hxxps://www[.]mediafire[.]com/file/e5tshm84p4pindf/game[.]exe/file

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
333s
max time network
335s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/e5tshm84p4pindf/game.exe/file
Sample260930-pltkmaxdke

Score

8^/10

defense_evasion discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
165	960	chrome.exe

Executes dropped EXE 6 IoCs

pid	Process
2680	game.exe
3132	game.exe
1004	game.exe
640	game.exe
6112	game.exe
3716	game.exe

Loads dropped DLL 64 IoCs

pid	Process
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
3132	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe
640	game.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
251	discord.com
70	discord.com
230	discord.com
243	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\game.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001c00000002b610-531.dat	pyinstaller

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\game.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1716	1568	chrome.exe	80
PID 1568 wrote to memory of 6132	1568	chrome.exe	81
PID 1568 wrote to memory of 6132	1568	chrome.exe	81
PID 1568 wrote to memory of 960	1568	chrome.exe	82
PID 1568 wrote to memory of 5248	1568	chrome.exe	83
PID 1568 wrote to memory of 5248	1568	chrome.exe	83
PID 1568 wrote to memory of 4736	1568	chrome.exe	84
PID 1568 wrote to memory of 6068	1568	chrome.exe	85
PID 1568 wrote to memory of 4736	1568	chrome.exe	84
PID 1568 wrote to memory of 6068	1568	chrome.exe	85
PID 1568 wrote to memory of 2184	1568	chrome.exe	86
PID 1568 wrote to memory of 2184	1568	chrome.exe	86
PID 1568 wrote to memory of 3456	1568	chrome.exe	89
PID 1568 wrote to memory of 3456	1568	chrome.exe	89
PID 1568 wrote to memory of 3544	1568	chrome.exe	90
PID 1568 wrote to memory of 3544	1568	chrome.exe	90
PID 1568 wrote to memory of 1096	1568	chrome.exe	91
PID 1568 wrote to memory of 1096	1568	chrome.exe	91
PID 1568 wrote to memory of 808	1568	chrome.exe	92
PID 1568 wrote to memory of 808	1568	chrome.exe	92
PID 1568 wrote to memory of 5012	1568	chrome.exe	93
PID 1568 wrote to memory of 5012	1568	chrome.exe	93
PID 1568 wrote to memory of 4968	1568	chrome.exe	94
PID 1568 wrote to memory of 4968	1568	chrome.exe	94
PID 1568 wrote to memory of 4732	1568	chrome.exe	95
PID 1568 wrote to memory of 4732	1568	chrome.exe	95
PID 1568 wrote to memory of 3964	1568	chrome.exe	96
PID 1568 wrote to memory of 3964	1568	chrome.exe	96
PID 1568 wrote to memory of 1400	1568	chrome.exe	97
PID 1568 wrote to memory of 1976	1568	chrome.exe	100
PID 1568 wrote to memory of 5196	1568	chrome.exe	99
PID 1568 wrote to memory of 1976	1568	chrome.exe	100
PID 1568 wrote to memory of 5196	1568	chrome.exe	99
PID 1568 wrote to memory of 4576	1568	chrome.exe	101
PID 1568 wrote to memory of 5240	1568	chrome.exe	102
PID 1568 wrote to memory of 5108	1568	chrome.exe	103
PID 1568 wrote to memory of 2604	1568	chrome.exe	104
PID 1568 wrote to memory of 2604	1568	chrome.exe	104
PID 1568 wrote to memory of 1948	1568	chrome.exe	105
PID 1568 wrote to memory of 1948	1568	chrome.exe	105
PID 1568 wrote to memory of 6124	1568	chrome.exe	106
PID 1568 wrote to memory of 6124	1568	chrome.exe	106
PID 1568 wrote to memory of 5216	1568	chrome.exe	107
PID 1568 wrote to memory of 5216	1568	chrome.exe	107
PID 1568 wrote to memory of 5100	1568	chrome.exe	108
PID 1568 wrote to memory of 3892	1568	chrome.exe	109
PID 1568 wrote to memory of 1896	1568	chrome.exe	110
PID 1568 wrote to memory of 1896	1568	chrome.exe	110
PID 1568 wrote to memory of 2680	1568	chrome.exe	111
PID 2680 wrote to memory of 3132	2680	game.exe	112
PID 1568 wrote to memory of 1004	1568	chrome.exe	114
PID 1004 wrote to memory of 640	1004	game.exe	115
PID 6112 wrote to memory of 3716	6112	game.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/e5tshm84p4pindf/game.exe/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8fdc728,0x7ff8f8fdc734,0x7ff8f8fdc740
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,7924123286641896291,18275279614333159873,262144 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,1696893442144698592,6469392086150531002,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,779181909287773445,6819313531443664029,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,8772621150650166861,17444543013528904003,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5953309428192798187,4018648470825073020,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,8996627389274527611,8276704011648286836,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3960 /prefetch:9
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,16708665214618231574,17089409902121707199,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5032,i,7587703587289569519,6785397437251440011,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5080,i,7733393825110230322,17530735592012613970,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5284,i,1971589928967127940,10387333004612425635,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5616,i,5474722624271163522,5484432951631572821,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4768,i,6828901681010356493,945583130837723936,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5840,i,13399198750945102219,7693857209374530700,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5928,i,12003212803038289288,12649150136042746730,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6912,i,5467339774972996173,2446732885748054655,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6068,i,9269079033926693084,11529025576229396325,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6132,i,16786456185232254182,8602847810193286171,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,4006074812245715970,17576317121948435134,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,7328508509946954680,4083856102588505392,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,11839190262399512843,15139943050664021811,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5080,i,11466293964680899395,15280846360013517254,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5144,i,2741369927755188502,14461225547502263892,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5452,i,10531846880460706228,6751671233320903610,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7164,i,17224807217283892066,685546246444392542,2097152 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7116,i,15675432901956373833,17384570060378402082,262144 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7068 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,17154621098747206724,16231191226967297614,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,5992688864981426146,18421298123407355855,524288 --field-trial-handle=1876,i,15466058369179608130,2068262037394453962,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:1896
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\Downloads\game.exe
    "C:\Users\Admin\Downloads\game.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:3132
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\Downloads\game.exe
    "C:\Users\Admin\Downloads\game.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5784

