hxxps://share[.]google/0bRcZOn4WCsfPOR0D

Analysis

user interaction
yes
max time kernel
101s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/0bRcZOn4WCsfPOR0D
Sample260809-sy293sbb27

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2444	Cs2Hack.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2444	Cs2Hack.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3732	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307631931685648"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
2444	Cs2Hack.exe
2444	Cs2Hack.exe
2444	Cs2Hack.exe
2444	Cs2Hack.exe
2444	Cs2Hack.exe
2444	Cs2Hack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3124	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1292	3840	chrome.exe	87
PID 3840 wrote to memory of 4908	3840	chrome.exe	88
PID 3840 wrote to memory of 4908	3840	chrome.exe	88
PID 3840 wrote to memory of 3732	3840	chrome.exe	89
PID 3840 wrote to memory of 3212	3840	chrome.exe	90
PID 3840 wrote to memory of 3212	3840	chrome.exe	90
PID 3840 wrote to memory of 4952	3840	chrome.exe	92
PID 3840 wrote to memory of 4036	3840	chrome.exe	93
PID 3840 wrote to memory of 4952	3840	chrome.exe	92
PID 3840 wrote to memory of 4036	3840	chrome.exe	93
PID 3840 wrote to memory of 2844	3840	chrome.exe	94
PID 3840 wrote to memory of 2844	3840	chrome.exe	94
PID 3840 wrote to memory of 2856	3840	chrome.exe	95
PID 3840 wrote to memory of 2856	3840	chrome.exe	95
PID 3840 wrote to memory of 2684	3840	chrome.exe	96
PID 3840 wrote to memory of 2684	3840	chrome.exe	96
PID 3840 wrote to memory of 3492	3840	chrome.exe	97
PID 3840 wrote to memory of 3492	3840	chrome.exe	97
PID 3840 wrote to memory of 864	3840	chrome.exe	98
PID 3840 wrote to memory of 864	3840	chrome.exe	98
PID 3840 wrote to memory of 1780	3840	chrome.exe	99
PID 3840 wrote to memory of 1780	3840	chrome.exe	99
PID 3840 wrote to memory of 556	3840	chrome.exe	101
PID 3840 wrote to memory of 4068	3840	chrome.exe	104
PID 3840 wrote to memory of 4068	3840	chrome.exe	104
PID 3840 wrote to memory of 1644	3840	chrome.exe	105
PID 3840 wrote to memory of 1644	3840	chrome.exe	105
PID 3840 wrote to memory of 1192	3840	chrome.exe	106
PID 3840 wrote to memory of 1192	3840	chrome.exe	106
PID 3840 wrote to memory of 4552	3840	chrome.exe	107
PID 3840 wrote to memory of 4552	3840	chrome.exe	107
PID 3840 wrote to memory of 448	3840	chrome.exe	108
PID 3840 wrote to memory of 448	3840	chrome.exe	108
PID 3840 wrote to memory of 724	3840	chrome.exe	109
PID 3840 wrote to memory of 724	3840	chrome.exe	109
PID 3840 wrote to memory of 4196	3840	chrome.exe	110
PID 3840 wrote to memory of 4196	3840	chrome.exe	110
PID 3840 wrote to memory of 4448	3840	chrome.exe	111
PID 3840 wrote to memory of 4448	3840	chrome.exe	111
PID 3840 wrote to memory of 732	3840	chrome.exe	112
PID 3840 wrote to memory of 1124	3840	chrome.exe	113
PID 3840 wrote to memory of 4132	3840	chrome.exe	114
PID 3840 wrote to memory of 2240	3840	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/0bRcZOn4WCsfPOR0D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffe591c728,0x7fffe591c734,0x7fffe591c740
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6623457226083712424,10160051930615056866,262144 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,8865034816764690138,16786732936821444382,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,2030597466693090088,579045654630224313,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,3255047410163367902,16381753398145868945,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,8672572560683937490,16690763727492017505,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,10067926428490821776,933340594814915450,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3972,i,16283487555427635760,8384566470361414217,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5204,i,14097913348748107075,770469950960346439,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4624,i,7790427391031429397,13225472835812484786,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,7244424389294928284,10985573749484146120,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4816,i,1523394530678852792,12527449301708816915,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,16209608202346137092,12821073556434294858,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6264,i,5206724363037558534,1052614001041248952,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5520,i,2835215435126182962,17274412141391985406,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5340,i,8482063150539157977,17963867639629271048,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3404,i,5835885016884972052,13936838807841648331,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4924,i,6402613687051470787,6137453404888485051,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5808,i,13293900472840215271,17514284049976050284,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6956,i,13797084593487287566,9470876933591021662,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7084,i,10630616651795581344,16397748473458914550,2097152 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,7515318410830033082,8427424510626052339,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,3189521592624574570,6039349396367781668,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,17032060300496116294,7285129283425939462,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,14559478093877382920,11394515866034016045,524288 --field-trial-handle=1996,i,3600125964568445640,15712400623345872527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4764

