWDyk4O4L3gpYC3uuaa/06t/66xz1+MkNtafsfLnKmvT7keSYAsfX+:Ujw4rqru4fbQ8
TLSH
T122A28DF7C3E8962DC92156F0EB156E1FCE5D0924836C386BC9D9AE4B93E2471E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 0943e3e69fb699f390ceee01cb9d71713ea77ce1f19bf38878859d39d5dcfdda
MD5 172edca466fa40ec5d7f6af3f46212d5
SHA1 e8e8928b8902ff15e5e1b038bd1877e8ce26cf5f
SHA512 d0f0300199698cc51491f5121f3a76938d9ac8815fa582c2f4c670f81506798af8a2a76e7ce0845ecd3738b39da44e821db5f0bb93f69c2a70b16e08ff704735
SSDEEP 384:DAHQKYeJoVsWDyk4OEaa/06t/66xz1+MkNtafsfL4vKmvTEakeSYAsfX4nO9W91M:U+w4MM/sum
TLSH
T1F662BEF7C3E8962DCA2151F0FB156E1FCE590924432D386BC9D9AE5B93E2871E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 59f6ad8639eb15eca42299cb3db99c7503c9331f8dd67cde2d8f09badaf05b43
MD5 deb865327a7b8f4a66a095ba4387d39e
SHA1 ec7f6209be947b66ec10d57db6996af820537c61
SHA512 c7a43497d7f353b07a89a6c356c6425d0f3796c4a660525039efbc2bdcf39abd75269c40f4e0a5deab19c49d3381f0bf3a4fdec21b37b2ccf6480e65e44a5860
TLSH
T1C6519EEBD1FE741B1028596F1D49F805597AA8310382A8F4DB9AC16DF0C98F71F16867
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1eedc610cd69731c38ce263401df1d2b8dbef7d3d94247408b64d745308c0583
MD5 d2ed9042a43ab2722a1e813c77f2e8c7
SHA1 6b260da41734ace1cc11b20fa024b74f291a7281
SHA512 25d3f7bf0b67798f345a46b8d821da73c7aefe7804faa39a940bd4fde7a64c02aa4103bcb30684272a4fc96ef33c6bc4b22e52febde88fb7a540b6fdb33547dd
SSDEEP 192:HRfNlWO0vv71hpAPRp2FpE92Hsb+WNnbg7AJ2YH4skwDmVyIsnAUgtaJ:HRfNAnBhUX9QwEc2U4sj+8
TLSH
T1E352F76FB92465BB6CDBD22AFD217B03D7F1102561E51E84E6FC8A1C18EB5CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3adcdfcdd38d477b1a46bcd0b8214823ab51920d20d619f7e1dca29f035e3c50
MD5 4a58e6672b9cc2e89f3ef4f5ebfd30d5
SHA1 466b0380c9504734c0ed424f0bf119d790661426
SHA512 c5ad084abf41c68e155eeccd602fd6ba6316374de9b31c59be9379ac3f7982188491bafa14bdc777466fac5c47e64af4bd0ae3f8441aa47fc085e0ae32813396
SSDEEP 192:HRjcBzNlWO0vv71hpAPRp2XAFyelq92Hsb+WNdLsCYebg7AJ2YH4skwDmVyIsnA4:HRjmzNAnBhUXyQw2c2U4sj+8
TLSH
T16E52D7AFA92415BB9CDBD22AFD21BB07D3F5102565E51E84EAFC8D1C08DB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f4e9f6743abfe9ec55174dea351a6684bacade41e698c798b4175748bd879fd5
MD5 4eb8532203bea3c9af8e794dff3fe1e1
SHA1 0893e429fd92f27f97c0e58b134826f994723e6e
SHA512 a739c149cea26874d5ac9767f778fe88f9773e4faa2f82a9c902e5607dcd3753e00914088b8219e2cad30ad3d80b3a004746acd9f80efef6d2ad5512b02cd6fe
SSDEEP 192:HRjcBzNlWO0vv7RhpAPRp2XAFyelq92Hsb+WNdLsCHTebgpWlC+AJ2DH4skwDaVK:HRjmzNAn1hUXyQwJpPf2D4sjae
TLSH
T1AD62D7AFA52415F79CDBD22AF921BB07D3F1102565E51E84EAFC8E1C18DB6CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 e11e367f76e3bd1c5a5e820a4e37e045e8bc916dcd8751decd9f167ee9b50bf0
MD5 c603d6427f682ae47b8c425660b3b3f0
SHA1 b24106101825c641c8ad8bfdfe2ab90f43c73e14
SHA512 24128ad25b6bf731bb078d9b550387548e77098e7721862e4a9f5c960cda73f80ec5b2006056d9579c7e00b83c892676c66cb6b154bb1289866de17ad75f2548
SSDEEP 192:HRjcBzNlWOZyv7RhpbPRpKXWxrSvflDekly6e992Hsb+WNdLsCn8yJ0TwIVcbgbm:HRjmzNFe1htXd9Qwl1wn6Lf2x4sjpe
TLSH
T12A72C5AFA43419F798EAD226F811BB1BD3F1142195E41E84EBFC8E1C18DB6DC2223547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 fe651cc7504358c2b04908c5f8219ae9c35c554992d82de7f5fdcdcfbb534aef
MD5 75142f98205c9855df1c83847dadf969
SHA1 ad427c41b4535d8167f7e448ef2ea0970435a676
SHA512 24ea45ca120dc691202e2286dd9f52593bea1d81c1201cf1b3d01664c666c28ce15bd0041166735d8dac004d0c4e689caeb1146a915505f38a7b840e101e55c8
SSDEEP 192:HRjcBzNlWOZ+v7RhpbPRpKXWxrSvflDekly6e992Hsb+WNdLsCn8yJ0TwIVcbgbm:HRjmzNF61htXd9Qwl1wn6Lf2x4sjpe
TLSH
T19172C5AFA43419F798EAD226F811BB1BD3F1142195E41E84EBFC8E1C18DB6DC2223547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ed2255bb490d23395b9b68ce1df793d20aec332229cdcbf09fe75ed964293e86
MD5 0c0e0e87c77d8b7ae81d5959c8a807fb
SHA1 c9e520c562bac5afa4ffc13a1c34463936b0f099
SHA512 09ff0a4059621ff8bd5242e39828a095ef82a978936af30e2c0e76618d85a9e5eb5719055abd5e152909a6ea3c1daa7b8ceda3ddc54b6e995309c4b5fe69e102
SSDEEP 192:HRjcBzNlWO0ev7RhpAPRp2XAFyelz92Hsb+WNdLsCHTebgpWlC+AJ2DH4skwDa8K:HRjmzNAa1hUXLQwJpPf2D4sj9e
TLSH
T1B262C7AFA52415F79CDBD22AF921BB17D3F1102565E51E84EAFC8E1C18DB6CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 79ccf8224a1c19dadb4d56791c3f540415fb8698bb0773a47041d9fa8a2d3d3f
MD5 cf8eef7acda3cbb97c69195a28e09841
SHA1 3c6a95568a4436bbd6b9166198140e6c17331e28
SHA512 313dcff10141200552223a105188ef484d49aaf84677f8f6f2176c60134fede60b71a3897e3f3a69579d15aba69e42d0e95141d0cfe9a2358ab58e6657644e57
SSDEEP 192:HRjcBzNlWOZxv7RhpbPRpKXAFflDel992Hsb+WNdLsCHTebgpWHc+AJ2aH4skwD0:HRjmzNFh1htXCQwJpLf2O4sjpe
TLSH
T15B62D6AFA82419F79CDBD22AF921BB17D3F5102555E41E84E6FC8E1C18DB6CC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 654d67a44b7194d6f027bd9f27e5e8879fdeb1b7235423e9caeee76495223bbe
MD5 d0e66b8372f1a461b47fa8171ebab5a4
SHA1 335e532b951305cfacccfad622c76129bcc5f072
SHA512 cc31fc1e9c500e687d9654a807db431e015f2dab7e1178a4454d87322e7869300aa1a547da03347150a81661b69f2e55cf307496ebdbcb2d3a9eee019c2b7bde
TLSH
