redline | 87738c9f89b27de5d18545ef1a64f588674aab995c2fbcaf859e5795d225144e

Resubmissions

01-04-2023 20:59

230401-zst5vacg24 10

01-04-2023 20:57

230401-zrv1racf95 3

Analysis

max time kernel
213s
max time network
302s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
01-04-2023 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Script GUI [🔒 1515].rar
Size

3.3MB
MD5

dc44d9ac63fb3f7bc9ed4543a7bef843
SHA1

e5126b4fdd8b4b687270d59408f4e191843b0bd0
SHA256

87738c9f89b27de5d18545ef1a64f588674aab995c2fbcaf859e5795d225144e
SHA512

2bdd17eb62a87b88c37738fac75e652a6509b0610fc85b7dbae4c3c894c40e192c53b04c4f69705013c6a099e78d189c01bd01dcce3846f4f18e4f9c5f22961e
SSDEEP

49152:mQEEki7Or1xhuZ9LCbisGXhEaMtbBb6xP/80Yd8xWjSzfM31lgqiv0woKlDmx:rhOxxAIrEEaMFZ6xc0UIiSDAgqiFoK1k

Score

10^/10

redline @dxrkl0rd discovery infostealer persistence ransomware spyware

Malware Config

Extracted

Path

C:\Program Files\WinRAR\Rar.txt

Ransom Note

User's Manual ~~~~~~~~~~~~~ RAR 6.21 console version ~~~~~~~~~~~~~~~~~~~~~~~~ =-=-=-=-=-=-=-=-=-=-=-=-=-=- Welcome to the RAR Archiver! -=-=-=-=-=-=-=-=-=-=-=-=-=-= Introduction ~~~~~~~~~~~~ RAR is a console application allowing to manage archive files in command line mode. RAR provides compression, encryption, data recovery and many other functions described in this manual. RAR supports only RAR format archives, which have .rar file name extension by default. ZIP and other formats are not supported. Even if you specify .zip extension when creating an archive, it will still be in RAR format. Windows users may install WinRAR, which supports more archive types including RAR and ZIP formats. WinRAR provides both graphical user interface and command line mode. While console RAR and GUI WinRAR have the similar command line syntax, some differences exist. So it is recommended to use this rar.txt manual for console RAR (rar.exe in case of Windows version) and winrar.chm WinRAR help file for GUI WinRAR (winrar.exe). Configuration file ~~~~~~~~~~~~~~~~~~ RAR and UnRAR for Unix read configuration information from .rarrc file in a user's home directory (stored in HOME environment variable) or in /etc directory. RAR and UnRAR for Windows read configuration information from rar.ini file, placed in the same directory as the rar.exe file. This file can contain the following string: switches=<any RAR switches separated by spaces> For example: switches=-m5 -s It is also possible to specify separate switch sets for individual RAR commands using the following syntax: switches_<command>=<any RAR switches separated by spaces> For example: switches_a=-m5 -s switches_x=-o+ Environment variable ~~~~~~~~~~~~~~~~~~~~ Default parameters may be added to the RAR command line by establishing an environment variable "RAR". For instance, in Unix following lines may be added to your profile: RAR='-s -md1024' export RAR RAR will use this string as default parameters in the command line and will create "solid" archives with 1024 MB sliding dictionary size. RAR handles options with priority as following: command line switches highest priority switches in the RAR variable lower priority switches saved in configuration file lowest priority Log file ~~~~~~~~ If switch -ilog is specified in the command line or configuration file, RAR will write informational messages about errors encountered while processing archives into a log file. Read the switch -ilog description for more details. The file order list for solid archiving - rarfiles.lst ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rarfiles.lst contains a user-defined file list, which tells RAR the order in which to add files to a solid archive. It may contain file names, wildcards and special entry - $default. The default entry defines the place in order list for files not matched with other entries in this file. The comment character is ';'. In Windows this file should be placed in the same directory as RAR or in %APPDATA%\WinRAR directory, in Unix - to the user's home directory or in /etc. Tips to provide improved compression and speed of operation: - similar files should be grouped together in the archive; - frequently accessed files should be placed at the beginning. Normally masks placed nearer to the top of list have a higher priority, but there is an exception from this rule. If rarfiles.lst contains such two masks that all files matched by one mask are also matched by another, that mask which matches a smaller subset of file names will have higher priority regardless of its position in the list. For example, if you have *.cpp and f*.cpp masks, f*.cpp has a higher priority, so the position of 'filename.cpp' will be chosen according to 'f*.cpp', not '*.cpp'. RAR command line syntax ~~~~~~~~~~~~~~~~~~~~~~~ Syntax RAR <command> [ -<switches> ] <archive> [ <@listfiles...> ] [ <files...> ] [ <path_to_extract\> ] Description Command is a single character or string specifying an action to be performed by RAR. Switches are designed to modify the way RAR performs such action. Other parameters are archive name and files to be archived or extracted. Listfiles are plain text files containing names of files to process. File names must start at the first column. It is possible to put comments to the listfile after // characters. For example, you can create backup.lst containing the following strings: c:\work\doc\*.txt //backup text documents c:\work\image\*.bmp //backup pictures c:\work\misc and then run: rar a backup @backup.lst If you wish to read file names from stdin (standard input), specify the empty listfile name (just @). By default, console RAR uses the single byte encoding in list files, but it can be redefined with -sc<charset>l switch. You can specify both usual file names and list files in the same command line. If neither files nor listfiles are specified, then *.* is implied and RAR will process all files. path_to_extract includes the destination directory name followed by a path separator character. For example, it can be c:\dest\ in Windows or data/ in Unix. It specifies the directory to place extracted files in 'x' and 'e' commands. This directory is created by RAR if it does not exist yet. Alternatively it can be set with -op<path> switch. Many RAR commands, such as extraction, test or list, allow to use wildcards in archive name. If no extension is specified in archive mask, RAR assumes .rar, so * means all archives with .rar extension. If you need to process all archives without extension, use *. mask. *.* mask selects all files. Wildcards in archive name are not allowed when archiving and deleting. In Unix you need to enclose RAR command line parameters containing wildcards in single or double quotes to prevent their expansion by Unix shell. For example, this command will extract *.asm files from all *.rar archives in current directory: rar e '*.rar' '*.asm' Command could be any of the following: a Add files to archive. Examples: 1) add all *.hlp files from the current directory to the archive help.rar: rar a help *.hlp 2) archive all files from the current directory and subdirectories to 362000 bytes size solid, self-extracting volumes and add the recovery record to each volume: rar a -r -v362 -s -sfx -rr save Because no file names are specified, all files (*) are assumed. 