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7501:76:7zEvent27215
1⤵
- Suspicious use of FindShellTrayWindow
PID:3124

C:\Users\Admin\Downloads\Cs2Hack\Cs2Hack.exe
"C:\Users\Admin\Downloads\Cs2Hack\Cs2Hack.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6223f19a-ae2b-47db-b5b4-e7afbe13a7a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6223f19a-ae2b-47db-b5b4-e7afbe13a7a4.tmp
Size 115KB
SHA256 fdae778630c4e750055aafb3b04fff9a712dcc15cff2c7d9d5474836af6dc791
MD5 92cbba06a5e967a3a99ed20e222d817f
SHA1 d9324f4711cba048c9a9d264654b8d296f3e73df
SHA512 35723ac4740104ac63ad2d33ab56d2249b4b8a2c7a21dff1f8c0c79142e7c073fa4b57a7b355f14144bfe07e488dcabbc5d264bb75c31358b4d20dfe4e2a14e0
SSDEEP 1536:TgQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Rqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15EC30237DBC21F339E96CB60B9530FD697B644A99034D301EA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 35f0f594156bbadbefbb4647b33d4fbc826ebb150ec3cd1b53c07fb764a2c202
MD5 8f22552a32db677649ac3bd25b68f6dd
SHA1 8b603befabbb63a51d332b034c0c3cda32c82895
SHA512 69d5249cb943509f29a6386314bb84b92beee5ab4c815de437bd86d94e5074de40968dafaa1a74cfa4c9159473a838b27606bd535d24d2036de5d345ed6872e0
TLSH
T1A8E02BA9C920AD2B18FD075D6458474AE754235B2B40856B3A3D92098FB96370596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7b4e6c0083c5654f2fdc88cbb8ef6dc9e2d03109faf51dcbd72d5c00accf2e58
MD5 70d00d4836c1d4b22b6dc036c395cc6b
SHA1 a1b52008e567d4ce9f484d15c442b7d28c28726b
SHA512 8c0e2a13557f88727ff507c32dccf64cb4251296624bc63b5c7c0d0bab494c88c37b6545d7efb0c7b2c344d93949bf68de91b2c7956395c921a1dda9d6b7f4ef
TLSH
T18E41AA71F0E82A56CB2425B069EA7F0EB5F548AFE4E34F06634CBDB5694EB8F2043454
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 bbf5051b4ff6b5c61fe06e63ec33d4b6ac08ef47a09589500a515bd36ede607b
MD5 13c52b9e568fc137a43ed2eacad9ffc4
SHA1 51095337953baa504095a001db413b6a2c1ca2ad
SHA512 b772fee907b1656742848706f7f920f7fadb0efeb1c9ec37f91a4f758a8ac9362ee57fdbbfef3664ecb2276a63d3eb367e0c2b5e2464f5bee0714d89881bf06e
SSDEEP 384:DlyQ/hG48RI8xJxeZKqV995v3awxywBeHekQJtVmRaIaEdlnz9ShYxlko4Vd9Exc:1DkHkZeLngGIjOP5miE4ne
TLSH
T13CC2AAF383E5D62E891157F89A146E1BCF1D0619832C3C2689D5FE47E3E2472E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e9cafa00b22fe6466ef1cf68c1d5d5cef8882df19119fe5bd11d7b01f1c297a