T146B01200C0415551C04206B41543248C72389F20B60B173143E06962C83516184140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59013e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59013e.TMP
Size 96B
SHA256 66e3aadd2e335fe7f3b76bc2de6b148aad4b858a92bc647b2e748d3063e1efac
MD5 1f5f03e242ecc71f8f9ef2bb95fcab41
SHA1 ea3046ba93bc38f14551aeba844d57f1f36a723d
SHA512 e02d245254b4d266fda9e7ee5aca84f762175265207a0b36a84cbc39d36e499efff17b4e3c32718b925f7d2846c097777409a11896f338c12523a592fe5e83ec
TLSH
T121B02228C2022203C00203B020C088E83020EF30C223032283F00FAAEC2233000308A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 1315e2c8b5a01f0e9889067d3a1a80dd44f691ba62ea663211231bdba583a2ce
MD5 1f411534ce35c58e53047786ffce0756
SHA1 1a154b565e05c125838db8c726e6637e2167fb17
SHA512 f0c3becd7038142fd8a03b913425c01222fee2ad4d2b89c49df117cd4f3cc212961fd7d7aa3b8ee4ac887603210db62302d0f53964d8f199df7054bc68d15caa
TLSH
T1C1A0026009424431D45C86707DC16541275048A59192670645900195AE747514175D43
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5fe54a284e4dae08e2622bb209ec94b9263c586b18e3202ab2106feeeb077660
MD5 04f1a9b8cc98dc3186ed864f4c7889a3
SHA1 8c91eef049051f442cf90d97f422356301a79e2e
SHA512 512ec32d6b3316b24025ba5ac8fd7eed96981f04521618b5dfb173af2258e3b62e8aa8ab380fb3d251fbd5033c31ff550ac72118590793efb0e9f4672cdb39bd
SSDEEP 6144:zkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:HBtdRAoeYCA9oBGcAoF
TLSH
T1063422376F3CAD3225E9775C608E4B2F9CF16AA5DC21AAF581C47B08A2D34D51D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5c6047318c83e8bc3be4ff8a365a7c14b8d16110bad4ee0a18e988b376948bee
MD5 abe8db956a25597dc141e2ebd59e1c73
SHA1 69651a153e26053ef64e2d460002e6c16f92f04b
SHA512 f95fd816bc38c0c93ff7e5ffb36a45b317d7351264bb9a693ef9ffc61eec19f1e624c0668eecd17d6330f37ced912577c72188525124f6ab2814258f7d1617bf
SSDEEP 6144:WkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:UBtdRAoeYCA9oBGcAoF
TLSH
T16F3422376F3CAD3225E9775C608E4B2F9CF16AA5DC21AAF582C47B08A2D34D51D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 93584f0aee2a74d4418b211d715a62fa108b20f3c463faa19d1bbaa2ad383a93
MD5 62532c24ca39adc1f5f5488878595f6e
SHA1 7298f318fa654a3acc4c3c2c28cddcf8749bbac6
SHA512 9744d38834d4836a97ab450d83a7a9dcc6a997373983bfaf8d4558404e2cc49450fddedbddb1947bd4287486dd84ba072618dc7a20d06494329977c8df53ab21
SSDEEP 6144:ikyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:wBtdRAoeYCA9oBGcAoF
TLSH
T1D13422376E38AD3325F5375860CE4B1F9CF176A3DC25A9F486D83A04A2D24D95E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1215f26939861685e734f72a91ff6064369b18bcd3837a04d2df47448c2eb8bb
MD5 2f48fa4495c1577067569c3f4523d165
SHA1 dd637434bf110d60f175b5fd0c6a1f1c7a2dc0f3
SHA512 368d4c39c2ebf84245a98a88f8e8a281dcca03269116ceb484bac580d4c619b6890783ef468b196ca1b77081635bc0ff6eb0f67aa882058ff86c121999a8fd7b
SSDEEP 6144:LkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:fBtdRAoeYCA9oBGcAoF
TLSH
T167342237AE38AD3325F5375860CE4B1F9CF176A3DC25A9F486D83A04A2D24D95E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9a4df3c08020a9f45eed907b884ec6de8378c4372d9bf3c1efdf1a1543334fa2
MD5 28887b4405feb3a866e94fb4e56a2943
SHA1 2ef7edf45ad632422243d6bb60e99ad5c4f6e46a
SHA512 52fc71648f57cb10b53a120ff2649d2dd2da9d919a32f094f0bbfd1ceeef71f1dad9bf3b323f6bc3e2640ea2319c95090e915c8e2d86e76e87de02e94b49ec99
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:um7Rkm1tYpBeh2BAo3
TLSH
T1CCC3122B5E75A9375D79B74EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6552519d3c2d7026e3932205e1a72a7c0b4e3d3775a742fe1e5e839042bd0c8f
MD5 04319d1a6a4eee79808c866d97f4b88b
SHA1 bcc3b9b272c38b9a743e9566bfacb6d9f242701c
SHA512 6b76bffb24bf7890845c8ae9248c12bf59e0c8a97870ed6b055584c0fda24b2b2afd09f236dd6f6d05666a15c23c7001936ac331f1ebf56ccb2d067164c0d059
SSDEEP 6144:SkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:gBtdRAoeYCA9oBGcAoF
TLSH
T1DF3422376E38AD3325F5375860CE4B1F9CF176A3DC25A9F486D83A04A2D24D96E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 276KB
SHA256 f039ccb29f0f9c38bd94a80b2f6dc8629d239f82e9c9ecd21175ce6b33dfce8c
MD5 941f86efd6fb23304bd97a6713e57c70
SHA1 7c34133345f5b6319a61caa6390a7fbc2026f2d5
SHA512 f6a5de3042927263cc67bba738a0ef05bc46a9a45f27ebb050e2f9e6b9c5ab128773e8d151f6ea4d2fa2b1ff9147bea54af85815e05b96f3c922901dbf45a251
SSDEEP 6144:MxmXwGxC/XlKkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:MxswGxC/CBtdRAoeYCA9oBGcAoF
TLSH
T1055422336E789D321AF93B0DA0CE0B1F4CF1A6A7DC25EAF585D83A0493D29D55A4DC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 a7d984887d691b7d5f6a9b4e3f883a57c88f70cebcf1da59e9f87bdfbf97adea
MD5 e7e3e971f3fef2d1c25af2c79a186de3
SHA1 da5dc8524b5907a9398a8ab48a545eb748654023
SHA512 ea3fac26db76bc03e33851c8844d932e096665dbdb68cfb819b08215e1cebaa5b8eae63add579ad78ff1e2bb09a1b4bb0d753dd9e37cfe86659ad08911f4068f
SSDEEP 6144:DkyBtza5n1+IuA+9wCUedCJm7Rkm1tYpBeh2BAoF:XBtdRAoeYCA9oBGcAoF
TLSH
T1DB342237AE38AD3325F5375C60CE4B1F9CF166A3DC25A9F486D83A04A2D24D95E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