C:\Users\Admin\Downloads\game.exe
"C:\Users\Admin\Downloads\game.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f45900ceeb7dc9678556463babb47662b5e544418a8cd415a5a3f9de01629e1f
MD5 9b9ccd6148c837ae3e8ed6a0a6345a9e
SHA1 6d0831a5a28910b0448453ecd510109643c80ea5
SHA512 bd19012e102b93cad070dcf6b461d144328094253aa3760416059c8df402e40a34382c33d5a55fb22f8a477484aa221270b043d913647dbdeeeb044acfd928a0
MD5 SHA1 SHA512

Submit Download

29bf894d-c7b0-44ef-909d-5dea119d9b36.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29bf894d-c7b0-44ef-909d-5dea119d9b36.tmp
Size 17KB
SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
MD5 10219fe671f251c5a102a95887dac447
SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
TLSH
T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 035c189e886d1e8738f7d04dc40f638f433b201dd9e3dc1bf043db41dbcf354a
MD5 eb597f95b77e0534bce11d2bb07a6c7f
SHA1 b106642ce4e29edffbb3e4a2f585ea1706826563
SHA512 5f1f56cd3a5cf1e6901be5a921282fd56867e6b15c23f7fe24592446e6fbf6e250d2d6ea9379d6113965a1c3f766f64975a0baf04ad5ac734947d45c81d9854a
TLSH
T127F028A6DC21EC7B18FC0B2874A54B4AE765136B2A80894F3B3D410C4FB063B869685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 6f0729a8b0507bd4633fda07b4138571b07b6759f98ce3308e6fe647d4c3caba
MD5 e1cf26fca9ac092f12afb62cb875c29c
SHA1 925540a38553e6672caaa80880509f999e3122e1
SHA512 cceb65f7ba676d25605d43eb8972f97b3e5bbfed6061a9481bbe1813511117b29e01b8af70ad625746bd1de73059cd3d15ca39dc866e5ab290bb178a27d8a787
TLSH
T16C31BE10A2D6F040DB0E35700AFB5C5D7277FD688B630E9E748964F07CBE76455D0A55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c89f688b82094a33ca0652a3e4e2e72aa8550d478396b1383ddb2f4be6ebee59
MD5 bd70bff927f56910a99b69f7f609f91c
SHA1 da1a9d0a20abb693252f597e460bb8403a635d02
SHA512 2013a2d37d1850b6214df180a9fa8332a4357ab1f421fcf92f3ef00b36258eed78b1354d90370d25ee51ebfa6af9f2b3d3bab62c143681ecec0ae2438be557bf
TLSH
T167512F80F1C9F450DF1926701DEA0C8D713BF96887E38E8B3885A2F47CBB796D590651
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 73bc1393b491aa7784a52c58edffa36d47ebbad63b4666088546402de14e2971
MD5 1f1a90e4073bd5e9420f5740d54cf465
SHA1 e09273503ce4f0b90484fd8c71b735da91dacb3e
SHA512 8004649b7cf95c432d7a2671aaa278437f6087e8c7bf191fbf0e6c524a6e335c33a22509b99819a706b73c01adc1868ea693f75fefdb2b586c0ed9c7fa48beff
SSDEEP 384:Dk1IgnevYBTeJZTBeF5/jJtJTBeXF7r1PAoPji4S+g9tS4nq6KY+2oYKLqrLAYfO:1GnJKS3LVnLrDMKb2HTzdjTwjE84nxNp
TLSH
T11BB2CAF383E5D66E89015BF896146E1BCF1C0B59432C3C1688D5EE4BE3E2472E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 93c5414e80ef40796fe875c05649ea81ada8bd5d8bd1254cb3072910ae46b8da
MD5 233b4b54990968efb9af703e4be43571
SHA1 7881dd0f2319aaf7bd3aa6e88a9bbb0de568b9d8
SHA512 980269cddcb95c0aa774f8e2ef003d16d016e2cd4f7ad68f304cad01cab8a2a5c2b2b3f3063a53e2d4310e6cc47f262c5e4caa6e4c941a3233686dd61c07f9f0