MD5 c8e04e27a668a17ccf44aea2e0827217
SHA1 51343f38856d3ab80a61f9942ff4f4765b942899
SHA512 e66b2477e235c4e5e87723a45659a7e527b04b95d36cc709429aaaa2779eea56750deb13e90b1ae833778d99b3429ec6b442aebf79820882c9a9feba562fb6b3
SSDEEP 192:wR9ktXwjCo7v72ympAPRp2KoY95Hsb+WNn2boP82lUeE1e2mKVyIsnAUge:wR9kFwDQUX37wa72w1e2mKe
TLSH
T13E42D82FAA246D7B5CDBD219F9227717E7F5106625901E40EAFC9A2C14E75CC321B01F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 291cb6fb3ba8e1dbe203bfa8ab36c01d89a3717e46dbbc3b1808ec90566ae75f
MD5 1b812c7f9efa787ba10da2a23c4577f3
SHA1 008f10ea5a2698d3bda40b10adc12a83d8ac263b
SHA512 cc5bf3c97a5574637e2ba177052af534dbda46823b5bb029c3a1a636864b4e02dbc50e0984890ce8d5364a9715e9232200f7e81f759f250e19e35bec3309b7f8
SSDEEP 192:wR30tXwjCodv72ympAPRp2Gry1oo1y195Hsb+WNBd2boP82OUeE1e2m9VyIsnAU3:wR30FwdQUX77wu72F1e2mLE
TLSH
T1F352E86BA9202D77ADDBD229F9127717E7F5203625901E80EAFCDA2C04E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 759984f3cd3b89355802ac29f7b697498dd8c70f062feae40d883b4484ea9ae6
MD5 93094e6f9bd65ced1671077bbeeb82f4
SHA1 dcb3a086d0b402e8ede5cbea1a24ad2ecb00723d
SHA512 55e0724ad895c5890946d0bf37abe20acc0509d9739605bdbf52246325253d5c6a988f7cdab00be13bdd384825a62ee6ea898d246a4748c40810bbf167bb8bed
SSDEEP 192:wR3ktXwjCodv72ympAPRp2Gry1oo1y195Hsb+WNBd2boP82lUeE1e2mKVyIsnAUp:wR3kFwdQUX77wu72w1e2mKe
TLSH
T19C52D86BA9202D779DDBD229F9227717E7F5203625901E80EAFCDA2C04D76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 87993318e57c3fe4d6c64dc55dbd5f56c23f29e98e2a7bb863eb9bac8701a2ab
MD5 8e1b35feaf932428bf538598e5a50bcf
SHA1 ef3d2fe300d40ac151e21d60a43b23a984d999ca
SHA512 86c836c24b28dd94180106399595f93b9483f084114e2f5bfe2f242111325464799e15212a146a543eaecdee6d415048a9f0c95f245dd7e8b42647f437086d0b
TLSH
T189B01241C0415512C04203B41142348872545F24970B170153E86D32C82B1718419060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c61.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586c61.TMP
Size 96B
SHA256 077dce8749802c1d268e67e9f49e8f216c2aecc6c07b9231e5da758dc70e3254
MD5 a1d4365732e26cf7f081a60a441141d8
SHA1 d26afa356a94fd09a2f8f4d876c694f3aa00f2ac
SHA512 7dfd0d297e61ae270736f171c7b85a76a5cd48eaf801208f6cea61204cc26318952327b72261b2c4f14460cf296f6893ddb378b51d57aa29fbdb1d8564ea556e
TLSH
T142B002A5C1426E17C05203B026E7A5D8B160EF26C707525392E91B6ADC2E67155251A0
MD5 SHA1 SHA512 TLSH

