9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968

Resubmissions

08/09/2026, 15:03

260908-sff9wssgmf7

08/09/2026, 15:02

260908-sem12sdm7y6

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MacroGamer_v275_Source.zip
Size 142KB
Sample260908-sff9wssgmf
SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
MD5 da89d18de41449fab464d6399aa60d7f
SHA1 8056ad22af11affdc1e9911394900c04d8378a1f
SHA512 3fa8202cb495fce447e96c19b0a076e656b3ad65cdd8e110fb1af370f76be982858e35149b9ede8e462ef6d588631167a7890dad5802034e03f405e14e3ccee9
SSDEEP 3072:ltW65EkLxMhk8mfCVi6hV6g1+nC+fkVqoRgmcU79zMi61PBUvn59/N+K8HBf:ltOcxI5VnV6g1L+fkbRH3WiTx98Kg
TLSH
T1B9E312B4967E1C40E19B55B2AF1043712FEA17E102A6D4CD903046F9BBCB3E479BB85E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5360	MacroGamer.exe
5904	MacroGamer.exe
3060	MacroGamer.exe

Loads dropped DLL 1 IoCs

pid	Process
5360	MacroGamer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a3b55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a3b55.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5a3b57.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MacroGamer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MacroGamer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MacroGamer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
888	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333534759308739"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
1744	msiexec.exe
1744	msiexec.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5408	chrome.exe
5408	chrome.exe
5360	MacroGamer.exe
5360	MacroGamer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5360	MacroGamer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
948	msiexec.exe
948	msiexec.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5904	MacroGamer.exe
5904	MacroGamer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
2652	chrome.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5904	MacroGamer.exe
5904	MacroGamer.exe
3060	MacroGamer.exe
3060	MacroGamer.exe
5360	MacroGamer.exe
5904	MacroGamer.exe
3060	MacroGamer.exe
5360	MacroGamer.exe
5904	MacroGamer.exe
3060	MacroGamer.exe
5360	MacroGamer.exe
5904	MacroGamer.exe
3060	MacroGamer.exe
3060	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe
5360	MacroGamer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5360	MacroGamer.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4324	2652	chrome.exe	102
PID 2652 wrote to memory of 3800	2652	chrome.exe	103
PID 2652 wrote to memory of 3800	2652	chrome.exe	103
PID 2652 wrote to memory of 888	2652	chrome.exe	104
PID 2652 wrote to memory of 3120	2652	chrome.exe	105
PID 2652 wrote to memory of 3120	2652	chrome.exe	105
PID 2652 wrote to memory of 3036	2652	chrome.exe	107
PID 2652 wrote to memory of 3036	2652	chrome.exe	107
PID 2652 wrote to memory of 4668	2652	chrome.exe	108
PID 2652 wrote to memory of 4668	2652	chrome.exe	108
PID 2652 wrote to memory of 3704	2652	chrome.exe	109
PID 2652 wrote to memory of 3704	2652	chrome.exe	109
PID 2652 wrote to memory of 4108	2652	chrome.exe	110
PID 2652 wrote to memory of 4108	2652	chrome.exe	110
PID 2652 wrote to memory of 8	2652	chrome.exe	111
PID 2652 wrote to memory of 8	2652	chrome.exe	111
PID 2652 wrote to memory of 5092	2652	chrome.exe	112
PID 2652 wrote to memory of 5092	2652	chrome.exe	112
PID 2652 wrote to memory of 2892	2652	chrome.exe	113
PID 2652 wrote to memory of 2892	2652	chrome.exe	113
PID 2652 wrote to memory of 808	2652	chrome.exe	114
PID 2652 wrote to memory of 4388	2652	chrome.exe	116
PID 2652 wrote to memory of 4388	2652	chrome.exe	116
PID 2652 wrote to memory of 2780	2652	chrome.exe	117
PID 2652 wrote to memory of 2780	2652	chrome.exe	117
PID 2652 wrote to memory of 2324	2652	chrome.exe	118
PID 2652 wrote to memory of 2324	2652	chrome.exe	118
PID 2652 wrote to memory of 4568	2652	chrome.exe	119
PID 2652 wrote to memory of 4568	2652	chrome.exe	119
PID 2652 wrote to memory of 5400	2652	chrome.exe	125
PID 2652 wrote to memory of 5400	2652	chrome.exe	125
PID 2652 wrote to memory of 5460	2652	chrome.exe	126
PID 2652 wrote to memory of 5460	2652	chrome.exe	126
PID 2652 wrote to memory of 5720	2652	chrome.exe	127
PID 2652 wrote to memory of 5736	2652	chrome.exe	128
PID 2652 wrote to memory of 5736	2652	chrome.exe	128
PID 2652 wrote to memory of 6064	2652	chrome.exe	129
PID 2652 wrote to memory of 6072	2652	chrome.exe	130
PID 2652 wrote to memory of 6084	2652	chrome.exe	131
PID 2652 wrote to memory of 4156	2652	chrome.exe	134
PID 2652 wrote to memory of 4156	2652	chrome.exe	134
PID 2652 wrote to memory of 4656	2652	chrome.exe	135
PID 2652 wrote to memory of 4656	2652	chrome.exe	135
PID 2652 wrote to memory of 5800	2652	chrome.exe	136
PID 2652 wrote to memory of 5800	2652	chrome.exe	136
PID 2652 wrote to memory of 5200	2652	chrome.exe	137
PID 2652 wrote to memory of 5316	2652	chrome.exe	138
PID 2652 wrote to memory of 5200	2652	chrome.exe	137
PID 2652 wrote to memory of 5316	2652	chrome.exe	138
PID 2652 wrote to memory of 5840	2652	chrome.exe	139
PID 2652 wrote to memory of 5812	2652	chrome.exe	140
PID 1744 wrote to memory of 2116	1744	msiexec.exe	155
PID 2652 wrote to memory of 5408	2652	chrome.exe	163