SSDEEP 768:uPnJz3bS3LLrDMKb1TzBXTwjEXjtNk+MQbg7P:6kB0+bcP
TLSH
T177D2BDF783E5D62E89015AF89A146E1BCF1D0719832C3C2688D5EE47E3E3472E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 30KB
SHA256 a7b856d4f9297a7bb91b98e76a565bc68bd2deb4666be0c58f512e4b70b6144c
MD5 41210258099bf361d626f7ae54a9242b
SHA1 09a184a5d731eefb8078770d28a4ff0cb3b2e78f
SHA512 50510db846a7eea542317873020dafe5501679fc4074d9af153c0670794c22dff63b2ea665fa0c203fdd6a43230093a392e5643ef11400930f25324dd9699971
SSDEEP 768:1GnJrS3LVnLrDMKb2HTz6XTwjE84tNYP+McEgj:cY260sEA
TLSH
T106D2EDF783E5D62E89015AF896146E1BCF1D0719832C3C2688D5EE4BE3E3472E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd5ad666573cfef3ad99de843353a467d44d6a155e4f1c3f49c4b77b5e5eac31
MD5 e94e979367fafe38176cc419d8d420e2
SHA1 ddcb2b531ff2c998f1ac2f7618e3a31e4472e0cb
SHA512 64aa4938bdb1c841d45621f6e969a2cb209db88f9ec6e5050c11489fdce69388f667851b76e1a7a9e72784dd4544b2aef1b12608f5c659fe893629949d7e203f
SSDEEP 192:qRK6g6B4r9FHRA9pT9L8nkMa8sv79fGpAPRp26f9+Hsb+WNn+I0o0J42qtuNHmkC:qRKRg4rka4NGUXTow+vJ42xNGkjZxe
TLSH
T1C842C52DAD50757B5CEAD22AF9227B6BD7F5002224942E88E6FC893C10D7ADC3213467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c9acbb8ad4cf3283fc43e683b7779753918b0506cbd651e660b4b2a05e91129b
MD5 98828d9c2b4b7972dec3440d2c28edb6
SHA1 26625e39d14efb49a52354c5f56270756443d2e1
SHA512 3ec836e99eff58c752b6e5c66de668fc62593c25b73d35a3d07eeff71f92376dd08347d5503145990a7d02f12084d23816fcdc40873b6c554dd6b0d164bb3632
SSDEEP 192:qRCSg6B4r9FHRA9pT9L8nkMaFv79fGpbPRpT/aMgyKI9+Hsb+WN3DM+I0oIeeltO:qRCJg4rk3NGlX7owvvaeCNGkjZ0E
TLSH
T16852D86EED5039BB5CEAD22AF9617B6BE3F5102524902E88E6FC8D3C10D76DC2213457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6f1f63926a4b541d90186d9f3f276a45efed9159dcddaf98720a9c68c439eb3c
MD5 2bdecd0b5be9eabbb27eca7010284894
SHA1 7516aaa0ffc216d621a9512eabbb90425d95c934
SHA512 be6cd92e7ac9f2cd0b355a367c7053788c878fbc7c78a66cb99f1d2ad48f7d1154bfd7f44472c8589e51c5d3973c6a9ea3faec424d1e356a259199c27b8b873c
SSDEEP 192:qRRSg6B4r9FHRA9pT9L8nkMaMv79fGpbPRpT/aMgyKI9+Hsb+WN3LBEM+I0oE7Ya:qRRJg4rkKNGlX7owOvXYSNGkjZ0E
TLSH
T1A952D86EAD5039BB5CEAD22AF9257B6BD3F5102524902E88E6FC8D2C10D76DD2213453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 60421767456add0b5fe59c7306628de3bcd2379949bb7549db343e306a74d59f
MD5 3f94d2bf74a82dbb64bfaf6a6394192b
SHA1 53c9cdcef88388cbfc99832b6858a4049711b04c
SHA512 0e22a345d71d35b519fcef4e14984844ef527b29688d3cd0cb1224579b8e75d40fbd0b1232fad4f8b17260b81110471b603ddbde5a6734291d63b6c35397da50
SSDEEP 192:qRCSg6B4r9FHRA9pT9L8nkMaMv79fGpbPRpT/aMgyKI9+Hsb+WN3LBEM+I0oE7Ya:qRCJg4rkKNGlX7owOvXYSNGkjZ0E
TLSH
T11652D86AAD5039BB5CEAD22AF9257B6BD3F5102524902E88E6FC8D2C10D76DD2213453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 869dd51e9be8d17c003daaeb5b83ad412bf0b97f5b9b0c362fb556316f714648
MD5 99178ee3b8669b8764f57379e0abd065