3) as a special exception, if directory name is specified as an argument and if directory name does not include file masks and trailing path separator, the entire contents of the directory and all subdirectories will be added to the archive even if switch -r is not specified. The following command will add all files from the directory Bitmaps and its subdirectories to the RAR archive Pictures.rar: rar a Pictures.rar Bitmaps 4) if directory name includes the trailing path separator, normal rules apply and you need to specify switch -r to process its subdirectories. The following command will add all files from directory Bitmaps, but not from its subdirectories, because switch -r is not specified: rar a Pictures.rar Bitmaps\* c Add archive comment. Comments are displayed while the archive is being processed. Comment length is limited to 256 KB. Examples: rar c distrib.rar Also comments may be added from a file using -z[file] switch. The following command adds a comment from info.txt file: rar c -zinfo.txt dummy ch Change archive parameters. This command can be used with most of archive modification switches to modify archive parameters. It is especially convenient for switches like -cl, -cu, -tl, which do not have a dedicated command. It is not able to recompress, encrypt or decrypt archive data and it cannot merge or create volumes. If no switches are specified, 'ch' command just copies the archive data without modification. If used with -amr switch to restore the saved archive name and time, other archive modification switches are ignored. Example: Set archive time to latest file: rar ch -tl files.rar cw Write archive comment to specified file. Format of output file depends on -sc switch. If output file name is not specified, comment data will be sent to stdout. Examples: 1) rar cw arc comment.txt 2) rar cw -scuc arc unicode.txt 3) rar cw arc d Delete files from archive. If this command removes all files from archive, the empty archive is removed. e Extract files without archived paths. Extract files excluding their path component, so all files are created in the same destination directory. Use 'x' command if you wish to extract full pathnames. Example: rar e -or html.rar *.css css\ extract all *.css files from html.rar archive to 'css' directory excluding archived paths. Rename extracted files automatically in case several files have the same name. f Freshen files in archive. Updates archived files older than files to add. This command will not add new files to the archive. i[i|c|h|t]=<string> Find string in archives. Supports following optional parameters: i - case insensitive search (default); c - case sensitive search; h - hexadecimal search; t - use ANSI, UTF-8, UTF-16 and OEM (Windows only) character tables; If no parameters are specified, it is possible to use the simplified command syntax i<string> instead of i=<string> It is allowed to specify 't' modifier with other parameters, for example, ict=string performs case sensitive search using all mentioned above character tables. Examples: 1) rar "ic=first level" -r c:\*.rar *.txt Perform case sensitive search of "first level" string in *.txt files in *.rar archives on the disk c: 2) rar ih=f0e0aeaeab2d83e3a9 -r e:\texts\*.rar Search for hex string f0 e0 ae ae ab 2d 83 e3 a9 in rar archives in e:\texts directory. k Lock archive. RAR cannot modify locked archives, so locking important archives prevents their accidental modification by RAR. Such protection might be especially useful in case of RAR commands processing archives in groups. This command is not intended or able to prevent modification by other tools or willful third party. It implements a safety measure only for accidental data change by RAR. Example: rar k final.rar l[t[a],b] List archive contents [technical [all], bare]. 'l' command lists archived file attributes, size, date, time and name, one file per line. If file is encrypted, line starts from '*' character. 'lt' displays the detailed file information in multiline mode. This information includes file checksum value, host OS, compression options and other parameters. 'lta' provide the detailed information not only for files, but also for service headers like NTFS streams or file security data. 'lb' lists bare file names with path, one per line, without any additional information. You can use -v switch to list contents of all volumes in volume set: rar l -v vol.part1.rar Commands 'lt', 'lta' and 'lb' are equal to 'vt', 'vta' and 'vb' correspondingly. m[f] Move to archive [files only]. Moving files and directories results in the files and directories being erased upon successful completion of the packing operation. Directories will not be removed if 'f' modifier is used and/or '-ed' switch is applied. p Print file to stdout. Send unpacked file data to stdout. Informational messages are suppressed with this command, so they are not mixed with file data. r Repair archive. Archive repairing is performed in two stages. First, the damaged archive is searched for a recovery record (see 'rr' command). If archive contains the previously added recovery record and if damaged data area is continuous and smaller than error correction code size in recovery record, chance of successful archive reconstruction is high. When this stage has been completed, a new archive is created, named as fixed.arcname.rar, where 'arcname' is the original (damaged) archive name. If broken archive does not contain a recovery record or if archive is not completely recovered due to major damage, second stage is performed. During this stage only the archive structure is reconstructed and it is impossible to recover files which fail checksum validation, it is still possible, however, to recover undamaged files, which were inaccessible due to the broken archive structure. Mostly this is useful for non-solid archives. This stage is never efficient for archives with encrypted file headers, which can be repaired only if recovery record is present. When the second stage is completed, the reconstructed archive is saved as rebuilt.arcname.rar, where 'arcname' is the original archive name. By default, repaired archives are created in the current directory, but you can append an optional destpath\ parameter to specify another destination directory. Example: rar r buggy.rar c:\fixed\ repair buggy.rar and place the result to 'c:\fixed' directory. rc Reconstruct missing and damaged volumes using recovery volumes (.rev files). You need to specify any existing .rar or .rev volume as the archive name. Example: rar rc backup.part03.rar Read 'rv' command description for information about recovery volumes. rn Rename archived files. The command syntax is: rar rn <arcname> <srcname1> <destname1> ... <srcnameN> <destnameN> For example, the following command: rar rn data.rar readme.txt readme.bak info.txt info.bak will rename readme.txt to readme.bak and info.txt to info.bak in the