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MacroGamer_v275_Source.zip
1⤵
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdf5afc728,0x7ffdf5afc734,0x7ffdf5afc740
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,10151476511367465890,10341712023692943870,262144 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,1738937135748302449,751557255985530170,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,2809709420287208773,9050741189847286851,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12012692388762043673,6123963497499780876,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,5092036153021425233,9448606796591872894,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,10359063933573240798,2452600759929472044,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,3845233993004188382,9266099702896806066,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,10755920405952263095,2502890237249052884,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,17632742801884087584,14258278969705465228,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5212,i,12630853157565547452,3159829208046657369,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,4626170497634508349,10776995696313691314,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5640,i,10480970310214802322,5774362294522335951,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5712,i,15276196377324061576,2130634023223484237,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5576,i,4582580474237937306,10325469921258213228,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5940,i,4700428079005964927,5451013066331048918,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6132,i,6394136511603408031,7014322467835773708,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6264,i,12716857543829320776,3691165208268204380,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,5722452027593730685,6410169460537969483,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6568,i,425708583916392840,16775415671733262217,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6960,i,16983136451643348884,17108677905998691611,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,11939415913505149395,10953096273196613980,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,1182301034569011115,5595588094758097074,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6972,i,5272946347965427312,11078076596476245539,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7156,i,6732494108375901484,4165452624225555440,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,1036438276997927653,1926732529194240616,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7140,i,18403541622497565265,5731374719346033430,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6684,i,10167933281049938718,12183391390881531649,2097152 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6572 /prefetch:2
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,14088969389648645751,508534770910671146,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6608,i,5050417678485025881,13887607088135172368,524288 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7188,i,16981933785575724813,8194585313162652587,262144 --field-trial-handle=2032,i,11690017681076116115,5180525216807310529,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5036

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\MacroGamer_v275_Setup.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:948

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4756

C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe
"C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5360

C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe
"C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5904

C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe
"C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a3b56.rbs