SHA1 e846fa0e9b8fcb93a546bee3d1a38e2487440bc7
SHA512 069c913b8de2f23b053c818d9966fe6bba40221e4106ca00890fa0ae9257bee67810bce3df469f9070be92177bd2b89ee4119a28fc6a0ca85ca26c2d565659d4
SSDEEP 192:qRCSg6B4r9FHRA9pT9L8nkMa8v79fGpbPRpT/aMgyKI9+Hsb+WN3LBEM+I0oE7Ya:qRCJg4rk+NGlX7owOvXYSNGkjZ0E
TLSH
T17452D86AAD5039BB5CEAD22AF9257B6BD3F5102524902E88E6FC8D3C10D76DD2213453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 67f43c57a50fd66b36252055891ce8eeb9746234c164650b07b5b5709ef1d996
MD5 0c4858d5b7b8233aa5f8cc827cc94b95
SHA1 41b4fed5e6354482888423e00f369620f0401677
SHA512 92e3f446a763f9647e6820bd12dadef42d5cd36cc591c52432be640212202079c96c052ca1af52709e9b1712fdf4c71bbb5f51e0bb4cc3dc80d4aefad6ae8605
SSDEEP 192:qRCSg6B4r9FHRA9pT9L8nkMa8sv79fGpbPRpT/aMgyKI9+Hsb+WN3DM+I0oIeelw:qRCJg4rka4NGlX7owvvaeCNGkjZ0E
TLSH
T1C352D86EEC5039BB4CEAD22AF9617B6BE3F5102524902E88E6FC8D2C10D76DC2213457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a34659c5ac87933dae1ded645b10a07bc33387d61e88fd20db4a5305251dad32
MD5 4fbdd00892a0f817c80b6a9da87d1db3
SHA1 4943fc432b6531fc0d2722851187f8d723782d77
SHA512 82f6c54b3f332dff9435cf949ddd5d6bb9ad61f6411f4d733bce381810acb69bcf51367b4414cc0a54ebf688659367fdcd2ca1a17c0fd55d219ccd1fa9614ffb
SSDEEP 192:qRCSg6B4r9FHRA9pT9L8nkMa3v79fGpbPRpT/aMgyKI9+Hsb+WN3LBEM+I0oE7Ya:qRCJg4rkBNGlX7owOvXYSNGkjZ0E
TLSH
T13552D86AAD5039BB5CEAD22AF9257B6BE3F5102124902E88E6FC8D3C10D76DC2213453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e616b14d9de8738ffe2b9daa1bb43c099753410b783967208752ce9749a38aea
MD5 c70932dd7f6ff36e9866ac6106c3474d
SHA1 b6d3453e061b5f052929b7c742408dd6ba647c28
SHA512 33d034b399450648c726b9d4404e141b4f38a90cbb2ed612a7f46334369be9a86fbf1116c7c874302817b607a5bb1afe12621f9e8d7cacc206ce946595d7dfd5
TLSH
T10CB012958481A741C00203F4225054893194DF35BB05134141F04D41D835150902F154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591cd5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591cd5.TMP
Size 96B
SHA256 98eece6cb4eb2c8714dc3b3d6a2e796eaf9fbf52a79b8fea49f20e48f493436a
MD5 3e1e017330af700405c5f0ab6f5d4431
SHA1 63129be339967b1a79acf1b419578e05443ae94d
SHA512 e610e73993ec11ef2ff302caaa76225b85c40c1c3d0812fe271cd448a6973c331e6fa0bf1806a3840e37e33bf60f18bdfbee9ac22634d4003f242ad817e8d46b
TLSH
T1F3B022B0C002F332C00203F038E0C0E830A0EF22E3032302A2F00EE3EC202300228020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 20d1a472ca3beecfddf32ef7258540994263812463817346cbf47f7b64306924
MD5 4fb68720efa52c13e6bf72beced22cb7
SHA1 6c02ad72e9d19754b4ebe1dda6905b4ae3fd67dc
SHA512 913025ff0d2da56e3076a3fac38af5698ed2d68213d997a2d860aefb430e58e50f28f89f40ae0c86c36cc550c31fb0b7aabac286b8d4c513b9e857910b1976cd
TLSH
T18AA002568FC41941F0051EB410C313C02321CD100745530354964184DD701C14F05140
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 ccd0c0d1ebf8008d2c6f267eb462cd343c54ac25297c6a245080324bc3dd08bf
