91f0c6327b0d1de06d38a894deda96595938d103d675257c896c7d939da943bc

Analysis

user interaction
yes
max time kernel
98s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xenonLauncher.exe
Size 5.6MB
Sample261030-vbxr7afa47
SHA256 91f0c6327b0d1de06d38a894deda96595938d103d675257c896c7d939da943bc
MD5 7e25324ceb143ea528ba8fe365916f21
SHA1 c2f2624ba5d96b1cd126f7977c8e16b6a32579e3
SHA512 9763734186a24f47f7300723ba56ae5afdda6aa3c46d945b041e370433d0067cff2823947971e3f98106a2e2a6cacaac705bf9cd4dcc15287baaca6a10e70b18
SSDEEP 49152:3zUOl1TDae3C73lhQGxI+q6IuFJcIK9V0V/nPnN8rNvRbxeFe7WGfpVulxFUVyAd:nBGE6s9VpbxeUdfp8lxFQcrvE7+kD
TLSH
T1EE46EF17E36502ACC026D178CA539B13F3B178220B21E7DB23E59A955FA77F40E7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
65	5612	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
2976	FiveM.exe
200	CitizenFX.exe.new
5352	FiveM.exe
3504	FiveM.exe
4640	FiveM_DumpServer

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3020	GameBarPresenceWriter.exe
4772	GameBarPresenceWriter.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM_DumpServer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM_DumpServer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FiveM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FiveM.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5612	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Colors	FiveM.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	CitizenFX.exe.new
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{3C7A4082-8ED3-43A5-B9CA-83831082188B}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{F3C3F151-43E8-447D-8293-6E2EBF3E4FD7}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe
4112	xenonLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe
Token: SeShutdownPrivilege	248	chrome.exe
Token: SeCreatePagefilePrivilege	248	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
2976	FiveM.exe
3504	FiveM.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe
248	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	FiveM.exe
3504	FiveM.exe
4276	OpenWith.exe
3504	FiveM.exe
3504	FiveM.exe
4456	OpenWith.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 800	248	chrome.exe	91
PID 248 wrote to memory of 5612	248	chrome.exe	92
PID 248 wrote to memory of 3728	248	chrome.exe	93
PID 248 wrote to memory of 3728	248	chrome.exe	93
PID 248 wrote to memory of 3028	248	chrome.exe	95
PID 248 wrote to memory of 3028	248	chrome.exe	95
PID 248 wrote to memory of 5884	248	chrome.exe	97
PID 248 wrote to memory of 5872	248	chrome.exe	96
PID 248 wrote to memory of 5884	248	chrome.exe	97
PID 248 wrote to memory of 5872	248	chrome.exe	96
PID 248 wrote to memory of 6076	248	chrome.exe	98
PID 248 wrote to memory of 6076	248	chrome.exe	98
PID 248 wrote to memory of 5132	248	chrome.exe	99
PID 248 wrote to memory of 5132	248	chrome.exe	99
PID 248 wrote to memory of 2104	248	chrome.exe	100
PID 248 wrote to memory of 2104	248	chrome.exe	100
PID 248 wrote to memory of 4400	248	chrome.exe	102
PID 248 wrote to memory of 5080	248	chrome.exe	103
PID 248 wrote to memory of 3200	248	chrome.exe	104
PID 248 wrote to memory of 5080	248	chrome.exe	103
PID 248 wrote to memory of 3200	248	chrome.exe	104
PID 248 wrote to memory of 2480	248	chrome.exe	109
PID 248 wrote to memory of 1140	248	chrome.exe	108
PID 248 wrote to memory of 2480	248	chrome.exe	109
PID 248 wrote to memory of 1140	248	chrome.exe	108
PID 248 wrote to memory of 1756	248	chrome.exe	110
PID 248 wrote to memory of 1756	248	chrome.exe	110
PID 248 wrote to memory of 2036	248	chrome.exe	111
PID 248 wrote to memory of 2036	248	chrome.exe	111
PID 248 wrote to memory of 1656	248	chrome.exe	112
PID 248 wrote to memory of 1656	248	chrome.exe	112
PID 248 wrote to memory of 976	248	chrome.exe	113
PID 248 wrote to memory of 976	248	chrome.exe	113
PID 248 wrote to memory of 1940	248	chrome.exe	114
PID 248 wrote to memory of 1940	248	chrome.exe	114
PID 248 wrote to memory of 1504	248	chrome.exe	115
PID 248 wrote to memory of 2280	248	chrome.exe	116
PID 248 wrote to memory of 2280	248	chrome.exe	116
PID 248 wrote to memory of 1504	248	chrome.exe	115
PID 248 wrote to memory of 4568	248	chrome.exe	118
PID 248 wrote to memory of 1736	248	chrome.exe	117
PID 248 wrote to memory of 4568	248	chrome.exe	118
PID 248 wrote to memory of 1736	248	chrome.exe	117
PID 248 wrote to memory of 2516	248	chrome.exe	119
PID 248 wrote to memory of 5132	248	chrome.exe	120
PID 248 wrote to memory of 5132	248	chrome.exe	120
PID 248 wrote to memory of 4228	248	chrome.exe	121
PID 248 wrote to memory of 4228	248	chrome.exe	121
PID 248 wrote to memory of 4256	248	chrome.exe	122
PID 248 wrote to memory of 4256	248	chrome.exe	122
PID 248 wrote to memory of 3932	248	chrome.exe	123
PID 248 wrote to memory of 4144	248	chrome.exe	124
PID 248 wrote to memory of 3956	248	chrome.exe	125
PID 248 wrote to memory of 1284	248	chrome.exe	126
PID 248 wrote to memory of 2976	248	chrome.exe	127
PID 2976 wrote to memory of 200	2976	FiveM.exe	128
PID 200 wrote to memory of 5352	200	CitizenFX.exe.new	130
PID 5352 wrote to memory of 3504	5352	FiveM.exe	131