97c693e5-e8ea-4b4c-91de-2d22a408aded.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97c693e5-e8ea-4b4c-91de-2d22a408aded.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ebc7b3f56056ed27de92f9153c390137a302c6ea5656a8c94c9d2594837007e0
MD5 f905b9e4ff9db0287afb407fab63970a
SHA1 3a2948b21d1e8486549fbc476d099f233780316e
SHA512 547aff1b792df24fc993644fc5713fa9594914140444aa7ce35000a25fe10453e567a1082c90dbb56c168e57f76c2b9df8e838fcd4314f8a3e400ce0685ec1b9
SSDEEP 192:sxZ3VRc4QQrss41u1ZdIaRuv4IrpLHW6+WNGYveVSphgixJ:sxZ3VaTQrss41u1zIKYLLHbGlPi7
TLSH
T1D932D60A6D28987B5CC7E259FB597B53E3F91022A1D45E489AFC8B0C09DB6DC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 991f9e529073e6d45822700dce7f2455720d28098529390a70d7feef4ac58777
MD5 e2610621e90555adf73b0813e7870586
SHA1 18a9bd4f98abee9d12aaa5613df5d67bd72dc28a
SHA512 6f1e67acf461a017853d2304bcdedeef5021e13aff6f663b298e6445bc4fbca53435c1bcfc345c4fdb671307aa2db6999c6f1b565d492d25edf78b842419c12f
SSDEEP 768:ZYsySOvF6ssi7pLuLnRhWvFvnX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpysyN0Lld:eJSOv/HEnRhWvFvnXu1ja5tN0Lm2juTo
TLSH
T1C6E2EA3B780CCE7E4F804EDDED5A7F8E6EA802CB5698C94047F9845C02C76EA52165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dc57d7744657fdc8d493374967dec756c4c00d74f4a1f0770487792268d456a1
MD5 cda3de0a8cd1cf26443a6042ffbe5bd6
SHA1 1578d820223523a3160964cad514d2781d719f42
SHA512 6baf1756065ca3f93b2f007611d86a3fb30dcd48d91df4fed97626700831873c539fa811ab779f70fec34d7a569038968a2684d2b5d9245d623d7f8d6a02a67e
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9l6KpvBftGp+Mgj4KAphe4KV8p0PHTt+:pAFccps3iwgbkUUkjGPVKEI8p0PU
TLSH
T17FB25C36EC68CABBEDE74F89B74A7A03EEE0126785D859D4DAD81D0C00971DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 803c82b82135f57b0c97b756717449501fdd631b9808f53d3a48e52c85ae5fab
MD5 db09a60b2bf145c1de13dddfd0ea829a
SHA1 d870dccffb54eec13b96a1ca9f776ff62af516f8
SHA512 3686debd4e33acc03d3e68fa3b5828875c1aa17a725042a284fa029411537baadd3d3eb2825d84702a6bbad7989d68d5babcb44d87d20879aca30ed3039526ef
SSDEEP 384:npViF9CcmyWCs3sN/8TUNTUlIm2QckCr94EmpvBftGp+Mgj4Q4LyKe4KV8p0PHTw:pcFccps3qwgbkUNYjGPVQ1KI8p0PU
TLSH
T18FC25C36E868CE7BECD74B99B74A3643EEE0117385989AE8DAD81E0C00D71DD570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 960587a07632ac82e21d1c258d45b52d8159c1d6c7b372036514e10661657350
MD5 e269a688e86dd0084afc44375b94ec51
SHA1 a52747c45f04a999584277073a9fa7cb6ccf93a8
SHA512 1b3963e2edeb97219292398f5370c3ecb51b3c9183da02a6c066ab70ac455c518e0dfc8dc351e2ccf6fae08a8bfedabc6dd89154820c19649d473659098216fe
SSDEEP 96:LtgskO7HON69FJgN6ZRtS9uhUPa9JbFfJztSBtg4W:pDxJ5LZrS9uhUib7RwI
TLSH
T1BB12E12527FA2516F1F79B32F9B233019F3BFC025A14990E62C183450CA2F126999F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 11KB
SHA256 4e0ebf2bf7a9ca230cf6691bd75384ac9d29165fae153d875e10e7369e974a2a
MD5 d7e1957392b6772796cc66fcf1ef42a5
SHA1 90632c40b15296a583a9f9dde6f94b18e4b2a833
SHA512 e0f05c4a7b0b536c05549cdbb18c8fe68ee0f14fddf7a3a3272fea337fb96f9ccd78e56b8816531c745f3ac904429d466fa7588f3b95f12555c6d133bdfbd1ad
SSDEEP 96:ztmfqyiFxyqynhtgskO7HON69FJgN6Z0tS9uhUPa9JbFfJutS0tg4W:RtfQDxJ5LZOS9uhUib7EtI
TLSH
T15F32EF5427FA2216F1F79A32F9B233019F3BFC029A14990E62C1834A0DA5F156D58F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NullPlayer_444975097_230005.txt