MD5 82cf10a71292ff05766fb9bf40571991
SHA1 30a0b38cae85ca3265c2364a4aec9ac745bce8b9
SHA512 53ef00d487f9469e49843a5d8d679f6ec9ad9e8de21f340cfc618394a050658d25fb07c26d3b3dfa49b0649bfbb31dcdf56eedb83db4220f60c4825f938863b6
SSDEEP 3072:0ecT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:0erThDxWhaj5mjie/JYFobx
TLSH
T149D31223ACEE01FB15BCC50890793F0086F985B3D640FF679AE86A4F51C7EA4A36B155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 172KB
SHA256 2ea183f4f33a4561d4fa247f14543ca5fe7f846f47d75ba2e891bbef7441e7a3
MD5 1f2e2e996b0f14beb8d6f004ebcb90bd
SHA1 4055d74782fb24c1d7fdc5420c1942a856cb980f
SHA512 97ef548eaf4fdba2bbae78c6faf8f2fc18abdd699e3a78032344a7d7b7cfdd4ff955b68e174f5b507236ed6c6071af961bb38664954b5382d5ac230f58b172a7
SSDEEP 3072:0H1HqVdZyOVUrdYrxGlsP6YT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOg:0MOdY16vThDxWhaj5mjie/JYFobx
TLSH
T1870413519CAD0DFB1DFCC50840793B01B2F846B35644EB9F87ECBA8B21E6D986316664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 5cce222db71f2b61f34b81c765c9943d31a3878e87b4a7614984d8efe65aff5b
MD5 04fb49af07a808f68e960a9dfb52b8e3
SHA1 d9da31e51eab3bbd1dba6d9aae261499876d1279
SHA512 e07e83a82bc4c57fd8c64d74a144d6665f03124282b4cd81565e23305b2a1719d1a66ba12c2359071c1035f22383a60ac8d06c4fe92f7d402cfec70639336604
SSDEEP 3072:I/IMT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:Ig7ThDxWhaj5mjie/JYFobx
TLSH
T193D312239CEE05FB19BCC50840793F0086F985B39640FF679AE86A4F50C7EA8A367156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 d67d9144c2bfa1996884c5257db1af91e37b9dd631ce5d5477e29deaacdab935
MD5 2af5a8b9a867860086680fc2c4343ddb
SHA1 c23d7287fe1cdf404a4df88da9a1562d41f1ef4d
SHA512 cff808fba982742f6ad7dea753e8ff89813618991a21c72f3e6aa9a66bd4bb313f478b47f29d3d46f73a3f7ee52288babf9571004810b4400237573e4ae6b830
SSDEEP 3072:JtT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JeThDxWhaj5mjie/JYFobx
TLSH
T1A5D31223ACEE01FB14BCC508907D3F0086F985B39640FFA79ADC6A4F61D7EA4A366155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 959dcaed39d7a7b6cf195d1bda1ea47e861fd0627c2f8875ab3271c64daacfad
MD5 cdcdc50be9db4901888a9a65861e8277
SHA1 43d6a06c2822eb3bc57d130985d0c47c6d574df1
SHA512 2c862fbd82d17a2d6efaa43a654d4671ba5e7cfa82155bcf0b099353ff62683661192f1ccc8cea13303047234eb4b72f567bc0af8b0307ce076a8ea3a39d7314
SSDEEP 3072:JecT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JerThDxWhaj5mjie/JYFobx
TLSH
T1ADD31223ACEE01FB15BCC50890793F0086F985B39640FF679AE86A4F51C7EA4A36B155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 5c9dafa1537a316d3f42b421b0234b1dd93c5161cb23108cd973a0bd8911e175
MD5 eb7345a3559ac8fd28133af9620c9963
SHA1 4caacb6e0c9aa3f406a031fda24fa95e33170a30
SHA512 4f371536e0a4e1f88ba4dd0f759ac768035fa544ff0f4fbd516bb039e4d9214abf2d845182143a6cd5bd15e20d4359d6ee662dc0cedd7612b1c1721a0df16405