PID 3504 wrote to memory of 4640	3504	FiveM.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\xenonLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\xenonLauncher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbdcbec728,0x7ffbdcbec734,0x7ffbdcbec740
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1416,i,10806414736671755696,11657253906676134628,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,6450752194705363385,5305097161752431910,262144 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,9044856362293158076,17753451215714477541,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,403999337371871384,16012474274098017326,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,17518226205976102896,14407011792059043785,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,6843661932441310626,3528722610432335657,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,15719256140419299235,3151472821550186503,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5032,i,16132415351514326872,3799596958953759091,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,14533773937202369561,6482578970371491430,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5644,i,5611292274065537260,6012745329954761004,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5656,i,3623187382786275403,17920624388367821933,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,11316545565360890078,13987362818629948382,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5988,i,17860126195105058645,17727750867215320735,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3936,i,1215369016431326771,5969086045055908810,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5716,i,10201654632292832149,1204766255089695983,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6236,i,529266921948163836,8087617658189995749,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,15875108148740683716,2712723137530361097,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5960,i,2971684075163491247,16593374268640647521,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5572,i,16329069162727518802,5628896923934286489,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,692003623131201489,7459423983308968798,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5584,i,5942159451404554475,14521216530902998294,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:9
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5960,i,11004090379241145848,4018361202097232107,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,12274062944769115547,6334593300030501506,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3940,i,7693049546180914541,9559000125541426808,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:12
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6104,i,8176802369578933190,15013100266773698624,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6044,i,4954564301788999561,16042495803576908112,2097152 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,14532291097907816961,7811650919597230776,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,17063565880520726824,9568223269988827598,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,3229556998870378665,7690138115759533901,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3676,i,14743900905667551815,17120393699732813082,524288 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:1284
- C:\Users\Admin\Downloads\FiveM.exe
  "C:\Users\Admin\Downloads\FiveM.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies Control Panel
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\Downloads\CitizenFX.exe.new
    CitizenFX.exe.new -bootstrap "C:\Users\Admin\Downloads\FiveM.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Users\Admin\Downloads\FiveM.exe
      "C:\Users\Admin\Downloads\FiveM.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:5352
    - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
        5⤵
        Executes dropped EXE
        Drops desktop.ini file(s)
        Reads the TCP/IP host and domain name from the registry
        Modifies Control Panel
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3504
      - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2404 -parentpid:3504
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1164,i,2533927672640058442,8446384160010709636,262144 --field-trial-handle=2108,i,7337835642015229582,7432277441970044340,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:10
  2⤵
  PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2648

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2032

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CitizenFX.Core.Client.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\CitizenFX.Core.Client.xml.tmp
Size 6.6MB
SHA256 73035e37ee074f8f1d5dd9a1f5674bb30e0bb2d24ebd676bcfc8433663d89f49
MD5 1b6812e260b9da251bacca4d1fda7fc8
SHA1 b02302803d4e9ed1bf4c9bb0f03db3a108e99dbd
SHA512 a1c5b9b7ccd48433e48ffa117e51606793b15c45753ab51fa55847757f20360229329a75baf6af26a66a23f9faac69f5492c3a4dcdb34399203b963543adbfd5
SSDEEP 49152:MaG9a/E7S78ScSwYSNMdpqy2r8kOpWhrbrxH2TIrCqJg0a9f6Uzqny6OxTi8DDWo:chbETIrCqS0Qzqny6OHDeaYaAfity2z
TLSH
T11266EF147BC59E200EB281266E28B9C8FF25492721456D26348E3F734F7ADC797EF861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.dll