Path C:\Users\Admin\AppData\Roaming\StardewValley\ErrorLogs\NullPlayer_444975097_230005.txt
Size 2KB
SHA256 37a6dc3b227bf5f52cb2b366c836aa0560833532dff4b162d7eecf5f9f1966b8
MD5 6849922a68416ff96f9b5d5e5d88e1ee
SHA1 1aa7c2b29e48ae10e3301783578ed6451b8fa751
SHA512 9e6857c0f46721aaed2dda6d7676d5fbdad3b5d6659393fef89b78206aeb4ed3190427b3f1dad45de8ca88ff173cea6012425e1759b15c41cf10e948078ca963
TLSH
T1F0415007F22458636EF6E58F7CC8B605B6F64A52F06281CD90117F7FBEB64A04A30756
MD5 SHA1 SHA512 TLSH

Submit Download

DesertFestival.fr-FR.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Data\Events\DesertFestival.fr-FR.xnb
Size 286B
SHA256 589c428f40cce354221cb7c75e3a212c23bd222952c3c46d1ae966d263f634d6
MD5 c5e1d623983809f6c38c276f1548aa1f
SHA1 7eb8012262ce3fc67c167adaf1be0e6b3276654a
SHA512 9eee975e2453474f643996dee6fe3fca161f08f3b364c134ce46db97c997df7701d2b6af8c8ef85a5528c026b3634668223b6c90263fe59d21a279d1f66e478f
TLSH
T139D0EB413E00E040C1FE99B6461D6010084BE9E20F205067495A282C38B8688EA08E0C
MD5 SHA1 SHA512 TLSH

Submit Download

Tent.es-ES.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Data\Events\Tent.es-ES.xnb
Size 222B
SHA256 83bf8b5c96087d0eae165ca3f9d864df1c677f7a69b1e67620eaee8f9bd15861
MD5 5f6870d85096c9ef6adf00cbdb47c22e
SHA1 7942b3a783c4c1cf294c325113a18017730d4bf6
SHA512 0d10b320fe68559c8fe398b09e776b231dc5797e3dfb5775fa9a328af6f178d28959501b57b5cbc18ef3f1d7e7151d2c5c282f14209bca185ae49c23f0ed3e80
TLSH
T1FAD0234C31E33412D5D6137C13C4C8810E0A157DDA5A71194285864E52467332D5575C
MD5 SHA1 SHA512 TLSH