SSDEEP 3072:0/IMT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:0g7ThDxWhaj5mjie/JYFobx
TLSH
T1C8D312239CEE05FB19BCC50840793F0086F985B39640FF679AE86A4F50C7EE4A367156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_asyncio.pyd
Size 70KB
SHA256 adaaf0c703641f6dbed30d101a5e23c17cc9454c36303394b9e28a52ea457471
MD5 0693819137d5c98bfae7f06b0d76a8f9
SHA1 d9d92845f0f41a600e3967a1fd05ca69f2147a34
SHA512 ab08c8fc551d96c5f5cfa81b72f2ef8256c852c676cfb2c60a93f06dbfd07577679ddd0cc3356092ac91412e6442572f8af92cc467c4cde0475c4cbb918ae4d2
SSDEEP 1536:wCY0h2ZouTTuqsHQH79Iyvnuyrcz895fIiJ:wCD2rnuqsHG79IyvnKRy
TLSH
T1D3638E87A2A44247DA97B274C5736F56FBB0F6521902534F61E8C28E2F13791C3FE622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
MD5 8401e66257d7a7c03e2783b8adcee482
SHA1 57f6a22162c76964675dfe35e79be229bd6e54e2
SHA512 e868dd99b1a8f1d0d5f84af461573aae35f9e4433dd5710a23fb2f7b3f552405255e7ebd048b206412e80cf327d10f093c510befc335e4dc2461229f9fae36f6
SSDEEP 3072:KBZr0elNwqlDYuhJsPXHDFYHuSQT9wPHeR4quOVstP7eBSTLEKXj25Mf78A+TVq:KTwqd8jFYHuSQxwPHROVQKBSTLrqg78Z
TLSH
T130046C5A329C11B6D5A2917886579B43E3B3B430171197CF01A0C7B62F1BBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_elementtree.pyd
Size 133KB
SHA256 6fcc5528ce81f4514fb11cc7248080fd335a3c60d898e845d3341ee589887da1
MD5 a52f49f8fc408a15e0717c1d7bd1c803
SHA1 45b8ffa6f2e04494c274cb2fb176af60091b1092
SHA512 fb2a5d88f43b2370681de2e46042e7568ccb503568473ceec1c993e9e936b275ee3b4ab968a12740e567604d2490b252104c8a9aa079644ff935693ec8afc745
SSDEEP 3072:Xn4rCCrToRaQi3+al3fJ5LaYLZbpO0brsHL8nf4QWTVIyzf1i1Yic:Xn4r3rToR79al3fJNjbIIf4QWTzh
TLSH
T103D35B4B7165C06BE0A35038D2678F56DBB6F9A20E0087DF2284F29D9F373913E69715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_multiprocessing.pyd
Size 36KB
SHA256 7b21c5b0ebee82b0d85724f245857d65e23f82c6aaf392efcd4f800462025d92
MD5 25fc0102fdb08c54e6bd72c0b11b1a4c
SHA1 2dc0d9a3bbcfef184699c147ac2cfa2fcb40a7b8
SHA512 89640ff838030ca75309184bcf1ad58a8ad3a917564a4185675bc7494630bbfc5b821dfab53081b5a786553aae89958b057c369b4d56af12ccb0fcea983e3d03
SSDEEP 768:L+hu80ZnR2VcZ7Dz2dtIyntAXyrcEOJh2Ip4i6Cxf1mlY6Ce:Khu80Yu7Dz2dtIyntSyrcz89WfIie
TLSH
T122F28D4AA6684053E963A671C5A3DF8AF538F7831B21864F7195D2CD1E33381A36E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_overlapped.pyd
Size 56KB
SHA256 fae5e0e822434da7b1707b9ae4c77b8fa7d1d7b810e7e2f5cacf04449c714086
MD5 4a721637bc0c8b53d13485f5030da7b5
SHA1 7424dde1d136649e68b1f13cd0e738a1d428393a
SHA512 fff4270fd6d759d31ae6784510208ab4d2eb0b454799d393f4d2155a6dad9c8b836233eb3d233002491019bbeba87e9e862c8eee608a51a0f83194a9a5110e13
SSDEEP 1536:dMm7HdS/l5atPzKAdE+DRIyWt9yrcz89WzfIW44zvrdn:ThBzVdEeRIyWtnaW4IDR
TLSH
T1C1437C496B9400DAED63C1B9D5A38E47FB78B3D34601531F61A8D24E1F73392B72E289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\_queue.pyd
Size 33KB
SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
MD5 8fc4810cff733e6f17a7530d3fb67d58
SHA1 20163031892c87a67169f4ae25115e4e33845626
SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
TLSH
T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\base_library.zip
Size 1.3MB
SHA256 7365f4a9295f71c8648c3f72536b7adefba73e5708c780abbd01af8b814ac90f
MD5 7d5034a4b1291b37bc432cffca14e640
SHA1 b2ae9b4c595f5ff0ac6beb592493e84d211e8dd5
SHA512 e5928cbf7ffd63880c408f4003f1cfc0c7529a88dec0eac31ea63c26415d2f0fb570a615e13dd429438c445943a0ac65eaa5d1c2e5e510014ea9334dafef7859
SSDEEP 12288:SiqO6wi2cPPdxhYtyCMWfIW7WpKL+DmQuOBa80201jwCVRDVoioSYBRqhTQ+djdM:S65cPPdxhY57WpvzRqJdZB7SeT1Vm
TLSH
T12F551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\pyexpat.pyd
Size 199KB
SHA256 567f19a92479e66b652ffaadbddba26b7c5dda43d5e97c67a4a76a076021b736
MD5 feb79984518146b9703d3913d54f2106
SHA1 6a4eb8d7e593f008308f05bf26f7caf7d76a1716
SHA512 4b5a67c38aa149cde71ccc1171cd55af8a12a66d514f63fb543005d9ee8f19226f839d28782187a0e46e0f205e3307e4e0739e1b2bd64c0e99e0af794c1836e8
SSDEEP 6144:xS4jcle1bq6XFdTW4yxB+LjrKHP1XcPump:Fclaq6wT1Xaump
TLSH
T143145C4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\python3.DLL
Size 70KB
SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
MD5 c947a886e61ad18d052840e095aaa5fc
SHA1 4a2d0092e50757e0b951565c02dd541ab48da96e
SHA512 d4b3d769fa4c22e914e12ac8b63263bacda72b351bea5bd53ba1d0fd6a6c57c98fc392645170f26e7c84fdf855fbe587615f4f3b1f150285420f5b26bda2da0a
SSDEEP 1536:LotssyKcunV8PT5Iyy00yrcz89YfIZRSjB:MtssyKQ5Iyy0AcZoB
TLSH
T120634CC25B5BF8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\select.pyd
Size 32KB
SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
MD5 e5728d041bfb1841fc460db4027a2952
SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
TLSH
T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\unicodedata.pyd
Size 695KB
SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
TLSH
T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmain.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\vmain.py
Size 4KB
SHA256 64fcee0ad58c76f347333b17d44b4c6f6256cb98bfa813a21c92fae1a39422c4
MD5 82ae5e57889e529d51ee32ad1f03dab6
SHA1 ba505239540ff9f97332ad065f6d932e85d02abc
SHA512 b83c18e1dc4c56020a77db1f835262029dbf98b19ce337b5ec5deba6cd138b8033a605b4e10a7a5ef6ff17487c6e7850979777d810619c099b110e4656b88fa8
SSDEEP 96:BiVDwuOW+2m+WuuG+m28vGuO2gXWme2BBinPmb5MJF3Tc87PRSCTgKs:0VDwuOW+2m+WuuG+m28vGuO2gXWme2uk
TLSH
T15B819C5ADC164A5083F2E58C8E32E845F36817EF1649171F7AFC88589F3CCB8A19497E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a782\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e02\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e02\_tcl_data\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e02\attrs-26.1.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