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.dll
Size 384KB
SHA256 872f9a0e93f652ec96b7b2ff4dd85737af09f3c1904c4675c76d79e9917aa1e0
MD5 3b0ea1f1e586dc3c70af6a6ee3b22f42
SHA1 0cc387dea9f848c5e9f94b83e858c903ec6b9523
SHA512 b6f85b6e31831d4f70f9b8150f3a3046e2f9f5dcfafeb44ea2696d2891ca02088de6b164bae375db11241640cb24b087ad1c47da27ba35f07c752f4d0f72d84b
SSDEEP 6144:9eCTWCT4qS1ReuAW/SJqhpECMurgskeC2NsBfz1Si2DW3/tUNf4jqqrRrL:zTtT4qS+jWIvz21PWl04jqqrRrL
TLSH
T162845B4C37DC0653D6DFA77A9036568683B8C067A14EE3DA1CC5D8BD9DF2BA38902253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsgPack.xml.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\MsgPack.xml.tmp
Size 600KB
SHA256 3ad561cbcba9b7da8991a9132bc9a22a036d51570129e729f238393ba33b538d
MD5 b01b2defff08859297cf2cfc8d4eee17
SHA1 4f533a702164bce501590ee330be3a2ad30a3d52
SHA512 91b76194533f6a870b1b1d55bb6544f3a218e67d326f7a2379b7968aad3314850b29e449890a9c00070af26f01357da6528a785133ad4fd7146dd64b6fd3ab82
SSDEEP 1536:ROzOlcArQL7o7eRwu7ZFo7A5wAY8D69JL6KdLXhtgyzgwtr5YOlp1CoEsP+oRz/z:W/d26yLXwyzNtNYOz1bwY
TLSH
T183D4123876C98E130CB3421A5D25F485FE3E0523704AA896B08D5F677FBACD993B7909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.Metadata.dll.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\clr2\lib\mono\4.5\ref\System.Reflection.Metadata.dll.tmp
Size 454KB
SHA256 652ded0ce5e153b85154ac65d00244aafb49e0fe8a958e2afb9c5bea83a957c0
MD5 50119d5845f7e74821108ff3f5058a63
SHA1 74443707eda9ebbb98a68a1d03a29d5305b25f11
SHA512 7510645c489dc890fd8e8dd89b3c08777e2928dce49f84a9fe409b5d8b5269b82e504668f5f7a1caa9cd863d42629c626572db9b40ee5aa9d815e4c2910536e3
SSDEEP 6144:wNXb/BmfTcqQ9d8l1+h2pThycq7/K5PBNplTm+sTosDAhmomkUulC+Cd3r335wq:wNrBmfIqzl1+h2pTQj76oWXCB1
TLSH
T122A47C8263F8672BE6DFC778E0304A154771E916660BFB5F88A8E76A0C537E84C015B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2189\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2944\data\control\settings.meta.tmp
Size 38KB
SHA256 7d01c11f35d87dd39327d7314c1a9563658c5a18fb5ae10abb485cbe856f5913
MD5 9a9812f429759ba7dafd3cae3ca399fb
SHA1 3f41e4f9ed953b0800cf9a1cd4ad29a0758256b8
SHA512 ef65a0d9ff8f3d8d4c786a1e760046b0eb29138669376bd73da7418ff886defd9871b026c869c605d759729f256098990e4181f38ed423d60548952b3151603f
SSDEEP 384:Gs34QSSgC5RHTiVfFSAvRSOxRlne8lY7SI11zHdlz9a8NSuF5MGsXZXgCoRKRyRU:D34QOfFSE6Jvz3gp1E4
TLSH
T15503DB6C3A9D5F5A198C80B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3788\data\control\settings.meta.tmp
Size 46KB
SHA256 a35da765f0332a10150daa530506289fe5683e5afda6b7b70a362d7e66f0fd9d
MD5 b12db507b6e5063a1ce25c4e22ee3efd
SHA1 c90eda2a2dd2a3562136975457e6a1dbc9070fff
SHA512 2aa09ff789000897b4e29b756260159195308f54d762ac516ca7acc85a25ceee7c1ca4aa2917c3a647843b39a13684d33ac9a5ec24749477a880a4f35640f6d4
SSDEEP 384:Ij3F4QSSgC5RHTiVfF3AvRSOxRlne8lY7SkfX7vz11zHdlz9aVzaoSuFUMysXZXs:M3F4QOfF3E6j/vz3YaspbOzE4
TLSH
T16523BA2C395D5F5A198880B71CF704C975AFECBA2FEA19A41B25E07307C3E602376679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 cd19d03697196957a6a3953bc3e9c6350105f3afc0713a1c97073ee3eb37ab04
MD5 da3dbe346d1211689883fbdcb1329cd4
SHA1 381b88207d76673d4e15e560942fdaef6cddfdae
SHA512 7308674a0042c7d7e4c17bf047f8a5e8bb1f56eb604aa2d6b506df70820f900a063a1adf3aaccc41980d5b1d93082a074fdb4aae9d0f725ced623884441da0fc
MD5 SHA1 SHA512