Submit Download

c0585f92790c7b3b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\c0585f92790c7b3b_0
Size 63KB
SHA256 7e45e2425056c3c1cb8304c2e815baa23e17d93edf4e29364c2463386c1c56c7
MD5 2e51b560824263dfdaf61fc99a1f5b3e
SHA1 ce133a9ef3715c5d9fe8f7bdcf3ed8056ca2f4b6
SHA512 8f7476b2a7657196ae237476521828686d65c8ce17e0d48a05eeb368ceb8d95d5239a4c6bac52e325ad4bb7bc39e9de27ddfe278dafcfbb17515196f6e0553e2
SSDEEP 1536:u8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:u8k3vFpxh4Y473qW
TLSH
T1B8536BA6337178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E44AA60267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0f7c75961af0fc312b08b01005603a64c2eb1134be2694b230d042cc9c37c2c5
MD5 6d270a878c858c7ec4d6218467f99225
SHA1 89edfb291af3937cd3119b17d93214159b09f68b
SHA512 c39dd7dbc7e8572dc2f977c7eb74cb19338d0ce841f767ca279392f305018b472ba17742b254b652c71a74ac08669246c3b2978586ab6b47375e5275524b0827
TLSH
T164A0021103552101C66106B4AAD12EC1671089158301428A55D514C88C581429A05254
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 33c617baa38a275d1686571aa6acdce0466ba34228e86a06725bcca1d6399def
MD5 1f3229ef71965662f036cfaf6d046228
SHA1 41b2c8c30165a28d620ec38168c7a370aa963d6b
SHA512 0a8f718c376b8152d9d976a1166d302e5717c4fac1442a8b822eda0ed3a6f6472087636ac6827861d70e6bc47c76542754e134ccd55ee65ad7cae45ab4f447d0
SSDEEP 1536:WtxqHyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:mSqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15EC30237ABC61E335ED2CB70B9230ED797F544A99034D301AB6D37FB6883891658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 702304346346bd0037997bcd5dac564f19472350a89dfa73c453e42bf0b895c3
MD5 6c8a65603ab5957bd287a925e8fe7236
SHA1 64343597c48b3ac246d78cea77e9f61a2b4e72d7
SHA512 411e999a18471668315977802292887fb7a08a5559ca44e4c278f47beab7338e0d241f1651f2dde797b7d29a6bb4c17be506aa52bc2e5d6c42f5dcf110af4580
SSDEEP 1536:WzxqHyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:ISqfd7NtZL8cHQRZEQ6Spsk
TLSH
T147C30237ABC61E335ED2CB70B9230ED797F544A99034D301AB6D37FB6883895658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7e0c28896ccbc8a482eb59170ba6fd4730cb610e27b03724fe4cbdaa3270f578
MD5 8d3750765161a2689e92c84d525df17d
SHA1 63e2c59841d6df7470e681c83e807eb6c2cebbc3
SHA512 ad3cc9661c759843fbc3dd247f7c96a588399d03cf9ae2a96b4f37bdeaddf4c7aa95fb0ff2fa69f8c76ab012745cfbad04042fc651493db50bfadd46709b5dbf
SSDEEP 1536:78yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Cqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15EC302379BC61E339DD6DF60B9130ED793F604A9D034D305EA6D7BAB6C83491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d0ec380bdd6617815e4e78b99dd4cccdf8fd28fdaf9c22bd9d9367472149c204
MD5 5623d1596cf2b74140891fff96ddd760
SHA1 578b4618488031e3de7d8539b351e7efea54e233
SHA512 f700f0c52bf128467f27f489d46d17ea12bee785e6bc83408a104443eac698f99af6cd7a8fc6199a8b2fd0aaeee85b7fdca90b0b590057926c8d3fe6a84f3a63
SSDEEP 1536:7zxqHyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:ZSqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D6C30237ABC61E339ED2DB70B9130ED797F544A99034D301AB6D37FB6883895688249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cs2Hack.exe

Path C:\Users\Admin\Downloads\Cs2Hack\Cs2Hack.exe
Size 14.3MB
SHA256 40df1733675a2562b0a3e03f019f1b13cfc59688afdb7c39d5fa284d07040324
MD5 624d9c3a6949dfed1425836c346fef4d
SHA1 3bc4bdd24bf5c1688a714ec629e1830232cbe3d3
SHA512 b1c44d5589f7aeffd96660818a914d459139051118b5afb41f32f08ea2bde16751bd5d767cb043f5043144e21433ce1b4064f9df8d35ca26e7648475057a4194
SSDEEP 49152:jA1tAy73BWCnTdOYDaZDxWOZeMv+qGCZnHdSqFr/5SfiF5A/eK8zkhABgvMaraQW:j4ClzdX0KhHT5LJYLy
TLSH
T19EE64A17AA9549FAC4A9D735C4B74615BA70B84E8B3233D71E52BE782F317C05E30BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GfnRuntimeSdk.dll

Path C:\Users\Admin\Downloads\Cs2Hack\GfnRuntimeSdk.dll
Size 2.5MB
SHA256 78fc4bce302745a4851ce32f33e81c17d09c679a291fc4b4d7862c7b15f56e33
MD5 2295e64498c97512de4f006eed191d31
SHA1 51f8f969d65d5611b9f16e13b48f4a246af26899
SHA512 b9525b2125330111d0b463125ee702adc79e8b027858a2bd4233697ecc9d6b80ec80433afc46d97f61bf0e4490273b0e86908d2d78587397d862923a3d9cff83
SSDEEP 24576:/dHt/wyzGnCvVv8GZ+4QYN+FhsYoCKj1nqZnFbP9JXCCcSeGo1qgbQ8IRuTcLZCL:/pGSyrsYoCiq+CWJ1qjscLZCn37
TLSH
T10CC5BF20FB828671D9DE22B954BD773E487DE0241F2441C371981BF9DA605C27E3ABE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-491-0x0000000240000000-0x0000000240226000-memory.dmp

Download

memory/2444-492-0x0000000240000000-0x0000000240226000-memory.dmp

Download

memory/2444-493-0x0000000240000000-0x0000000240226000-memory.dmp

Download