game.exe

Path C:\Users\Admin\Downloads\game.exe
Size 28.1MB
SHA256 25a43ec8a068aa629d288dd28ab297b4bb20051f629c79e6629ac319559fb44d
MD5 2134557456aa10dff24631bb51ca5d24
SHA1 f8a86702c93e6df46c3ab1b5b94035fbae188b47
SHA512 18721eaae10e3ad45e97e4cfa94aafc474ac22009511d290e9941457a4677f974360853475cedefb1bc684132dde7ead116d23bbeb36474856535315c3f4978c
SSDEEP 786432:e5vzWpLRvjXoRldWzbW8MC60h0bCOvV/M8+4Vq7CqxzaDF5BG:e9zWpHWOKbC78+hLaF5
TLSH
T1D15733547B9504D9E5C1BA3AD5D60C76A391FA120BB0C0CF1AF818B01AB72D8AF7CF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\game.exe:Zone.Identifier
Size 312B
SHA256 dd4e43236828a35857385d1f188e730f9c56695c5efecc47e49b2bb22e4db148
MD5 b4f0eb915399c99c06d29fe0b37cc676
SHA1 29b9164cb1cf3250a44df80530e9ec92002a0744
SHA512 7c0ddcb2485617cf52d9c6593c4667f836985acef1842b4b705483e815b6e146b13fc08adef3177f788b2ea4b9c8d9d265fc9b054cb97ceb5ba915b7800fd913
TLSH
T16FE07D27C8D55542036876C0207ED45D300F7CED00A7E210BD948A638AA801583D0E5A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-2728-0x00007FF8F8510000-0x00007FF8F8539000-memory.dmp

Download

memory/3132-1640-0x00007FF8F9680000-0x00007FF8F96A9000-memory.dmp

Download