Emails

[email protected]

Extracted

Path

C:\Program Files\WinRAR\WhatsNew.txt

Ransom Note

WinRAR - What's new in the latest version Version 6.21 1. Both file and folder modification timestamps are restored when unpacking TAR and TAR based archives like tar.gz and tar.bz2. Previously only file modification timestamps were set for these archive formats. 2. Added decompression of .tar.zst archives with dictionary exceeding 128 MB. WinRAR 6.20 allowed such dictionary for .zst, but not for .tar.zst. 3. Switches -ed and -e+d are also supported by ZIP archives. Previously they worked only for RAR archives. 4. Bugs fixed: a) if unencrypted file was stored after encrypted in the same RAR archive and both files had been unpacked in the same extraction command, WinRAR 6.20 failed to unpack the unencrypted file; b) in some cases a wrong detailed reason of file open error could be displayed in the second line of open error message. Version 6.20 1. If "Autodetect passwords" option in "Organizer passwords" dialog is enabled and password matching a processing archive is present among saved passwords, it is applied automatically. This option is applicable only for archives in RAR 5.0 and ZIP formats, which allow to verify the password validity quickly. There is a minor chance of incorrect password detection for ZIP archives if stored passwords do not include a proper one. If encrypted ZIP archive extraction fails, you can try to disable this option, repeat extraction and enter a valid password manually. 2. If extraction command involves only a part of files in RAR archive, the additional archive analysis is performed when starting extraction. It helps to properly unpack file references even if reference source is not selected. It works for most of RAR archives except for volumes on multiple removable media and archives containing a very large number of references. Also in some cases such analysis may help to optimize the amount of processing data when extracting individual files from semi-solid archives created with -s<N> and -se switches. 3. "Save original archive name and time" option on "Options" page of archiving dialog allows to save the original archive name and creation time. If archive includes such saved name and time, they are displayed on "Info" page of "Show information" command and can be restored on "Options" page of same command. Restoring involves renaming an archive to original name and setting the saved time as the archive creation and modification time. Switch -ams or just -am together with archive modification commands can be used to save the archive name and time in the command line mode. These saved parameters are displayed in header of "l" and "v" commands output and can be restored with -amr switch combined with "ch" command, such as "rar ch -amr arc.rar". If -amr is specified, "ch" ignores other archive modification switches. 4. Faster RAR5 compression of poorly compressible data on modern CPUs with 8 or more execution threads. This applies to all methods except "Fastest", which performance remains the same. 5. "Repair" command efficiency is improved for shuffled data blocks in recovery record protected RAR5 archives. 6. If file size has grown after archiving when creating non-solid RAR volumes, such file is stored without compression regardless of volume number, provided that file isn't split between volumes. Previously it worked only for files in the first volume. 7. Added decompression of .zipx archives containing file references, provided that both reference source and target are selected and reference source precedes the target inside of archive. Typically, if .zipx archive includes file references, it is necessary to unpack the entire archive to extract references successfully. 8. Added decompression of .zst long range mode archives with dictionary exceeding 128 MB. Previously it was possible to decompress them only if dictionary was 128 MB or less. 9. If "Turn PC off", "Hibernate", "Sleep" or "Restart PC" archiving options are enabled in WinRAR, a prompt to confirm or cancel such power management action is displayed directly before starting it. If no selection was made by user for 30 seconds, the proposed action is confirmed and started automatically. This prompt is also displayed for -ioff switch in WinRAR command line, but not in console RAR command line. 10. Context menu in WinRAR file list provides "Open in internal viewer" command for archive files. It can be helpful if you wish to view the archive raw data in internal viewer. For example, to read an email archive with UUE attachments included. Usual "View" command always displays the archive contents. If file is recognized as UUE archive, "View" would show UUE attachments. 11. Recovery record size is displayed on "Archive" page of file properties invoked from Explorer context menu for archives in RAR5 format. Previously there was only "Present" instead of exact size for RAR5 archives. 12. When archiving from stdin with -si switch, RAR displays the current amount of read bytes as the progress indicator. 13. If wrong password is specified when adding files to encrypted solid RAR5 archive, a password will be requested again. Previous versions cancelled archiving in this case. 14. If both options "Test archived files" and "Clear attribute "Archive" after compressing" or their command line -t -ac equivalents are enabled when archiving, "Archive" attribute will be cleared only if test was completed successfully. Previously it was cleared even when test reported errors. 15. NoDrives value containing the bit mask to hide drives can be now read from "HKEY_CURRENT_USER\Software\WinRAR\Policy" Registry key, which allows to include it to winrar.ini if necessary. Its "Software\Microsoft\Windows\CurrentVersion\Policies" locations in HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE are also supported. Previously only "Software\Microsoft\Windows\CurrentVersion\Policies" in HKEY_CURRENT_USER was recognized. 16. Bugs fixed: a) archive modification commands could fail for some ZIP archives with file comments; b) fixed a memory leak when reading contents of .tar.bz2 archives; c) if source and resulting archive format is the same, the archive conversion command didn't set the original archive time to a newly created archive even if "Original archive time" option was selected in archiving parameters; d) if "Merge volumes contents" option in "Settings/File list" was turned on, the folder packed size in WinRAR file list could be less than expected when browsing a multivolume archive contents. It didn't include the packed size of file parts continuing from previous volume into calculation; e) even if "Set file security" extraction option was turned off by default, extraction commands in Explorer context menu still attempted to restore NTFS file security data; f) WinRAR could read data beyond the end of buffer and crash when unpacking files from specially crafted ZIP archive. We are thankful to Bakker working with Trend Micro Zero Day Initiative for letting us know about this bug. Version 6.11 1. Added support for Gz archives with large archive comments. Previously the extraction command failed to unpack gz archives if comment size exceeded 16 KB. 2. Archive comments in gz archives are displayed in the comment window and recognized by "Show information" command. Large comments are shown partially. Previous versions didn't display Gzip comments. 3. Reserved device names followed by file extension, such as aux.txt, are extracted as is in Windows 11 even without "Allow potentially incompatible names" option or -oni command line switch. Unlike previous Windows versions, Windows 11 treats such names as usual files. Device names without extension, such as aux, still require these options to be unpacked as is regardless of Windows version. 4. Switch -mes can be also used to suppress the password prompt and abort when adding files to encrypted solid archive. 5. Additional measures to prevent extracting insecure links are implemented. 6. Bugs fixed: a) if password exceeding 127 characters was entered when unpacking an encrypted archive with console RAR, text after 127th character could be erroneously recognized as user's input by different prompts issued later; b) wrong archived file time could be displayed in overwrite prompt when extracting a file from ZIP archive. It happened if such archive included extended file times and was created in another time zone. It didn't affect the actual file time, which was set properly upon extraction. Version 6.10 1. WinRAR can unpack contents of .zst and .zipx archives utilizing Zstandard algorithm. 2. Added support of Windows 11 Explorer context menus. Beginning from Windows 11, an application can add only a single top level command or submenu to Explorer context menu. If "Cascaded context menus" in "Integration settings" dialog is on, this single item is a submenu storing all necessary WinRAR commands. If this option is off, only one extraction command for archives and one archiving command for usual files are available. You can select these commands with "Context menu items..." button in "Integration settings" dialog. 3. "Legacy context menus" option in "Settings/Integration" dialog can be used in Windows 11 if WinRAR commands are missing in "Show more options" Windows legacy context menu or in context menus of third party file managers. If WinRAR commands are already present here, keep "Legacy context menus" option turned off to prevent duplicating them. This option is not available in Windows 10 and older. 4. Windows XP is not supported anymore. Minimum required operating system version is Windows Vista. 5. "Close" item is added to "When done" list on "Advanced" page of archiving dialog. It closes WinRAR window, when archiving is done. 6. "When done" list is added to "Options" page of extraction dialog. It allows to select an action like turning a computer off or closing WinRAR after completing extraction. 7. Switch -si can be used when extracting or testing to read archive data from stdin, such as: type docs.rar | rar x -si -o+ -pmypwd dummy docs\ Even though the archive name is ignored with this switch, an arbitrary dummy archive name has to specified in the command line. Operations requiring backward seeks are unavailable in this mode. It includes displaying archive comments, testing the recovery record, utilizing the quick open information, processing multivolume archives. Prompts requiring user interaction are not allowed. Use -o[+|-|r], -p<pwd> or -mes switches to suppress such prompts. 8. New -ep4<path> switch excludes the path prefix when archiving or extracting if this path is found in the beginning of archived name. Path is compared with names already prepared to store in archive, without drive letters and leading path separators. For example: rar a -ep4texts\books archive c:\texts\books\technical removes "text\books" from archived names, so they start from 'technical'. 9. New -mes switch skips encrypted files when extracting or testing. It replaces the former -p- switch. 10. New -op<path> switch sets the destination folder for 'x' and 'e' extraction commands. Unlike <path_to_extract\> command line parameter, this switch also accepts paths without trailing path separator character. 11. If 'p' command is used to print a file to stdout, informational messages are suppressed automatically to prevent them mixing with file data. 12. "Generate archive name by mask" option and switch -ag treat only first two 'M' characters after 'H' as minutes. Previously any amount of such characters was considered as minutes. It makes possible to place the time field before the date, like -agHHMM-DDMMYY. Previous versions considered all 'M' in this string as minutes. 13. Maximum allowed size of RAR5 recovery record is increased to 1000% of protected data size. Maximum number of RAR5 recovery volumes can be 10 times larger than protected RAR volumes. Previous WinRAR versions are not able to use the recovery record to repair broken archives if recovery record size exceeds 99%. Similarly, previous versions cannot use recovery volumes if their number is equal or larger than number of RAR volumes. 14. Warning is issued if entered password exceeds the allowed limit of 127 characters and is truncated. Previously such passwords had been truncated silently. 15. If archive includes reserved device names, the underscore character is inserted in the beginning of such names when extracting. For example, aux.txt is converted to _aux.txt. It is done to prevent compatibility problems with software unable to process such names. You can use "Allow potentially incompatible names" option in "Advanced" part of extraction dialog or command line -oni switch to avoid this conversion. 16. WinRAR attempts to reset the file cache before testing an archive. It helps to verify actual data written to disk instead of reading a cached copy. 17. Multiple -v<size> switches specifying different sizes for different volumes are now allowed also for ZIP archives: WinRAR a -v100k -v200k -v300k arcname.zip Previously multiple -v<size> switches were supported only for RAR archives. 18. Switches -sl<size> and -sm<size> can be used in WinRAR.exe command line mode when extracting archives in any supported formats, provided that such archive includes unpacked file sizes. Previously these switches could filter files by size only in RAR and ZIP archives. 19. Newer folder selection dialog is invoked when pressing "Browse" button in WinRAR "Settings/Paths" page, "Repair" and "Convert" commands, also as in few other similar places. Previously a simpler XP style folder selection dialog was opened. 20. When restoring from tray after completing an operation, WinRAR window is positioned under other opened windows, to not interfere with current user activities. 21. "650 MB CD" is removed and "2 GB volumes" is added to the list of predefined volume sizes in "Define volume sizes" dialog invoked from WinRAR "Settings/Compression". 22. "Rename" command selects the file name part up to the final dot. Previously it selected the entire name. 23. If SFX archive size exceeds 4 GB, an error message is issued during compression, immediately after exceeding this threshold. Previously this error was reported only after completing compression. Executables of such size cannot be started by Windows. 24. Command line -en switch is not supported anymore. It created RAR4 archives without the end of archive record. End of archive record permits to gr