Submit Download

natives_21E43A33.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_21E43A33.lua.tmp
Size 2.0MB
SHA256 75ff1b676fe1c16846f3a463c3920e2f9b8297851d713f37e65a204f647060dc
MD5 dff524002313a6fd2f794696dcd8e078
SHA1 32f5187a8a8796baf36b90bc873f4668f28d18f5
SHA512 afc3d696e473a9950465b4fc8ce0daf1361ffdf1880d95e352864d7c23e54fdfc12ad2879df5ebc2860fc79b284b5c2f45f9fb99718231fe4bd64e953e0f5489
SSDEEP 49152:JNbJqV8HyrbVWFYX5oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FYX5cuh
TLSH
T1DE9509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.d.ts.tmp
Size 2.3MB
SHA256 9e9e81bc60cbe5d2b40a0e79add23f6c0d1eaea7dce2712ae38504c4a84dc9d8
MD5 36f5cddf9cd88dbfa27edf671c7c129d
SHA1 cd43a3155a234be4dad8fd71ffcb5a270ec749a6
SHA512 80f46f1143ff06eac28a66ccaf53bcaf2b380773996019857d836ee3f9ceb41422b4bff03e775156c60ea3add307574fa790e153d8cc1a731fa531b7a60e29d4
SSDEEP 49152:kO4NUH1AeYZJkDx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkD2AkD
TLSH
T1BEB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.js.tmp
Size 2.1MB
SHA256 bd072c00cb50219bad8959d7efee5bdc8caf90bd876fe4e3142b28a9386280af
MD5 9b1dcdbfc5e33692ecbc91477f5f0853
SHA1 1e0c5a805d7fbb81c53109cfe0d333e60256851f
SHA512 07c8a2e6aca864a2d0e1194dde07ba7baa43015874d794a675bbd462f04408f2a1a549a2b4512d59744b09d6d9596bc39893641ad351cc0014f48c41f55f5056
SSDEEP 49152:eIMMNUYXFaHRKkPjJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKkPZAhs
TLSH
T19FA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

im3d.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\im3d.fxc.tmp
Size 9KB
SHA256 be0c4a87833b062965bc2c2af4cedc30dd76d9cad10d996c2a5809de2f7e34c0
MD5 7f32d8c9e8ec983ab316a093be55ebd0
SHA1 077e8b5225a2d7dccf6a7ecabc3aa5d46e684955
SHA512 c44b9b2ac8410c2ca2bbd936697d83376ba7b02248342c6ecd9ec60e42a306ed070184f16e64e0daa9712ef204b1599ffd4152acf2bc5440271ff7d877f7fa78
SSDEEP 96:V7GKCm7GKCoQGKCUtKIV/h4KIb0FKG1ReGKGKyFt21mQxzjfDeGKGKy3Mrbk/vp:V7V7EN/K0XReSt21Z5jfDeYMrbOx
TLSH
T12922EC1A27821EB7EA2D9373C0DB4F01B377D86226E3DF53888155194CE63C4EE256AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez.fxc.tmp
Size 4KB
SHA256 53aab937bc5573154a144ec115b14ab51d7a9bca485af71021ba5bb225756ee4
MD5 4785ebb287fa3aa86649dd35b7b7f561
SHA1 e82f7fb0456c7e0b13a01c91929abb0ab1754007
SHA512 4cf76f9145d75faeebcd7403bfc9e82effbca4c74dead2ed260868b6f2495d64c4a76b6fd284fc23d278835affb732f911be86baf7dc46060455e1746071855c
SSDEEP 96:+KwqdQteKwqdQtLDlI5PJKHdRVzIPJKHdUS83EvWOM:StytLDlu+eXS83EE
TLSH
T174B10E016B85AE3BE76E9732CDD703197335D8411BF387234AD522242C523C46EA639E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_firm.fxc.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_firm.fxc.tmp
Size 4KB
SHA256 05df82e50fb5a00894a7f15c9fddc4235e8ae4aed37083297034e6e28a91a656
MD5 c31cf050db671c2f142f322d24e481ed
SHA1 11a3a81ec89bcca5d8cd6488a00e6daddf926876
SHA512 ac1d7daa4b905ae406a18dcd6ec72ce21a5df6619432ca411a45bb179b6a6f9f58e679e73634051a0e27957647697169afa80196e67c774c3007bf0f185edbcf
SSDEEP 96:+KwqdQteKwqdQtirlKHdzzZKHdvytmWlM:StytWuz8yt2
TLSH
T1BB91CB126F85EE37EB6E4B36CADB03153336D9415BF38B13459121242D533C48EA679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlinez_mask.fxc