Path C:\Config.Msi\e5a3b56.rbs
Size 10KB
SHA256 43defbe732da2d3df8798240d11aeeb1317491ea1c9583ef92118b1f16eb445b
MD5 ab14ec754745f0b7e5957ebb2837826d
SHA1 7b72a25e6a1d4d30c71fc9fb36016f6a4f2d51e7
SHA512 e3404a1027aecc2b3a9b6bc8a39099a1fd0648dafbef7379fcfc9263a2532ceab3222786e99bc29e47462ea6adcf336436ea6b7d7304b378eb90cd1ce6dfaf28
SSDEEP 192:7roKXMik7VsboGBLoeLcz6RMSfe61Ta6O6lOIAmTa6O6lO1AJOm4/pw:7rTXMH7VsboGBLoeLc6RMSXTa6O6lOm7
TLSH
T142326102B14484E3E8B52632C72312547B62D3E2A7917B4B0C8F987C8F9379DDE995DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cce433fb5daee179d6107be2f958f74ac66c75641c3b212c0418475243d2b503
MD5 b636c60ede2e2ceb2f0a3f07b653b0de
SHA1 868fbe9ab366e6ac4f16ed4c8eb7bc6ad57e2fb4
SHA512 058ac213a0f408ff4393c41840ed10dd7c8d1e8b939cfcdf7ea9276f96e0d39759c24532ca9be8fd2e95636f2556cc7564988ab0574d96cee22a5e98fa28c67c
TLSH
T181E02BB9C961EC6B28FE0718A0514745E610135B2B40898F763C850D8FF0B3B5B45C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Size 667KB
SHA256 d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8
MD5 f7a9d1bf05f8f0e2a1cc6cafd0985070
SHA1 a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4
SHA512 c30df08a315c7f161646269254645a2825de1108af85d48cfad8a1e88a6f70c7259235a8eaf235f548d0647760e535dfeb3b43d719398e2f9acb75274b865e6c
SSDEEP 12288:mjDGPXXktIro8FAPUxv9gvIp2z92NFttMDWEzpS6P:mjDGPnkqc8FAM32z92TtwFS6P
TLSH
T1D3E4012675C74B73C60312329A1B53A0AF769D6443B21D3231AB778D2DF27A053EBAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c284574e39585facbedacdfafb50e7a6491ea7a57dfc666d42cddc64d19d1d0d
MD5 e294d34d7cc9b347fe6b8b6e78889741
SHA1 cf803bd3befa5d096bdb234679e6d1ca64d63ee2
SHA512 5926cf89e5a8ae98a51d16808a116cda8778c59e8b75e33ca9663d02dd6bb8689d7cb608191e6705e40a59c9bad0ab90122a10dee64ff1e53c35e79888b07a44
TLSH
T1AD31CBCD7EA80895EBE83E39F4E3781A2235D74B0C0E9B064614F6A055D32A49C0752B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 352219afb24c1f512319e5b143cf3e80e4d5588fc9f2ff61f2b9ef26709d2d9b
MD5 c365f1f61fde27ba408c07616da21d67
SHA1 2fb5c41a5b1ee39cf0a10b5ec16c4c43b1d8afa0
SHA512 0a20d715f4b910fa2d558d9fb7e9bbf50ee088c6b03d562d84c34c3b63c17cf80284660c49a6b296b0dbcc18623773d916852c6ba7aa04f2f94b7ab92c6cbdf0
SSDEEP 384:DlxFt+6LJNf9VnlZns3DgWI6lXZNfxtfaSNEfefaWXfiFiAyEGLSaMwXU/9ahQd9:DaNEWy63rG
TLSH
T1CA6299F7C3D8C26D895256F4EB116E1ACE2D0A24032D3D268DD9AE4BD3F2531D21369E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3bd944226c572a9162cc36d5531f178df26dab8996aed37f3780ebc22b8422c0
MD5 b13cdb9fa0612c1da11beda8c10ab66c
SHA1 bf90d05d8318e8ad3e6aed004d5dbc3df4f29491
SHA512 83780b6a580257dd2fb12946dae6d28759ca7165f076c1fc0b589a7671e1ca8e3483128fc9c5c69a72a748c398b380f469f29a2c95f190d30c4315f381f82371
SSDEEP 192:eRNycBzEHn6v72vAPRp2+iK9THsb+WNnSB4yJ21m6kwdi+VyIsnAUge:eRNymzEHWC6XNFwkb2s682e
TLSH