URLs

https

http

http://weirdsgn.com

http://icondesignlab.com

https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar

https://technet.microsoft.com/en-us/library/security/ms14-064.aspx

http://rarlab.com/vuln_sfx_html2.htm

https://blake2.net

Extracted

Family

redline

Botnet

@dxrkl0rd

5.206.224.176:46989

Attributes

auth_value
9750c50e8073b21d538cfb6d993427dc

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
5028	winrar-x64-621.exe
4784	uninstall.exe
408	WinRAR.exe
3784	GUIScript.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 3012	3784	GUIScript.exe	118

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240597703	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248638025515100"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r22	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r08	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r20	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r27	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r00	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
1480	chrome.exe
1480	chrome.exe
3012	vbc.exe
3012	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
408	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe
408	WinRAR.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4336	OpenWith.exe
5028	winrar-x64-621.exe
5028	winrar-x64-621.exe
408	WinRAR.exe
408	WinRAR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4100	2960	chrome.exe	70
PID 2960 wrote to memory of 4100	2960	chrome.exe	70
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2656	2960	chrome.exe	73
PID 2960 wrote to memory of 2852	2960	chrome.exe	72
PID 2960 wrote to memory of 2852	2960	chrome.exe	72
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74
PID 2960 wrote to memory of 2400	2960	chrome.exe	74

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Script GUI [🔒 1515].rar"
1⤵
PID:2568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffef6ea9758,0x7ffef6ea9768,0x7ffef6ea9778
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4368 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5004 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3184 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5504 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5356 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5404 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5400 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2976
- C:\Users\Admin\Downloads\winrar-x64-621.exe
  "C:\Users\Admin\Downloads\winrar-x64-621.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5028
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1564 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4744 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1504 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3448 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5896 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4604 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5588 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5396 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6016 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Script GUI [🔒 1515].rar"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:408
- - C:\Users\Admin\AppData\Local\Temp\Rar$EXb408.28476\GUIScript.exe
    "C:\Users\Admin\AppData\Local\Temp\Rar$EXb408.28476\GUIScript.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3784
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Rar$DIb408.40878\README.txt
    3⤵
    PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=900 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4496 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1708 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=948 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=2336 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=4436 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6016 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=3372 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5976 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6504 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3140 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6756 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6944 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6932 --field-trial-handle=1764,i,4249390028441457907,4695664925264745623,131072 /prefetch:8
  2⤵
  PID:2940
- C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
  "C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
  2⤵
  PID:3540
- - C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
    C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=6867c2d3365d29f9b40f61bb5c51a4bc7df908c0 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x700,0x704,0x708,0x6fc,0x63c,0x171b480,0x171b490,0x171b4a0
    3⤵
    PID:2984

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xcc
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
2c3024c6aec09f36db69877db35f8e4b

SHA1
b582af99bd6ba14ae8fd28bc1cbbaec7b4df393d

SHA256
ee27f9cd887945d699f4a3f406e59c49076f38cef50976821d6439c0ab356a7e

SHA512
f2741ada8dea5939075baf3da61462ccd9430c005eb07f3354abd2f686ce83603f401655adb9e990d45808404c3b48d891f7d04e00766bf2904cd12a60a1e23a

Download Submit
C:\Program Files\WinRAR\Rar.txt

Filesize
109KB

MD5
e51d9ff73c65b76ccd7cd09aeea99c3c

SHA1
d4789310e9b7a4628154f21af9803e88e89e9b1b

SHA256
7456f489100ec876062d68d152081167ac00d45194b17af4a8dd53680acfc9bd

SHA512
57ab82d4a95d3b5d181c0ec1a1a1de56a4d6c83af5644032ff3af71e9bd8e13051ae274609bda8b336d70a99f2fba17331773694d7e98d4a7635f7b59651b77c

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
103KB

MD5
4c88a040b31c4d144b44b0dc68fb2cc8

SHA1
bf473f5a5d3d8be6e5870a398212450580f8b37b

SHA256
6f1a005a0e5c765fcc68fe15f7ccd18667a6e583980e001ba7181aaaeed442b8

SHA512
e7f224a21d7c111b83775c778e6d9fa447e53809e0efd4f3ba99c7d6206036aa3dde9484248b244fb26789467559a40516c8e163d379e84dcf31ac84b4c5d2a8