Submit Download

SmallFont.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Fonts\SmallFont.xnb
Size 9KB
SHA256 98bd749209104b82a9d67776df09249cee11aa355afd621b8e1db96231876c66
MD5 b70b79bfc4cac03ad78c84c14a02fb92
SHA1 4c5d82aa6931e31024db5d643e23b9a1b93d8065
SHA512 4acf7ca8bc56085b1d4b526728712eaac9e8157cc560ea36df1de8f3837b0260b8ff02bbafc5f8a1f8cfcb89853768098325de05fdb4028b87596c29ca9ed4ef
SSDEEP 192:n9vuXu2FbdZm9cHpCdUk2YG6o17luTC4afz8wOj1UFyyOQglm8sXcpVyKpp:n9kuEZm2Yq7luCRfz8D1UoNQglJV7
TLSH
T16012BF161E0198C1B4ED762F8602F71EBAC2A1D6C7AEBCF574A6381D6376743E760242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fall_outdoorsTileSheet.ko-KR.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Maps\fall_outdoorsTileSheet.ko-KR.xnb
Size 140KB
SHA256 9c72afab64c7cfdb4b7f6670698473e46d14b02be705ec8c056d4130174fb1b4
MD5 2457e99f29f79645c30b7f12a842980e
SHA1 078e3f9a5b62712998e76119bcc81dc19d74abc7
SHA512 23256c429d09a293ea720931914159a0af5e1d9088bb58297c7ef59e666c83bbed22ff2cf8236dc029034ea8929d2d13403b05f7a6eadce4a9901c7d669a50be
SSDEEP 3072:vKwHlgjsYM5Gzxy2BmXa0m9z4/ooMub26KWGTlAKoqFYvpQ2NDlyTbJS:vZHugZAmKaVbPGGqFy9
TLSH
T1C4E313471522FC50EA292C3B5C0B223D726A1AF0F86826C416755FAF9EFCB1F0D31A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

samshowtiles.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Maps\samshowtiles.xnb
Size 8KB
SHA256 5c285cf0cefca8fe097a4b82860db781f7e1a6ca30ab8ff240174526552c8668
MD5 c4057b301f18b713376482af4a8aabbe
SHA1 dccf092e74d8338597a91f4dc9d362c860115b0f
SHA512 8943c8783673ba7a66292a17964b098f55c757ed21a3632323448b27cf9dfcec19210cce98bf4cba72a9e83aeb26c309087471021265ea4dd175511327225fe5
SSDEEP 192:mkRnniuFjrvTJloAUTSe78rqY+XDj/GFNhpjFxmOjpt:nniulDcvC+zjmPjxT
TLSH
T146029F64EC1F5EBC630A4D8D6D408291E8B4CB1977DA8A3CF5B4C58A02677F4B1A4336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

summer_outdoorsTileSheet.zh-CN.xnb

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Content\Maps\summer_outdoorsTileSheet.zh-CN.xnb
Size 148KB
SHA256 410ffa85ce5277209fc36152165ab4cd17012c0315029975ecd2e7fcb456747b
MD5 23604079ad84be87502634b071d735ee
SHA1 13dbc07d93b25553d8a76ef39233a17bc894b798
SHA512 9661a652be4d8d6bcbb6b6eaaf4cb90bbbe8d8e6e784986c07679eb5e9ffe9f2af38d56dad77702353a6857cb6a0d2616be364e61fb23dacb543a422b46e8af3
SSDEEP 3072:11CMrcsz/0HPjlL73olwaPx7spBqTh8TnuaKgoBxjDevw:119rcH5YB6ShOniBxjSY
TLSH
T10EE323DD95EA4F081CA5D572F05B022E2DBA43E7391BFCCB1C43D93544A5ABAD028BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MonoGame.Framework.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\MonoGame.Framework.dll
Size 2.1MB
SHA256 92e5423a5d002b399de4369e483577007274c5634745f5414fd508981b7494de
MD5 cb1b96caabdd3839813a1ab966da7ef2
SHA1 4baed41ffd6e466f0ceeb2d7d2e99184b3cca583
SHA512 a2f0cb29cfb765fff6cc5a369c26cffc159f22f1afa3c319154ca5569aa90a048fe42b9f1702803d99e2cfd54edcfcbda0154868c84817844170d6e344b0a985
SSDEEP 24576:UaWVhHPFoTi5d4snVxjY0o9VkLbFPiW9HfiV:UaW3NpPdPOVh0fi
TLSH
T103A5C4F82FA50A0ECA1B5573C19AB825C1FFB0CC36D7BA597A540C983D11BE34447AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\SDL2.dll
Size 1.5MB
SHA256 58f0a2af6653445b48e58ace6890fbe237bf76452c9743e800358d6b935ded64
MD5 8c7e489260f209bb536bd738c3f02b5c
SHA1 b6f57c1ffb6aa24e5aeb873b391e9bb94675e744
SHA512 c61151c0a6adf902467265ea8dfecee72be4865ce75e61cf37a0a1d6e8c41dd151f123276d21e3be34e5190bf6f50daa8261f17e4bd676bde864150155585f58
SSDEEP 24576:XZ83VIbsy6WMiomlQhfgvT4zsRu0NoYwBhzp6:J8FIbsdiLlX4Su0NoY7
TLSH
T165758E4FB3BA05A9D96750BAC687B60BD376744827C097CF3A540BE91E33BE4153A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stardew Valley.deps.json