T1D342956EAD20257B6CDBC219F9217767E7F6203176941E84EAFC897C14E79CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b5cfbaefd9b43eaaa8ee671e23220512e6ed8f70bed4a1c5332461f574c01016
MD5 84355c5356384edfa149e004c2a55c95
SHA1 8e142efe750c178d8e6f61c47520c549c2602358
SHA512 03506432127c5a25a0a250c459fd8fdca3ef7facbaf444a2f0f150d03f274f33dcad56f1d94127a1be9244ba6f10dfc950d503896a9f421a2fd67fbbe5ce5f1f
SSDEEP 192:eRNycBzQHn6v72vAPRp2+iJe9THsb+WN7JSB4yJ27sm6kwd3+VyIsnAUgE:eRNymzQHWC6XTFw6b2z6t2E
TLSH
T16A42B76EA920257B6CEBD219F9217767E7F5203176D41E84EAFC897C10E7ACC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d52305c61ea2d8e89204c642392db849982687cee095481de3faaa1b56f3e930
MD5 705df446dc8db4f2830a9a9c56aa1491
SHA1 ac869647356654e04b48bacf6be6164db9aa3fa1
SHA512 4028087a4c07fffc2d5fe6c9e7d52738a49efccec230638992cd34db421ebef9cc4f4959d89527b7bedd8b0f08a168a975d16879146cd870beea438d82361ef1
SSDEEP 192:eRNFcBzRHn6v72vxPRpV+iJe9THsb+WN7JSB4yJzAn2YPm6kwdh+VyIsnAUgE:eRNFmzRHWCxXAFw6bo2f6P2E
TLSH
T19C52C76EA920297B6DE7D219F9217B67E7F5203176D41E84EAFC896C10E76CC2223407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1114ba9f60d1cf6b5d133d87d845c638e08d6646ccc5cdb9246f794b3670f342
MD5 c6f18f7b8ac3eb85f36be90444c8cb22
SHA1 0ab3f90f1670263162ec2693bdaeca4794de6cc6
SHA512 ce40b2858b7cf1ed07035363ae5d5efb8f35af58ab357064f5d94fef8bf5a98cb25aa21d62bb8c0b798953285ca4d238090a19ca45429017f1b4f669e7db0bf6
SSDEEP 192:eRNFcBzRHn6v72vAPRp2+iJe9THsb+WN7JSB4yJzAn2Fsm6kwd3+VyIsnAUgE:eRNFmzRHWC6XTFw6bo2x6t2E
TLSH
T16952B76EA920257B6DEBD219F9217767E7F5203176D41E80EAFC897C10E76CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 27703e8887cc81d0a776608e08243ce3e4f78c180c36e50f3361d3e4c1655d67
MD5 b129837299ecbce3f4c3d9943aace87d
SHA1 88a6e7aab2816e8ead6ba704aa3903bc43eb4c9d
SHA512 0a6a616d1373c7d41396b6205938cbc1afc1410a6a7193cd15c0cd7e148de9fcf007d336ac34a7c99f4c22898f1f8d5155ae25e178b1e84b13de532d081e9ac4
TLSH
T19EB0110300A88002E2028BB2A2C2A0883220AE08032B0A02B0E2A2808C22A0AC202202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b795a9978c77efd9a324690e59706e85cbc3f8b1ef2f8fbcb7950cc1dd240f3f
MD5 a6ca0be4370c4b8950adfc2cf9462327
SHA1 016dc9ca7e1327ab51b4eb9ff00560a49aa9f781
SHA512 0376772d611fac7a500ac6d8accd37f69f1687a475df7bf7fb7b8c30eee1915265b23bb83a1e78fe8427f0696559afbb146b062f3f1a964f8e6471b14af54115
TLSH
T1FBB0121254600022C96643F17073059023F45C1711421316948DC458DC2B6DCD110205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e555.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59e555.TMP
Size 72B
SHA256 04cff5f19ffb16b47857aebc79e6fedca44da9ad6429f40da244aeec0eed8292
MD5 63e12120f75d7e3d9d62da979628e7da
SHA1 fbd1ab37191644328e075cd6e1956783036592cb
SHA512 810910a022b8529492d4f866eacc4ab3e2c5072154735ca45548ab50120dc58d4cf5f6165782ecdeaeac1380d43dffbf8f7ea1659d5f58ca740c9e34262510c4