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\shaderz\win32_40_lq_final\outlinez_mask.fxc
Size 1KB
SHA256 925cac9047d439bcb5e6852fc58a759a64033ff27441ad02e7f8c2333da8423a
MD5 9b343ffa22056230a315fc5a5760185f
SHA1 23dad37c308d42b9e729c038757cdc2e0427edd8
SHA512 3bc7f19a979c19593476b6135a574c361e023d985196f4a20a1808f8dc810a70311714619096feb26455f5a5559a1788e09941d15362c4f018da462b5e5db3fc
TLSH
T1F641A8122B88FE0BDB2E5B35CBA207053776EA866793CB0398C021340C133C88F6275D
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

8de56b3d-ae40-4929-9519-d4b12cffd365.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8de56b3d-ae40-4929-9519-d4b12cffd365.tmp
Size 4KB
SHA256 5aabbd8367ff4803e8d35c797c7e5d192f4d6ad2467b54a705789ebab977b403
MD5 9daecdff81b3a394dcdf9d3006327753
SHA1 45540087d2c7bb171f22b5e1430ee17a0d2d948b
SHA512 840b14a4611dcd920676beedb63badb3a8e719d52ec742aae24b20f3392013a58a84534da30db34f8cfa820f33ffad6837b1dbba461ffc221ebfda80b39e38ec
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5zhD5B6FGyvoD3EmwW+Tbv4v4a:fC0ESKkdDUDlfBp4mwW+Tbvi
TLSH
T171A1F971A8789C7B59FAD859B4432A43CEB8317BD462AE94E9DD0F0814E70EC1342567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95a40db3-6575-4077-ad4c-3c9f8890d576.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\95a40db3-6575-4077-ad4c-3c9f8890d576.tmp
Size 180KB
SHA256 0a7908964e57025bdfb55ade264bb31881e757061a5daec2decdac4a4d033f79
MD5 f14220553419ceb31a2b6ca960a0eb89
SHA1 db55fcffca1666dea37cb4bc4a383b78b329084e
SHA512 a3212ed590a068804dc349f67f39b37e32ba0d4721407e376a500b01b017a88997d198b503c54a9d5d5157a5b834910143eedde80b8a457997f99c0afdc6eec1
SSDEEP 3072:mt2jI8DiheIAIc0rk6F25VHzs8vSNX6FT5VXiFNE1AoQ/T+T:q27D8FFtrk6c5JO6FXXikqo8T+T
TLSH
T1CB0412354C158FCBDBFAD9B6925DFF120C688A731700A884D8E57A4338DE45F871A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a641e25-bc09-450d-a0ee-ad0ced9bc915.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9a641e25-bc09-450d-a0ee-ad0ced9bc915.tmp
Size 144KB
SHA256 6c7eecead27c8ae9704a5b343b50d0a06bdc1e54a5876331f5dd618517aa9060
MD5 3ce180907ba1b492cc6f1c52897c46c3
SHA1 0439ac167fa8c2ee9b1c9bdf5b4c1a34c2443464
SHA512 3511b76f7b4f76e375448fa43be8dfee98d4990a5e1139d71d057846897374030b745fbbadeae7849602472434eec2c97000c337c01bf717c031fa3898981d2f
SSDEEP 3072:mlIAIc0rk6F25VHzs8vSNX6FT5VXiFNE1AoQ/T+T:pFtrk6c5JO6FXXikqo8T+T
TLSH
T10AE313744825CF9BD7FED776639EFB12457B0A77510058C4E9A62A0635EF4AA4304323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04ef1f86-aec7-449c-9c76-6ea4948ca874.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04ef1f86-aec7-449c-9c76-6ea4948ca874.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2fcc94e3-4e85-4cd3-8965-6c5f068bbfca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fcc94e3-4e85-4cd3-8965-6c5f068bbfca.tmp
Size 12KB
SHA256 d356a00a58fb8e3e23fbe9d12cac019e0c6870878055ae5ebdbfe12f7f81b503
MD5 1fefd43edd96634ce29fb35f7937dfde
SHA1 87acb507191475617d1b4a0c6a619f0ad8577e88
SHA512 8328cfb7bdab989d286fd379933f4229086c82c31486346d23be7dc05d99b2410818905784fe5b45926cb8eaeca4fbb4dca97cd2d05ab5acb5eacb8afcf91c8e
SSDEEP 192:+ROcBzLDu+Xv7aAPRp2xZ9f9xHsb+WNE8Ps4WNeeR1Mkw+37VyIsnAUgE:+ROmzLd/PX2Dw6Hei1MetE
TLSH
T1E242B56AED20797B9CDAC219F951BB13E6F5202270D12EC4E6FC8D2C25E75CC2213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