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.deps.json
Size 51KB
SHA256 8ab39d9208091d1b75aa85c018c1b7b3cf069d87310cebffa1aa2e5bacb24235
MD5 53abe9779c930b952037134cf4973fdb
SHA1 3b2a422a18ce833b273662cb1dd8e59b48185821
SHA512 3d16ed24313503cac619753f3c47e52498a5d05c31f487d7fe2ca7e2c8201c7258a15ce14002b3129744b607e853f7a4ea39466186ad2e851c546b66f1050db1
SSDEEP 1536:qrVEsIhKPMEPrT3XCGjDyiEc6BHa21Fe8kFN92uwtEeCJaYZN1qm:7kN1qm
TLSH
T19E334626D9A04DB701366BA229398694FAA1036F21405C8EB8FC645DDF3FEBB1151F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stardew Valley.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.dll
Size 6.0MB
SHA256 7f1e5b8e58d2758b78570ba771bbeb03d33522f62188bf6c32edf0cf626deaee
MD5 044fef001ff82e43f1e38982ee241281
SHA1 a9d1846b2d4bbfed265ef751bd9141418b825fcb
SHA512 c2cbefa7e0f27bb6d681ddd0152ba218354cdd6d95b3a80849b524e0dcca8cc7d756d8ec79b8b631d3907c108d2623df228cf197aab813574ffb93700d49bfe5
SSDEEP 98304:/9xM1FK/uX7Ug819X/+Xa3Ezy6ZfVAWq3783dVP7O7CejZlgrv:/R/87Ug811+Xa3Ezy6ZfG7837KU
TLSH
T1B4568D10B2B449B5F6FF1BB6B072080E67F0BC95D761AB4D31AA78EC14A2F509C543A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stardew Valley.exe

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.exe
Size 154KB
SHA256 79faaf98dcd88eab9885c29fa6b35129746b0f3b022d4a4c1bfe2ca22996719b
MD5 a3e0b996817b7c4426567f68639833d5
SHA1 9340b07d73357452e30ec5685c66727e676f968c
SHA512 645c6ffdb2430ca68eb387f63d78e0a3e5cc90a025fe90cf225a71180e1d94d3a831e6d6a8a2b4563efe47f044824ce6b0aad23978c23c2a90f817bae88100ee
SSDEEP 3072:j5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4FULCKo47:jBKjK2LFzZNf+ULLH
TLSH
T1B7F3194673A901E8D1A7E2BD8A664902F7763C26473187CF03A172BA0F776D1EE79311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stardew Valley.runtimeconfig.json

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\Stardew Valley.runtimeconfig.json
Size 335B
SHA256 92079d6874c1ba2904e8b0cca3cb39e6ccf178ac0fa01acee661300b3656a0e5
MD5 5204a6865aa93cebab3b3cf5ad5e3b79
SHA1 4634c672517267ce79de1e77957fb1fb5653284b
SHA512 5bddf07e85d7c1a8426c7db6ef13e92e89400f1dc56618c559ff965bfa2a65f73ed253e10dd1336e67d688f7c05373abc046ac7e27309e2aa8fbe8e9623bceed
TLSH
T125E02C36CA146CB711F1233A8522C0C3EA31632300001C4078FD040C6F3A5B20023F66
MD5 SHA1 SHA512 TLSH