TLSH
T139A002615B705515CD3A467070A102953261C8677EA21A5B559244689EAA7C08505102
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 7061c7c474f005026c24aebb19bd04352313b3c8260ff5b33912d0e273e4f7ea
MD5 6ae26a3f0f249c6a43d27a54f61f9ad7
SHA1 b596c339025c26489825c57ac5feb1c9903ea6ef
SHA512 3f6778890851f861984b15d31853720dcb62ecb23fe92d75c46e219c2886165c5122843d3833effcb742c006fb8e1a2699895f7f3b1fe1161acceb3910e891a7
SSDEEP 3072:1/CZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquhEGm7D5Lk17ox1tIpud630:1/CZqyXOplXaHlnm7Rkm1tYpBeh2BAoA
TLSH
T1C73422376E5DF4758CAEE76F604E4F5D5EB0CAA581249905C8C9AB8073A7BD90D09C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b76de0537502b6d06d1bf8df01e01946e96ce51d5903de2120f8ee727a9eb6b6
MD5 1f2a38368c25f6d406cf866c2cb8a527
SHA1 9e7706ec962c9d0d0569229a439daf6177b0beba
SHA512 829c7bc86de14735fc2b5cda67b0c1078d4a3bcad0376e46f9230734ce0d6c660bae108b3dfffb12869c08dc961f379925d68254c0f6df2124360448bce5e7ee
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:1m7Rkm1tYpBeh2BAom
TLSH
T1F7C3123B5E70E9765979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC0A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c98cd01a3a33ff9976031d850140eaa997ba59cd32eafc082a967a7e8eeee1d5
MD5 8b7a032ef8bbe6bb7fedd2eecc1dbd46
SHA1 bed67fdd78dc04b27d061ef787b11fdac2faeaf1
SHA512 92b134689c29c2bc2b6380b5bc300ad7566f4414e5dffd65fecf93450153a4cd03b2464b914b43140037c65a4d859322ed95d50b8c05f3b1a7f9438afd9ea569
SSDEEP 3072:UYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:UTm7Rkm1tYpBeh2BAoH
TLSH
T109C3123B5E74E8365DB9BB5EB08E0A1F1EF14AA6C920DE52C8D45B0433EA7CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 f3aa3d80f15814800e0661c6a0431eeedcd23305239f0b77393a83c21768a8b3
MD5 367e3e8a5954991d7d8cadd38c9a4eee
SHA1 910f47e5d6b51da3977a01c5749327c6fc618fc1
SHA512 1bab95e11496376bdd9382c5cb586265f7eef903296f1d28798eb83764a9f4d6282d7f938cef5a818322aca507a2544c40dded98f447b84429fcb73e2d830f67
SSDEEP 3072:XWCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquhEGm7D5Lk17ox1tIpud630:XWCZqyXOplXaHlnm7Rkm1tYpBeh2BAoA
TLSH
T1533422376D59F4768CBEE75A604E4F5D5EF0CAA7C6249909C889AE8073EB7C90D09C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 edef84053c131a9ada0c46ce52f126333f61083c421d772378c357179d41dca0
MD5 6f3bd77e740afd0db57a0b91063bc93b
SHA1 a03a4d62759ed2c61ed31014448b8598582e20ac
SHA512 fb7a01aed939c9476d1323875f72af812be9ecb2f3be6301d7815211fbc1625d6e879cf19b14bfe08b384a342ce055009d6861b5b36bedb1a43fce01aaba9e57
SSDEEP 3072:fXCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquhEGm7D5Lk17ox1tIpud630:fXCZqyXOplXaHlnm7Rkm1tYpBeh2BAoA
TLSH
T1573412376D59F4768CBEE75A604E4F5D5EF0CAA7C5249909C8C9AE80739B7C90D0AC30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2652_23398624\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