310e304b-7f1f-474a-ad40-077b6e26c2bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\310e304b-7f1f-474a-ad40-077b6e26c2bd.tmp
Size 12KB
SHA256 c21149514f4795367151b9339157c399e6f54df8721c82cf1c5b3f14e681e6f3
MD5 4f49c9d549dad0cebf387da974f74b34
SHA1 c0b5b273b617f37beecf83bf27cfe00cbfaca640
SHA512 f6bc2af46959a660ddc10e4b5cfd7378dc7f708a1bb2fb06b24a817456607f824ed3d096b7229d45215eb3ae80973ed9371a55136bc6acb3bafde25316a5eacd
SSDEEP 192:+RlcBznDu+Tv7aAPRp2xZ9f9xHsb+WNE8Ps4WNemR1Mkw+3LVyIsnAUge:+RlmzndrPX2Dw6HeK1Me9e
TLSH
T1C142B56AEE64797B8CDAC229F951BB17DAF5202270D12EC4E6FC8D2C24E75CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 350KB
SHA256 7cf60efe182c0c85b02ff13cbad26b1836c1798bd9a5f3a0b85bf89ff047c5aa
MD5 334b0fa1adf3ccf225d87afcef3894d5
SHA1 5e9af360ce30f803a1df1bc027ef68d5cd8dfa37
SHA512 680bfc7646e1a57eddd441c64fee3d50cb8aa47bf1eb68660bccc3ce7b92bc51824a3c0c6f9f0c6a36cb9fde842167a980f103e5b59bc484d645999af9f1ac18
SSDEEP 6144:wZpDEwRnuLHBNUjtt7heEW7eSh21T5TKK2lSu1raoZYlbo:wZdEwRuHsh17SmNTKKLo5
TLSH
T1D574237905C189E0804F12F6F6646E5F629E318E5F23FC0EFB66E587A16F1922F21748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 a65c304e8607f8c84d9a7b290b948ef5304b408133d6c09f505fd6d91d04e3be
MD5 972ad0b932fd2ca25cc82281de54c0c3
SHA1 2341538946d100964cdc85e9b45d6f0a431e6bd4
SHA512 15505dfee73d5ce2e1f5818f39b2ab2ae1ebece9cc1d6fbb004baa42b690aab04e32739244215b395a7587391f59a075dded7315a4162f206f43bc84e42a0e26
TLSH
T1DA11C993F88B002FCF80FCB679E54A09F2580258CD02135A4222A77370C2AE8DE902E0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