Submit Download

StardewValley.GameData.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\StardewValley.GameData.dll
Size 94KB
SHA256 9c03497c2d2ac24c94e2f25b3c2fc39ecde1bc97341e514c5f9fdcc1e759cb81
MD5 b99bad9b0872e753962f1b591575e7c6
SHA1 afbb186bdfd21a688ec12ca1d5e270d9d25d098a
SHA512 c40fa7001dc4547471b88c4e4db7efb54489c03ea1c41ba93ba90b8fd26b448b0850ad68c3231cf43711bdc79001183c1d79b6a0256eb5df99659f05f1afeec6
SSDEEP 1536:YL8ZWEfuBGdV6zkfbH+1CARaI97M2XwsxivmrIHZDbXnuCIgx2J6Ughq4pwzz4gO:1nuWVRDekAx97nXw7vxXntoJShbuzO
TLSH
T14A933AE0132583BDE6CF4B79F124465A46E1C28CB5D1EBEE8B54F84B3FC9B1660504BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Collections.dll
Size 258KB
SHA256 61ef7ce0cb1459e2d58af1795dd0bafe8c925def4620d7ef756ba8ea9c51c0b6
MD5 1ea34151310783585a8326fef2fa355c
SHA1 19f78734d779a14da4b09443395a57bab652353c
SHA512 8c42c677026fbe809fb70de051ff84b31653b07c5d0610358721e529f13563173729793e77f96ef0d966221e1bce1a863eeba7e65463a0b9734d5e5c798f95b0
SSDEEP 6144:f0bzf+JuwsctkH2KrzQ5t056pAje2l3ki7CL/df:f3JuwDiHQNW/7CLlf
TLSH
T188446B05B78C1B13F86E807BEA67C013E6769093931186CB037EE2895F57BC27E76526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.ComponentModel.dll
Size 18KB
SHA256 c3bbd79cad9fc5a8131a2a80e452eb517b470d7aa890bb0d9daa85733705dcea
MD5 acfe404d1f4fc2a4764cb8730f694669
SHA1 4b226ed287bdf7ba97e7920a0a63d72984da8737
SHA512 8d970290bb05e05aeb94b109b326c354b9f5c60a6df276d3de48ad7ff3e5f11ca8ceabc9898595b30aea3b2a776f04457b4a4878f7abaede11a18c244cb935f8
SSDEEP 384:IpW4W1WhvBQScpij+7Co0WECYA6VFHRN71Bmo8R9zMLK2B:lnScNx7FClHmoQ9zFM
TLSH
T1A1824BA2C7A88203ED671D7096BCEA473D3DA7D25E01D77F1A89E6491D927C89B30138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Private.CoreLib.dll
Size 10.1MB
SHA256 b2f486b07e0ec96526cedb244c6ee71f3fb41dffe71dee7dfb03f7d3e2731c3a
MD5 7c5ed0c3e2ab441a064d45fa52283271
SHA1 505a8ae8540487c3a13a29eb48512d07f0d3bd28
SHA512 eb2b02f4c4b1fa2f2d885cca0b1c05d060efbb5d14fb69828daa29c9f0e02fa9c045aaf463f9de180fc8b1defe249d52ddbdc342896ef85517946ca1c31d2e58
SSDEEP 98304:xKMweeI2ZQsU+fRIwvUVvJS63bXqPrLAU4n/0v4/PyGvjt:mC2SsU+fRI/VvJSyXiOyGvp
TLSH
T1BEB69E25E7D85B1BD01EC6BDC463C226C671E8A62313D6DB0018D7982F53BD6A27F263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Runtime.InteropServices.dll
Size 50KB
SHA256 0cd3306a5380e59b1c61b16461dd8a0a76e58d677e7da1ec3741bb64efa25aaa
MD5 268a59245835dbfbfd3c23bf744d39d5
SHA1 55874a6b8eec97204791fe1dcb081e85e50ca1c0
SHA512 6929a0f97b645ae062f6fde1f8593aa3aa4e89f14bc9a253718615477fe79d5de60aecfe4c33b32b0579719ac2ac241a5b243d3ca0063acb1cdeb984c858756a
SSDEEP 768:C5oK6fKfIPMWW/z2rg8Z61rvZqhwFLUFMjVYuPkKFClZts89zCVi:C5oWfIP8z2r1GqhwFIFMjVPPkmibzB
TLSH
T166336B22AB989326DEE757785673E6920DB6F6C613238BDF9090D90D1D9BBC80331331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Runtime.dll
Size 41KB
SHA256 787ff92525e6f78436e27c144bf888ee9714f07bf0add7eb8bfe1f7326e31810
MD5 3c99eb88f752b9d377c96abe31b7cc06
SHA1 3b7bb82e17facdbff666243e57d3b19b2565d09e
SHA512 07b15fe4a1576e5346fb05f69276a11f9f94f9cd9131a25f8062631c276765c8445912025b9c633b81e5d4544261a8b5b664b87a679e6613cc91c4e21a6917dc
SSDEEP 768:wBV0jdpFKYl5f4bGRi2xVbcVT4pEQPFClV629zR:MedGYl5f4bGR3G0mQ9ioCzR
TLSH
T17A13F7A0EE4E5233CD8E97718873E4C119FA33CF64B6D9BA544E9606288F384D273759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Text.RegularExpressions.dll
Size 517KB
SHA256 32bda8fbc0e27628e5960023f9b3497474ad45be38a26db91ddcf994aea58023
MD5 e1bd563427583b969b5cd81ae03cf21c
SHA1 f0951b08e22c3a111ed6551cff96ca65bc68d5d5
SHA512 aef13497ec93c68ac4714fa6d1584ba3ffb05035483a1ad51f2f56272f530e4a8f830201151321db85ea31e31ef86609ffd69115180931169ccc78ff8051305d
SSDEEP 12288:ojaCSWfE1hvpmzn7z/HpVxn87bC/m+VvHKHhiKpwR4wcMPVZ22R3+yLAR6Bt:bW2Yzn7z/HpVxn87e/m6CHhUPVZ2qjLd
TLSH
T15FB45C2467C80B16C76E86BDC4A35023D7F166662356D6CBC400EEEA1F47BC2B676723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Threading.Thread.dll
Size 15KB
SHA256 b25c3dc708b65de0393f7e450105a71b480f2a5d1f8cf0e8c8580e20a5fbcbb0
MD5 42eaeab968f6373477713ca452cfaaeb
SHA1 e0ad261919f5810907b3359e586a00ec80a94804
SHA512 26757c8388b3d2751138f136d25110af43eceaf4cd2f01d5d2f113e7990f0cb98c3832b767e91f283fa215394c278365ca19c5c397641f105b325b8088063fb8
SSDEEP 384:hz2EoZVkD4WcU7WlYA6VFHRN7zErtHNsAR9z/4K:FwuGFClzKts89zQK
TLSH
T18E724B968B6C8243ECA33EB0D2B9D6433C7A67C29950D56E1AC6F6041C57784DB3173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\System.Threading.dll
Size 78KB
SHA256 6daad511bb06971c76a7007d31db88013876a9bc07b899c78536770c1d901983
MD5 b754a2bfd575abdba9f77d1d6bf6980e
SHA1 1d21b27b5112887ab72dde91691c69d87c8f3282
SHA512 85b9a08d7ca1279ca2ec579fbe48e9e5e4bb547d865baefcb37925d31453160e681e2a4b46231f6b315cba0aa5892bae4fc98cf882a708d1a8e4fb61a721f0ca
SSDEEP 1536:xk5Rj1Ku+ydo98uGxdUJpRH7AveQWA3zg:xk5Rj3o9wxdUrKveQL3c
TLSH
T1F4736A01B3E84316FAAF47B999B269528074F5DA1B13D3CF0098D58D1EA7BC29A71273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\clrjit.dll
Size 1.4MB
SHA256 c8c62d5043e1e16089b85badc0d41daa4b8ebcbe8608435783c07679bacd159e
MD5 7b4375e2d9212108130aca9438b204b4
SHA1 8ad0a3c29a02429fa4233e0cbe09897eb3960a46
SHA512 fd33720895ebeb0074727a38f467209cbe763600476687f42e9727486133b9293f8d18c016ca14991d1671ec87ab09f8722645c54b1e326282e480f801f8b264
SSDEEP 24576:fLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGwqfy:fLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHgy
TLSH
T158658C06A3E805F8D4BB9234C5434B1BEBB3B8161371CFDF57A04A56EF237916A1A315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\coreclr.dll
Size 4.9MB
SHA256 64e1c7636e731bb9dd30adf26526ba69a64786f0d4c6979265cb5575ad1abff2
MD5 3f517cd4d560ff7c81ca4e0acf375a96
SHA1 53375106ad45031329a0fb075c0d3193c4a8fac6
SHA512 c7fba2ece43b3328f5a041407ea4d729bdbccc65869e7540c7ca1ab558facce9e434812c362131cf9d04573d3edd5460747debc175e45bfcef281546c94476a6
SSDEEP 49152:TRUteSi8SjfXq6ZlxPCEsBfdSf30d9A6oWUqSp0eTVRapiB8YNCdT2eBRJoqN2nc:9U6RxPCEwpJc5H8GatXj
TLSH
T158369E56B2FD00A8D4BAC078CAD74917FAB178491738EBEF02644A552F27BE1A73D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\hostfxr.dll
Size 369KB
SHA256 ec8f92f2bcc5f6ee94605b7883e663236f2a2f578f4e610eae9934cbd4266fe9
MD5 9d67514fe36639b7eda307fb46d27178
SHA1 b8ba4ca6bcf2e5740b7e0f7a077fc72b1248bafe
SHA512 4ca3bb0167f7f2512bfb1cc69b72fbdefc4d3ed7679ba7abd4b8c60f42df2b95f6b44550f5a14c5843305b7705634d9b26327d87bb24f2934abb5ff94c54aea8
SSDEEP 6144:+CrkuaHqY/1EtiaDC3+Gr4iAOs+WEAO2gcmgrW09S:JmHqe1E3D/iAOsksH9
TLSH
T1E7843B16E2ED056CF1BBE2389AB79901E6763C4A4770D6CF0390456A1F37BD09E79322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\hostpolicy.dll
Size 385KB
SHA256 b54e1acf51c3a876c68e99ff17c5a585af264cfc25f57d6913ea9bd85fcb25b5
MD5 99627be8353e7b34ebdbbbf965470601
SHA1 e60681e3f81b4dcaf304e715878ed9f3984a1baa
SHA512 bc162e11bdf84ecb7c0da3f6ffdab3380958c8b9c86e9dc4cbf03bc8fe3c5b2d958e11fb373d5944418f687f7f559c1dbeca36b37d1ae4472bb8b58420a7ad6c
SSDEEP 6144:BBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BUt9OqOHBE/Xb:BBGjtNlU/rsQy8XyxzkZOGX
TLSH
T1C9844B16E2ED056CF1B7F2389AB79902E676384E477096CF03A0516A1F77BD09E79320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorrc.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\mscorrc.dll
Size 143KB
SHA256 214186149ddf144e9fb1935a7b39fa9393d188cca6558ae580f3dcb3465aba5c
MD5 81556c4545ec2cc21ad218639a0c003b
SHA1 e80ee14ab3eee7baa7ff86b07ddd64b38788d4b9
SHA512 99243e57988b7758b8537a43815840509b37cceb3beb4b8e6a8086acb36880d5aa63a4496e16c3bad34d2d8edaff7a240e6ffec9f60488b6a31d9a957b4ca7c3
SSDEEP 1536:9V8Zms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXXniizP:9V8Z/aSKlZ4ZGnwmUS4Scnp7
TLSH
T10EE37791A7F95218F6F73B74A9B95AA00E7ABC96FDB9C21D0240805E5D71E40CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xTile.dll