a6654192-99f4-45eb-a336-20363f78fa72.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2652_23398624\a6654192-99f4-45eb-a336-20363f78fa72.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_36B21AED3F98F043ACBA3A.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D}\_36B21AED3F98F043ACBA3A.exe
Size 2KB
SHA256 dafa4e0ffbcd14a47ffef97037660be4c9bd51d573f31c97d0247e0fbd29cd01
MD5 ea20f13a4b9cf60cf79804edfa0b514f
SHA1 9cbafb307dadd8b6d7d1c90c4be125fbbae460aa
SHA512 b10747f390aae73d6bfa36f9412e2985b2c9c3671baa5268d0e8232a024659195f2a0170a825e4f63aaa503d83ca1d36eb6858d3655ee782f651a6741829cd01
TLSH
T1A751BFB3355E8CEAD14726345C51CBD87621BDAB89283C3AB4E737AE54346D08D8E6E0
MD5 SHA1 SHA512 TLSH

Submit Download

MacroGamer.exe

Path C:\Users\Admin\Documents\MacroGamer\MacroGamer.exe
Size 534KB
SHA256 fd3357647b68f211dcff4fb84ad599c904760c038f7bb025f362b3da6a64aa01
MD5 a4233d79efa0ecdc659d72dc74f38752
SHA1 77270a861de6412649bd29a5aa12635387a8fee7
SHA512 18f1454428d1c4e9c9c9a025f67cfc9101e5ec025ac61452f28fa3c7455c870ef463e2fcad016df86b256ebd8f6a7841b07c4396b7f58c2c2835d0c4212f18aa
SSDEEP 6144:9qv4sIND/AB4jYWoyGN2Ik5AfPjFWFNAy/7+dOYG+RWuABWEJwFFprmXy:oABhABEXotkI0A8AyzKOcuBWEmpUy
TLSH
T171C4AE273DE180B6D67232B4BF66D329627AFE300631A50B67D01CCA77739819A35763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kh.dll

Path C:\Users\Admin\Documents\MacroGamer\kh.dll
Size 4KB
SHA256 ab05f3533dbcd3d829e984e33110c7c568cbd64bd1cf9dfa3408b6315d1f668f
MD5 3908212a9e2bf9839e765655a31a8001
SHA1 fb0ba65176aa3bbe1558530c68e8fa096b9c0a7a
SHA512 80e51096f684367a7274da5a418550aec5b9e5506604a0b424b90efa432bb40cd5e7cdd49bc474bd9caf4e572b00704717f36516d8cd3e80d27087792effe73a
SSDEEP 48:6mh9GMCc917rXV2fMrXUEaMrDFSGsh1MluhewNgZ+6:F17zV2fMXrZSGshOuhlNgI6
TLSH
T10B91415FA3424557C0CC17FAA95B3A7B122B4DB43AE601179CF7950B382B3935E35B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgconfig.dat

Path C:\Users\Admin\Documents\MacroGamer\mgconfig.dat
Size 98B
SHA256 06fc4aeba8af535656c8d3d4d6804e02f73348edf61d91f325a7fa4ec58ce449
MD5 604e297e623edc17ac727f89796c2e2a
SHA1 22aaec3d159df072817b698b1661d97a77645aa5
SHA512 36365db77086d3e42602666fe0b6b1df7252c8480b5e29314b541485dc8ec89e94651e7857c150b978f56dd1112e134bc91d4360ed631e913883e7868265f419
TLSH
T15EB0024F710DD51B42310720A90567507415170D912DD554F3A7D3959C984D16404176
MD5 SHA1 SHA512 TLSH