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
317KB

MD5
381eae01a2241b8a4738b3c64649fbc0

SHA1
cc5944fde68ed622ebee2da9412534e5a44a7c9a

SHA256
ad58f39f5d429b5a3726c4a8ee5ccada86d24273eebf2f6072ad1fb61ea82d6e

SHA512
f7a8903ea38f2b62d6fa2cc755e0d972a14d00a2e1047e6e983902eff1d3a6bca98327c2b8ed47e46435d1156816e4b0d494726fce87b6cbe7722f5249889b88

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
58e2791a8387895fb7ab6297e54bc2d9

SHA1
eb535f54b7ff46589dab12165257537cd04ff29d

SHA256
b631525f5e6741ade44c095b36ace628988ac7617f0305c503949780200d0340

SHA512
998cae5591b049da4da34de94819c20c309e70e73f85bde552a0cf496e37bc9987531b3b4301d98b4cf9ef210be9204493ad6ae8f4af889a55361a55d9563fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_B3B43EFEA847E61D714C48920995E508

Filesize
472B

MD5
952513ca42adae3d5d739d3fdb9bf121

SHA1
ae098b91f1a9bb5f99398e76ac5512550b822093

SHA256
93b1f9965338820e21ec3694037f6f599863f3d8a0faa7f1492ac64077161ddb

SHA512
dfaa187f04a995d468ba0da35206a23fa332811169dcadde9a0f02049578381b9e8918073f4036453ff2da8a322fd1b69b9514c3883f30af60363031c07b12ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
bf036f99b033571fff858486e5acf262

SHA1
18d961d5c11dbfca32129194d9593fd13937551e

SHA256
53509792db44928e6606b9d823a025dc1de22051b133b688d5e609d504f3af7f

SHA512
7531b0ee49b38ac8bc166919f23ea9f5ced217ec16e745608a42d1c49a11b328288cb2cc056eb9aed5dd7b20f293924c4bc16932129e119079bda4e6bc708b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
e3ed01d3edafbd9a601c0c12328af7a1

SHA1
c84baef808ef48aba69ae58da8bbeba841131db4

SHA256
510d2b2078b428e820cc0b95636f0d310fba88f9e71600d9399b0a9bd24536c4

SHA512
fee4edf8b9eee8c4a9b9920d57781f2b1374bcc8ea4c9292d75d1123e301fff0243e5a03080e1c244093cd418194fedbc21a757a84a349ecd676cb9c5e5de41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_B3B43EFEA847E61D714C48920995E508

Filesize
406B

MD5
71c8c56864f0650560f249e07db2c0f0

SHA1
2e4e6e374eac89b68cd9862d1bc203b723a967ee

SHA256
82cf15b422e53b86e823b20b1dfcec0d4899cf43aaab2bda0c99f004e327f522

SHA512
722acfc7f79e2dcfd99b575b76f5095449e556c49c9942a4da7fcab0b6e21e6221633f673c9985c2a961896bbe690a4c952f164ac6dd582212c57c4cae32ac0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
296KB

MD5
30501ff2ce9b189a13a3efcae8a601d7

SHA1
518a27d6c778a23213d74239f4715da20c9ef261

SHA256
35c802cc50e265983beed64c4cc5f2402468cf1a19b39e8c103b31e065bf3eb0

SHA512
2c75ac9e00d77c7c2665b141ff6f7730aee12f6c0c6aa2460b33acde195a54c43e2c80e9c391e1ba6aff5e14d86f15992320d0bbf66d114bcac3dafe594999bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
64KB

MD5
c4f7300442a8f13dddf5c9bd09128727

SHA1
d7c8a30cdfe9027cca42c45f44d569627112ae6c

SHA256
5decc8ac1f3d26152842e44d1aa103c913711168c968c936bb782fb3cac10155

SHA512
3b6ebaff36af22dcc9ae7a7593657b56f99afb242ebeed50d26a33e1e6b0ff31c98ef576b96cf98c277cafc1050fee40b5d4c3fcd730595be756089a980030cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
68KB

MD5
7376fa45f083aebb4d1f89a1e71aec91

SHA1
5c0fb4b8ebb2a665e602e20fac0a2ad9afce9a6f

SHA256
713bbe73000f8273cd7307129d799de0b31282c9b5954081963d44472b127a76

SHA512
c393536304a36268cc2598af55d21729d4ebcb00754c9bd1303bbe6edffe5d2445068dc207a7eca83d83742383ba0e73cdd21b8a5ff08307e073d4bd42aca207

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a

Filesize
96KB

MD5
9add8a2d0968db9bfeecea90afe78908

SHA1
0fbad9c080edbbfafa13582c16dcdce975ad8bff

SHA256
1de5ec9db21d2c963b10fcea854a1cc1d0cabbdecb268dddabd4f2294687e644

SHA512
851859d5643d30089a470a289b515098c5c1c7b6a0a4f832c04bcd291af250ad1d63232742fde80f606d0f3d7b6ab6d36326f643407caec62ff67d5c9a56dfe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059

Filesize
49KB

MD5
9e8361c00c4bc8c9c051dee5bfa339d2

SHA1
d36a51791035bf241d03661e2bbb0d13c837ef36

SHA256
e4d3dbd48148b13bf0c8c90a2319c3fafa42d4abaa9c89fcabb3585d986234f4

SHA512
3bd193a1ce0ac4f243ebf877d95e9bcb8aa287c46aa3737c85b80c0995de1ddd385d4b138718055a216f5949f0bcfe33e33e649c0982db6e8c56fcaa6b242d33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068

Filesize
16KB

MD5
01d5892e6e243b52998310c2925b9f3a

SHA1
58180151b6a6ee4af73583a214b68efb9e8844d4

SHA256
7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d

SHA512
de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cbf78cdab75c2008a3cc8c6008cb3869

SHA1
3e71e2085c7fdbf6eade63815076a34260eb526f

SHA256
28dd0d9a462543c1bc7cb9b364eabdcd5c70fca2eee9eb040f9898fb3646220e

SHA512
e471cdb03560911d18dad02a35ca67df6b5286a446e50db1deda49900595724daaa689972962894a32c4ea7ecacb8e816df8fcc46793ee088e8773eef5a203c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
678def2b5dd8602292900fc87a3426db

SHA1
1e405183744b268fcc7e30eca87ef0493da123b2

SHA256
39363a9c065bb4fb2dc51b71bd31e7c277eeda77fb31db0a88b92951b985137d

SHA512
eafb2a4c910959743c5b97ede4b78cb4d88b2f8ba97bc8a84e825e90bee89dc639dae2cba2ff97d756f08090c88d57b51b23acde57e5fc153c79bf7dfcd96f92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
edb5bee33dd972afeb0f450fb494b908