Path C:\Users\Admin\Downloads\Stardew.Valley-SteamRIP.com\Stardew.Valley\xTile.dll
Size 65KB
SHA256 a7c0a758ac446bb4f7715651478e3097b7b3bb6fbd4daca52bfa8e80ee1e7df1
MD5 0a76281a9187545f3ae6d6d0211ce51a
SHA1 884c94adf5fda53cb0e123d5079027e9da8bdeaf
SHA512 fc83255b74c67333088d450b95f1221986be8660fc38b9d3b03defc790db570405b6a8d55c9b0700da277f6db427be55811b7a819591c1c287ef3d1eabe2a30b
SSDEEP 1536:Hlt2bfQmrnjIHSDMGn1mypru66dXo9mIuV0niD3H68XU9:F0bQyAquXo9mhD3HvX8
TLSH
T1556339192BD8DB37C2DA177AE4B015160BB1F519F573EB8D1D48B0AE4C67B904A203EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/7324-8661-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8694-0x000001FDD30E0000-0x000001FDD30E1000-memory.dmp

Download

memory/7324-8668-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8669-0x000001FDD2E90000-0x000001FDD2E91000-memory.dmp

Download

memory/7324-8670-0x000001FDD2E80000-0x000001FDD2E81000-memory.dmp

Download

memory/7324-8672-0x000001FDD2E90000-0x000001FDD2E91000-memory.dmp

Download

memory/7324-8675-0x000001FDD2E80000-0x000001FDD2E81000-memory.dmp

Download

memory/7324-8678-0x000001FDD2DC0000-0x000001FDD2DC1000-memory.dmp

Download

memory/7324-8666-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8690-0x000001FDD2FC0000-0x000001FDD2FC1000-memory.dmp

Download

memory/7324-8692-0x000001FDD2FD0000-0x000001FDD2FD1000-memory.dmp

Download

memory/7324-8667-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8693-0x000001FDD2FD0000-0x000001FDD2FD1000-memory.dmp

Download

memory/7324-8665-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8664-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8663-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8662-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8660-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8659-0x000001FDD3260000-0x000001FDD3261000-memory.dmp

Download

memory/7324-8658-0x000001FDD3240000-0x000001FDD3241000-memory.dmp

Download

memory/7324-8626-0x000001FDC2B50000-0x000001FDC2B60000-memory.dmp

Download

memory/7324-8642-0x000001FDC2C50000-0x000001FDC2C60000-memory.dmp

Download