386ce46f-4b15-4dbe-91fd-31782384cfe9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\386ce46f-4b15-4dbe-91fd-31782384cfe9.tmp
Size 9KB
SHA256 b2b47baebfa84f8575e1a1363501fe3e5723d2f84d06a40854a4474477eb94bc
MD5 bc08bf56c0ec9bb276d8601bcd1e1c98
SHA1 c8bc3c9e88d9081141f5dc045f449decd603d741
SHA512 0947f54afc5e05435a78bf66a6871c65d306d6c39646a855f598e6dffc1f36709474ad61495b1daa976dfc2333838af04406d6eec62ea09401a63650c8e43a94
SSDEEP 192:Dcbf11qMH6I5/GUgKK/w/aII9iIYNP40aPE3fPuhvnAGGAc/A7A7EiAoAtA7aAo5:Dcbf11qMH6I5/GUgKK/w/aII9iIYNg0M
TLSH
T18712BEF7C3D8C53DC91156F4AB166F1ECE291928432C3D67C8D8AE5B93E2871D25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab2edd3e-940e-4a5a-a152-825de42e9753.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ab2edd3e-940e-4a5a-a152-825de42e9753.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d0a164bfdc22e928281c8092e15b8f2c9bf80cdf4b0b0b66d24af14e144e347f
MD5 ce7bc65bf13eb71a0ece99b09be10bc5
SHA1 254dc1fdd6509a589479d3819f3aa5050af050e0
SHA512 f0228e6241194d50b51325fd4041e8777122e6361788ef23f72c1f032384c2390284952885239303c885f5a40e66f4ebc29c7f812ae39ff2aaad9c402e0fc6dc
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9w7v+ANEPR:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFk
TLSH
T16232D917A88D5E7F4FD8D50DCC067F8B6DB5029276680D2893FBAD0803A57CA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 5e42640940f8c969d78437aef338868a826c7c56816c47671af49c6f4300ee4e
MD5 bc9340082b160b1b1cd2d2e4c82cf4a4
SHA1 7ff9c49ee83947ebfaf1f010b1972507eba30ad3
SHA512 a96d32a094f76eb8fec21277cec33015d997b352b6232f89c3e61ac9c68e0d1cc0dc36060363d0ddb5b65579fc5c966698d429b0639dfe6b869714ca7e884fab
TLSH
T1E8A002D442451302C45402B1938542C473546A500F474B1172A00274C9A4D878105751
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0028199e4c07e1e87af86243c896e93d277244b56f90645d87140fe804fc0f2d
MD5 29408824b3db6366bab37c4bf4b28f95
SHA1 33e456f2f240f21b2554b34086f4a1661a1f3a2d
SHA512 89682b24b4a3b0422e843980df5158967b9f31b1969cde6e8f4773805d669c7f93fcc197a1464e5ea9fa9de59c605a5a473e1a940b04a442d1e73b01dca5249e
TLSH
T12FA0022043C40813DD44927171B60555229549151D61435399D256E4A89BAC84111981
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4cc1e5b16954b8150e105e6339cfcb5be3f05f03df248a991d01e4af4ff7db69
MD5 dee72473e95f591cef19b9a8d85f0db9
SHA1 fae4ec50739dd6494ddbbf71bf09ac8096188182
SHA512 9f669770f0c3fdc86bd0a05b9c17c272b5ffc79f5eb86d49cec70f41d2e61574825cbcbfbc22745c522c6b5f8c8df4ae26988e9268dfacaba0d51b5371436a88
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac7850c2-1b76-45a5-96ba-38b8135ea0d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac7850c2-1b76-45a5-96ba-38b8135ea0d2.tmp
Size 13KB
SHA256 392dfeb096c5f4ffea85064f93f40d106c4f18a89878468b41805f2afe90731e
MD5 80fb8b20fa1ce3b18888d72fcdb2f34b
SHA1 4bdfaaf452dd4988f28c2f17965ae1c5671edc1d
SHA512 539cf76d5faff5d99ee22a1a53ff07e2792b9badb31ce0969bb95ba86a5946ec3f33fd7d7780a5f4b9a2a524a4c3ed7ddbff07ea056e7fc159529ea397c7a4b1
SSDEEP 192:+ROcBzLmu+Xv7aVPRp7xZ9f9xHsb+WNE8Ps4WNe7R1Mkw+3HVyIsnAUgE:+ROmzLq/IXxDw6He91MexE
TLSH
T15652B56AED20797B9CDAC229F951BB13E7F5202270D12E84E6FC8D2C25E79CD2213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bff13c51-a854-4e22-99c5-cb928ccaf9c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bff13c51-a854-4e22-99c5-cb928ccaf9c6.tmp
Size 12KB
SHA256 ea3c3eeb8acb9b7956b92db2aa1094519eb807a30784e27b2bbb3c21399b21e7
MD5 148d51a7a005b0de23e5d773f45d691b
SHA1 447e51af99d0a5b4c1c9992b2ed1b891348f332b
SHA512 c4f7f6527588183cc8d20d730e8c9e58f91c70f156901ecc4539b0b2670a9dc1cf782d2ec7971f89ad27926fa97003b94f3ade20229cae978343e9e8c6457b39
SSDEEP 192:+RlcBzLDu+Xv7aAPRp2xZ9f9xHsb+WNE8Ps4WNeeR1Mkw+37VyIsnAUgE:+RlmzLd/PX2Dw6Hei1MetE
TLSH
T19442B56AED20797B9CDAC219F951BB13E6F5202270D12EC4E6FC8D2C25E75CC2213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf9b3279-198a-417f-974b-039826378314.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cf9b3279-198a-417f-974b-039826378314.tmp
Size 11KB
SHA256 34f107cca2fbf2516a8b6a88f1ae2b944264928d0a040a3f7e9fc7c1f139abb9
MD5 f366de761b224905ac5bcb4c71410571
SHA1 8ef4943b32d002934e9b02cda78f7404c93238b8
SHA512 dcb43b67a1bd682f325325dfd92c45bc9d69dc2d3a7f1fbcb9724462d7b2fb37f800f171e6648ab1b8658eb83e913b377ae67eea1501ab3e5bb4d8e3f1c49e12
SSDEEP 192:+R5nDu+Iv7xAPRp2xFZ9xHsb+WNnPs4r42tR1Mkw+3LVyIsnAUgR:+R5ndUYXUDwE72b1Me9R
TLSH
T1FF42A56AEE64797B9CDAC229F9217B13E6F5202230D12E84E6FC8D2C25E75CC2123517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0cbeb45-21cd-473a-8818-256d81f6c804.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e0cbeb45-21cd-473a-8818-256d81f6c804.tmp
Size 144KB
SHA256 b9670f27aec196ca28d21ad56d63225ac6fdd7d84f03ce6b0a2d9f193dd104ca
MD5 178548fa13d48ee85adbeb1b1b135ac6
SHA1 a39209cfe1dd452547c3a249bf246d4b0f874994
SHA512 140679db626a5b1c58ccabf0ea52d549eef0627323eff1f0f6b708b5a2828bcc54b1e3802739d4577884734930db7ac8040cfe6b20952fa002511475a6f6e169
SSDEEP 3072:/lIAIc0rk6F25VHzs8vSNX6FT5VXiFNE1AoQ/T+T:qFtrk6c5JO6FXXikqo8T+T
TLSH
T191E313744829CF9BD7FED776A39EFB12457B0A77510098C4E9A62A0635EF4AA4304323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94639e2f-7a9e-4f0d-8311-27216ffceca3.tmp