SHA1
65275333e9f362626a7b4728492d03e29b7e76fd

SHA256
cdfe7a6c7c3ede59325bccf45c523592139deaf9d0c1f1e948f9df3a61843d7e

SHA512
9fd55005bffabeea01a1e8614bef14950fcc09e2a8e698d16cb73324366485c97dee06cefc5181416e03a2f4fd2cf886d8084707e71f0cb24ee983a274a78ee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
4ebdf564eef5d9535d6451181153d235

SHA1
273c8b18e67c6f9ac4bcf5a75ebf3bc3f17b8bc1

SHA256
491eea4da5bca177b3c317aaf2146d3d19c3b18c24a90a97a474e2b0c2f379d9

SHA512
51cb159c857b38e6a094d0929d7c151193c3f81d7f94c163a8c30dacb9a2eadea2bac4195849d1fe648bf5abf57c64e7ea104ec9b09ef3416a67b0394e4981ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
c9f040f29cc85d14f42a7f4d542841ec

SHA1
415981380502894bade68726dbdf0b1dc19fc6c2

SHA256
66ff27bde33a028a6e2fa703d725a179aae985148c1313ceb8703367a03996bc

SHA512
ac86867b25743f2446f497a01446964f3e2c41cdeb3d87ef282d40c5802648063e520b7c816f4cd4d5476732de33c20d24867d887b8aefaeb3fd4884a6b10ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe59f9f6.TMP

Filesize
349B

MD5
cc31ac62e126ed9b2eccb939ba0802cf

SHA1
f518f9f81f417e8457ef85f2a1f25e24cb9e73f0

SHA256
6930f80840b1642cfba6f773d1e38d66bbe7a824d5a216b9226349fe660c89ef

SHA512
fea2decaf9ef145c82c3433f3cae15a1e774e56d387aab8efa4de99a861758f2a9dcfe781fd281565db2d1847003fe45f07a4611d80e0afd86118f2e79c89e83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
e945b24b0c3a42e9944326290d41ae63

SHA1
2fd89e84865b7c6fc3733c895e0f4fdfd6fbc0a0

SHA256
e5438db30260a2f4b5f49f7130a634f124150e5e80324fe1d4253a1375959dd8

SHA512
379782a86f9981a55a5351aa83dc3883b5fa0a8fc95e67c7f1233f81d09093441e6f6036989543251f9bc3b378a446663ec381a3aec8fd5e95bfb9e60af4d3b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
447ab83e1e6510203f5f76851272ba7b

SHA1
66c7a32b0ab83307575228c9ecbddbf45e26ff5e

SHA256
b109fdfbd412ae54c6e08e96919e2302a53de8672f6f7ef1df2903a1c0875934

SHA512
57ea697a0b51af75d080860821ceff877dd0b45919c2b6e1b3ab9df619a4de6d6a077dd4fb0abffbe750c7a0dff319e68188f79e63e8f7766546711277521793

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
0682f26dd419fdf097be90ddadda8a4c

SHA1
b574ebe1e7169e9cf422eea9c0e005b6a826a11a

SHA256
9ae15bf57d8496ccb3b49c9cf3cf358821f1a9f047f2e58abe482015d7485cf0

SHA512
dadfe25ca5e3699f8786dffd898ae6cc4627d3f5a3ad75ccb8c08ff388678022067d28ad09bb800c81a506901f3e735ea9c3f22b7821eec04519caf23a4f4450

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
fd8065fece960cd5c4265c593c688d07

SHA1
da52fb4b5a1f5519da64eb43ae35c92f62eb35e3

SHA256
79d5c30413b0472dc845af378ed9d3cafa20c75b970a342964a708a3ddd975c1

SHA512
4344eb214e27fe6a72f3d6dc1aec79873513c82665c3d8b504a4cfe79ccfbea9c217d12e3e3c7e001364f8a6eb51dea32e207cfd53f93ff634e1e2453560e71a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
8fd5772a5bd019d8bb590c89378ce193

SHA1
6f3d5b298811cdc3d487765488d350a8b62456a5

SHA256
91bafe0c2e1129b6833b6b1d305a66d0e5416cb9e63edda35203c25a7b67ef35

SHA512
ee1b3916236cc4fde064e8bb231c4e3662f068821b804cfd377e52a83785efb6fa9fe0f0bb1921cc61cfc71c1513fdd1e000c29542a6164353c3a8dcd2a17b50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
c7207c3b24458895aa9153385e41c412

SHA1
731ba7fe2b69bc77b8379f4bea6ef441cccfe87f

SHA256
6bdf9c01ef65fd843e5d9134dd17bcb0323b1ce54e0825610f285c4e618f00e6

SHA512
5d8796c92f03adfa623d9f6084fbaadbf94351ca49453cf5bfceefed74fcc130779835fb8ad4ee43e0c2032f856b1ac9417407d32ad8441254d3714d28ab3e41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
458db1aa4482d95a1ebdc78f1015f122

SHA1
b8180429c48855d8467ecc5eb9bbb615afb52162

SHA256
36670f8c9cb5e25951a594f99e9e26395a696458427aab3bd7a40ec02bbd152d

SHA512
e810b60a7f0cd482416d8347c655dfac00455230f176c00d0e85535fd0eaa802ec2a5259552e60fcedb4b6e78e2a219d591b894b5c83120179bcab21b0c1ad79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5418bdac6e24441350d97c36589e5818

SHA1
7bedf36f9401285f8a8c571afd58bcd419cfafa6

SHA256
8c1f0714643e5325dd1685a6b4a038d5eebf7a118441803b61b4fdf35e643bf7

SHA512
a3f2f16838bb1209b5c16641d2548733f28dc95c9f119476901ed2b6259af99ec6f98909f4764b7c16a5c6a34c17d7b7c3deecbc4bd00e84e650f7274b2dfac9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
3ee2970b92f337db8057bc3c1d0e1df8

SHA1
e90b24a480fa5dedee4fcddd5d2ada6a2f2d2862

SHA256
0bfedae547f2cf47cb60dad89d0b9217d81ba1894f740e715046027541d3a22d

SHA512
4215abeb231bdfc3934ecff703d8b8580514b7494863965bf0f1e34e3e0f02e91516cd44b0ad9b15e2ab737e91c311101da0199a6676dd93cb9626893af2362a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
fa7f096fa5b3f4f1269be208043e92c5

SHA1
02571cf5906c80f309730e085c90446b746f62a1

SHA256
f231d4cda8c68103b5c599080ec6c99281379722c8a540808df65432816160b3

SHA512
bb21b449db559181194f72de6d5805a6b6ae052e9472c4d4ebf38ef1401753f6561923764fbc7f838742e079e0b4b13a9076422cc6c948488d64de70e2029f12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
d30dc1e7188d0a6cf28670201db18520

SHA1
aa1157cc5e994af24e4b24dd21aaafa71f0c0e56

SHA256
107eac9ab9b7a07c4b65c8d1d84fe785edac8b5d6ab73bd7d1e845dc3074b24d

SHA512
97bac4c72ac376b83d88cef27517f988e00220e9b930980f2596846e57b95aec7e56bb47551c5b229a7f8f4eccaf483439d5c85934168cc0b46621e613394ea2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
875bf7ef1ed84213860be44992bc5a4e