Submit Download

profile.mgp

Path C:\Users\Admin\Documents\MacroGamer\profile.mgp
Size 149B
SHA256 d9a7f89b0a5e9c5cff8bf2073e9af520347930d8de7db73fd9619bae7cf68e49
MD5 c37c104cb195d1667874c32e2c1ed9ea
SHA1 29ed44d86255f792ec3ae37446ca1c81d0212bff
SHA512 59c1c24e4a9a599257ca24c968c2420b4dff8223e287941c5bc6345e91dd017086da0ff9f1e57cf3b90d013be783ddba44c7f9744ddfb0245dd40f62fca9753c
TLSH
T13EC0483EC437EAB530AD00D800A8CF04AF03808300A720702C027FDB3C13510EC6F2A6
MD5 SHA1 SHA512 TLSH

Submit Download

scancodes.dat

Path C:\Users\Admin\Documents\MacroGamer\scancodes.dat
Size 2KB
SHA256 4c2f8d3dec39671648aa256bfcd220e9f1efccb644309f17e5535151ad7c5dfa
MD5 f34e92039e140abfee02b4429d0c8390
SHA1 7851f43a016404d14cadfa1b452d2ec57a23fd4d
SHA512 2b6bc206699534167be34105f2af271cf53dd15ec3080889e9fc016dadae70c525155a4de66366c0edf0fb65a8eba05b0fd06bdc0237bf517045a016ad21325b
TLSH
T125415551E99D16C1EA737292BFB24F110C6AA30A104E3AA337A57F566D80636EA0703C
MD5 SHA1 SHA512 TLSH

Submit Download

MacroGamer_v275_Source.zip

Path C:\Users\Admin\Downloads\MacroGamer_v275_Source.zip
Size 142KB
SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
MD5 da89d18de41449fab464d6399aa60d7f
SHA1 8056ad22af11affdc1e9911394900c04d8378a1f
SHA512 3fa8202cb495fce447e96c19b0a076e656b3ad65cdd8e110fb1af370f76be982858e35149b9ede8e462ef6d588631167a7890dad5802034e03f405e14e3ccee9
SSDEEP 3072:ltW65EkLxMhk8mfCVi6hV6g1+nC+fkVqoRgmcU79zMi61PBUvn59/N+K8HBf:ltOcxI5VnV6g1L+fkbRH3WiTx98Kg
TLSH
T1B9E312B4967E1C40E19B55B2AF1043712FEA17E102A6D4CD903046F9BBCB3E479BB85E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 74ccdd54f0ba4c616f62b2c62b1140ae77cecbfad38a5f538c523b041dc461b2
MD5 faf7a1627bb4e5e80cc73e6b65aa4adb
SHA1 5fff8d4be36c74bf7fcde7d455099ddb399288db
SHA512 7dee8de62576288e7c58b5c23f6f3ddc1e4de97db897c0f958ff603aaf58b32e834b0c8de5d22ebc848ac8a036ac62aa4a67c54ea96b073be9ef8a8b556ee052
SSDEEP 24576:eu8m+1zcdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:5
TLSH
T13547A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a8936282-7c9f-4ebc-bd28-7a1a8cc8f2cc}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a8936282-7c9f-4ebc-bd28-7a1a8cc8f2cc}_OnDiskSnapshotProp
Size 6KB
SHA256 d319c632c1ea4c85d93500197bab69d8271f7cf6de90313db719dbaf1c8817c0
MD5 d564cc5463cd1f376abd10b24ec6b2cd
SHA1 70c23cd89cc23b16497f7bd6b6a4fdb0d6a7822d
SHA512 68de583f0277ea0e6fcf05b11f55ca229d1a28fafc8acd8fe0b874c9873c1da81e130e6c91d3213f73fb267e26ccb3db07daeced8d0d4f8d3d406424703c7a76
SSDEEP 96:FH6lmpOMivc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:empYb++ZVm
TLSH
T12ED178085AF54711E2B3AB7129F14557A877B911EF33CB8E0198238E6670910F936F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download