Path C:\Users\Admin\AppData\Local\Temp\94639e2f-7a9e-4f0d-8311-27216ffceca3.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir248_639926688\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 46c515650f6422115f0b3768e0b1c54633ed2a0e932306901f82ca83b1210cbf
MD5 1451769cd336e047e4e92300ea8e667f
SHA1 b50ce7c7d9818da2827b2cce578e988b4d1e1030
SHA512 1a57a982b6aef52eeeb2691a6a98acb51a76b9e5c3623417d8c4552060ccded432ee39699b69458d7e616d5f32c4e55160860204b0bb21897de25831005cb4c7
TLSH
T17F41350389E95F20D3FAD5B5A5B7A31906377CE2F3668F4E4880D2482951E029C96F4F
MD5 SHA1 SHA512 TLSH

Submit Download

CitizenFX.exe.new.tmp

Path C:\Users\Admin\Downloads\CitizenFX.exe.new.tmp
Size 5.0MB
SHA256 e101119998c235a3f058183086991839980936db5d23319b042499123e17ddc9
MD5 f9afe3072531e2528c2dcfa88be65663
SHA1 5756f732f44505697991eae0ab6837115ef04845
SHA512 2c8e17fae0395e86a1e6387f5f1b35056bccd01119c6d8b1223c56f1330fdf732cf9d1059d7563dcba3da8e1d770c3e22715116486bfe82994680785c4df66e2
SSDEEP 49152:qOjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLh:mTqf4YaQzVpEBTQtB71THSv82k3
TLSH
T10F369D56A3E400E8D5B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 44877.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 44877.crdownload
Size 5.0MB
SHA256 05a99a0067ddde35a8b6c92721fc8ee058ffe1cee9a9dceb2bafb1a8e2d92368
MD5 e8c3fd1b35507fa301fac9367f28757f
SHA1 fd03919c9370248a62c9d540f6cd9fbeccac09f6
SHA512 7f4f60aa0978a5f3f49cac744c11b6fe410cf32ec8dcd83fd6ad2120e9830b242b6f6a758c03ca76e8ffa800dbfec1b92f759c176f829f94492ed81e65befcdd
SSDEEP 49152:XOjPWFWnM4r0BEjYoVKs0B6N58NaUjwg1mxE9tOjhhVmaeI84dhAzBM04arJYLaw:iMKk0N5f/rQcc9YL4P1G/Lzg5ji13
TLSH
T113369D5663A401E8C5B7D1B8CD968527EBB27C161331DBDB02A0767A1F37AE16E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download