SHA1
597329cfae2e83b2a1a0ccdc46b23c388218b359

SHA256
0fd73b14d853a58afa3dd6c4d8854984ddf53f4523d1ef7bb3ceecfcdfc38a8e

SHA512
e64388551a617cd375e06a9b60e5ce7a2272d93e67648f7b98ea0e0bea37d55e906902cf242af4ba134c966e035b0c8ecd2f7d76ca286f7e726e25aa8059007b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7083b6a3df9bca8648db9bdc5a315825

SHA1
8c87e963312e96e5c1a4336da2a38c79f939a25d

SHA256
316bb5d6613b8a79fee63dd12501429452bd8e268b12443b4fa9f0136a1201d9

SHA512
fd31de0032aac0db129eb712b75cd865598825a02d234da28a77d78a069f53f8b95ef60d0343a6ee6b894522f3183c95c043573aaf08477f0786706b9808c72a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
3c18987eb1be00d135a27a944e2bda94

SHA1
ebf9d2b47740a13ec29b396035530c978792900b

SHA256
b10758950d48c5ae18aa1fe1343ad43a0fe6db5cffba2216a6c0557363d3543a

SHA512
6af62101b6ea72450374fa53a306b9a65c05881402a21ec2f9c823466c8131eda8dc91bc6345b352b388a07e956bb152ffa99110b88576f6ecfb2a8442038140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
38832e548328212c61ddb55bc4d8a389

SHA1
08f00cd2b5d3a13e0b40bb00353bd92947a4534e

SHA256
484ebc2bf138d66ebdef6564b048adf49c5e225c9ab11b81d26c50b5b038eef6

SHA512
05f131f6383c263c46c90bd4b5928e66f55b94a87a6b99639620dea2b92add756eb18b97ba56bb0fc9de4ea1c7d131982eb612a1c41c07857f313f5ada013391

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
90b80f84cde4ddaa20f3635a97db23fb

SHA1
d95460f4e8f0ce95aef3cdb72385fdec1ae67c79

SHA256
f62f41776cf777830ec5cc524c786e36a463403c30d0657553adb3632ebc7cc0

SHA512
68eb6425603c8f4c6f963690d44d2b70f9732bb82603245af6face3720b5077e0b96017b57eee06305dadab2f137e42fcc5e2ec7c11c1a995fc2c0e0e46309f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
a29c85c01f111e43f3d18b1b3669a6e4

SHA1
243d1252e0a2bb13b93ae2b7aafb039ea4510eac

SHA256
1dd6473c2941b9f5b29f4fb4a7b6a8eac29d471c5f8452c2a00c5a89a6ec9dd4

SHA512
3382340d6646860521347806432355107887859a3b2f47394b3513b52302f679794d1b4bfb4ecda78fbf147c07fa96b359547bef02c32e2d493e10aadb225215

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
dc0cbc17da7b13e23824e49a7f295f93

SHA1
951fa67d333ca38446488861733599f03d9591e4

SHA256
b2eef49e314e5c41840e050bacae967c1a80b66459ed7bd8ffaa063610f4df06

SHA512
a0bf21e061b6db8efd897aa37e77c3d1b901bc52b76117a0c50cf0a2bffe1ed868373f4178da42052ea2f110740f26516895eb12300af660744f695e76d2a2dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a61a25af09c38aae30fb5dfc13257abe

SHA1
2f04b3c911478078da9dae0ec6e63d060719b942

SHA256
05756f5d01cc3af59458b7759dd5be79decc4f69b1a469c72618d00300e19626

SHA512
883622cf33f214ce82d1928f585188bc176d2444d460a34ff30bff6398eac4ed14bf59b7b67304c85adb468fc7febfb8357cf343c669311471d51cb57890e19c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fa7e47ef76cb1aa59b70dfa9c835eed7

SHA1
3e0f8be429c7f96957e18861b2b26d16fb2d46ae

SHA256
a7b00ac2480fbeaf8f7d3e96e523cbafc411334716574167dc7e03d22a03625b

SHA512
d0c945003cfb13f6d36a6fe0b73399365a1c376c51399d304353a1ddb6aa74b8f49ac0b92baf579ff550dff3e3a68b1caccbfd78a208b279fd2a1c2a6b9a72cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4eb3340556a6f07d5892cde7783b81ec

SHA1
c4592ad2a1575a0da8d243521d41b48e1ec5b8ff

SHA256
273637765846a7ec67313a0ad481d62b09a3b41ff045cc274fe59da96956e92f

SHA512
34d6149cbaccda85c7d0808b11e073c10be00a54a9325a2e1e22216eb6705a7fd64d0c5799fe7fd32366b06671fe00b912466097f09cdcede0cca97ae4ef3166

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
16657ef8ff799be89abb709f1c91c5a5

SHA1
3ae5a0bf1d6f8a83a39e86846b84f13c3fa1eace

SHA256
84c11e9a9648e5c09e25881faaaff6562eec5a667ca8f7f2948fb110a93a7594

SHA512
0877c7f0dadbffaea1677294e65b6f1c92c6ccc726362a6fa105dc5bd6ab44a960264db8a15993696d5116dccddd54e4d7f20555168b78e0f46fe996964c57ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d0df8243e4cfd798e83560f3b49c9e2c

SHA1
6c5df4546e9ee32e7c526a003843343031aa3235

SHA256
7f7a971f011e61d3ae7464a90d3489113227fdfa72339bddb5f8acb12a9c9d1d

SHA512
85b2003e7b89f0533c5ab71d9deedbcc12734187f30dee8953917663f2a1397f1db68c76b00f0f9d46d9df6e0cdfb76c6eb218cf03b5513fb088112889947d03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a689d393-3a81-498d-9db4-d87ae713fb6f.tmp

Filesize
4KB

MD5
f723382f74b29d4d6a2215ae3f8cfada

SHA1
b6b23b4641b257842f1727ea4cef9e6cad6793dc

SHA256
44af148d6fe484ce6424700495bf4249bbba6281375452b94f3f9adb2f9dd577

SHA512
7fba140950a4295ed97f8ff62c622ce4aaa6060c10def44fe01838606bc2f79020afa2eb46caca0ece8ed56aa781dc342b6cf1b0e02eb2551f4598aaff687a25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a8b2af2967ebf18c87be2d7216597905

SHA1
f7bb5b1b72532e14e8b3c4ed1bcdf270f1494da1

SHA256
11031eee9819110fa67ffce40085ced936b99b117bff634656888afdbb671df0

SHA512
14d479636fffcc343b4588c967222159796912b5317298270b45d39730244b4369c472517c56115bf290a549e731aedc506c0986765fd05338ec3a5b8ee1b6f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
55ea5ba3d2bc60b20677af3d72a7404f

SHA1
9ace10c09eef046da8accd6505d51c8b5a5fcedf

SHA256
164516da34ff7bee183b4c45d60c923ead7d0459381642c9d45e1d3da0c7e7d4

SHA512
729beb4ee8b08ba2fccc186e26038872a1fc43cfa70905014aea9a48f376cc8463846aa27daba3fe40cc373862559d539e001287c89526794cb8ddf9ee7c3213

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
471aae604240a2529da6b302e003bfe8

SHA1
5619f4999c3bf914415628b2f11e15df12a448d2

SHA256
ddd255e8bf3210d4a51ecc2325d91161075dba70684d7320818752e935b4910e

SHA512
ddcf53753e79a2c3d888d4e24b2d46f3683e7fcba2f161e48fa25250c9f718df7be938d22f6bcacdb928a4303aaab89660728035b9ba09b433971e08b8fa364d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f8e221f247bbaa1da7f170184d41cf37

SHA1
a23637fd522d90084a08043a9710f0ddff80467a

SHA256
0a88c750a45646464acb7792735357284ff2fc4c3a2cb7b4b36d1195dc85d97b

SHA512
2abee0f686b93577a2503be9b0b16e2cbe2fca71a30de5d5b693c47b6d7f96b4ce571907dfbf9a6a6f67bce8229b5af9c98bdbd94563c5aba1ce03d480bc01ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b42c2fdd59155d9a819dffe7870faeb2

SHA1
5654e3837f3d477cd2c234829c74f0f2e2bfd27e

SHA256
e24c5d944d58fdb71d3503ff7d7239df76c22426c026675b6bcf097bb8a2372b

SHA512
f6c918d538eeeb65a86f111c96188ed1cbbcaeb7e53043da64d8df1a707b01f65fb862112030c06886b3efb960a09b0a6b01c6fbef7334597266ae8e44a278c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bdb063d7278ba2d09eac03f93c9d9a4c

SHA1
3aeef65a9d1a8e3bf4e6310ee0f8aa1f7cb2809c

SHA256
63bde5cfe26083e34da2945a8c19dae2a2a1c6ad380083aa70d011b4fa37be32

SHA512
d356dadcef4685eef22755b194936b6a46ba32b73749e625495ec0c718ede31b8fc4f5ad3268ef11c567dd17d14364eb6f8d87dfe0704bf49e00d06d7fc74232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
569c481ba8fda3623ecc96723f7c1fb6

SHA1
57495b021ab37ae14776c2fd32e20dfafa0c0ba5

SHA256
1256c1c6b85ebd483c6bbb0ad51a666be3f4ae0800bf99fb617f7fdec2152e26

SHA512
b908ffee25479e7b0d2f0d2d492f4257da9a4388b837c0a8921a8e7640650491a1b526e9b6f72fc38dc5f189457c1dea1b99ab0e147e5297fa0bec9233ef014b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3c840ab2-7290-499e-8b96-7e46d68cc9a5\index-dir\the-real-index

Filesize
624B

MD5
8d0cc31814b3b0c89adc123d1a1ffec2

SHA1
c79455d7f2aae7530895f7b3c9561cc9643b9336

SHA256
f64e0f8f285a53a64bfb130d35ead840d6675ada1abf3b4da58914b1d5521fc7

SHA512
c5bbf13e8b6b04865b6c90bf6ba77fd819544b9e8dc78627fbd1a5f48840bbb0c63bedb32e7810c51be5ad52fe5cc5ff5d401d71c99e09533ddb028186aabcdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3c840ab2-7290-499e-8b96-7e46d68cc9a5\index-dir\the-real-index~RFe57e399.TMP

Filesize
48B

MD5
f382974e39f3975a355a2c45a9f092eb

SHA1
3eb2d9dbbc06855aa1f893db28b5dda61bc2b1cc

SHA256
52ea9a82efad7b57f33b3bab42cfb7f627d0560543a9303b6310f01b86de00af

SHA512
713a65ae998fbf2017fe3fba6ccebc188418f0f76156ad9f7a306449af9f5f082442ad6fa4a87c986698c77b68409e7140d47fa717e0e8c13356123bd577543b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
129B

MD5
f6f025b9c273bddce09bad9c1416a833

SHA1
4bed431875a5eb86cf9c7fd5884390a8059693c5

SHA256
c1a7d2a07358d528cfaab2a3ab49f5962cbe8136e149f4cceec08e9313a3f03d

SHA512
8323297af30f914a5ef7c4c696f4641217c4c9af4aafd8a616d8ba279be116d9e870fb98960e47203258a099a4ffb2ecb924dd69a40de0b2ca8a68f97a3982b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
189B

MD5
16505dd04f1c088b700a70da9909e9b3

SHA1
0d18802ef84dce06b22a921f59a4b45426b90781

SHA256
3a947937dd8c258fc81824423d5be8371c00c4af1d9326d0ed24311f54885d06

SHA512
c424fe580565c3bde6af0fa7b9820ffda1c8695b8336a7ef1ea11ffd3f5f491c491af2d77869e08bc2da8e414e4c70300dfa82b6dcb488933ac0a0e30ad2aa89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
125B

MD5
a36243ac167df885ee277fc50fd2955f

SHA1
1363d0c315ef5ff4233be6d36d8a87267645b22a

SHA256
51ce97df8965e98e92e3e47958f7e661c9ea0d5346e4d1a8190c01f6f328418f

SHA512
e856b7bedc6af22fd69026089ad68966e2ff557c4ef202ebc81f62a379aa698a4cb57b5e3e36e6c6f9b3cf7065b5335088cb067bfa7f531222c2ef10868dcd52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe577b79.TMP

Filesize
120B

MD5
47ebd54ec3344da6bcbc87e71ffade45

SHA1
b3ae0f99e5b45d19d9599fe943f0958a48001e14

SHA256
354c5774ed83cac5be68762dd21e740250ecbac68ad6a2fc950499b41db936be

SHA512
dacab4610e2120ef066fe8b60b4802206e5d6d6d8e8ce5d517648bce6b9753c76b9e6afa23385a17e68d0418f727be9254663a35ce0d103f46b97005baaaac2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a1054806f147de9fcbfd08435f0833a4

SHA1
194759d9ceed64f76033db8eced1c9a49bcbc963

SHA256
2314021ac25c5d488247ea7f53fab91ee89fb4f10031c692d5468b8709548b14

SHA512
b381e0b0aa11fe8309c6cac99b045fd3702ae7b6dfce1ce8598180cc2c86b9202eb1bf6e36a4e426d0b6ff8e0f9f03a33cd9bcd9b61735e2a4aff1cb0ef416a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ce1d.TMP

Filesize
48B

MD5
a21401ec9625d81852f40c311a132139

SHA1
bbbda73ad9fb1cdb47586fc84d4e5b7c06f6c23c

SHA256
4daa81e9ef5a632520729f1d7fd20248ab1cc4d3b0cf6cc25df3d2a28370af27

SHA512
4198800658622da1efadd20d778e3600de5b35d972638f5a9a10487e5dd80f9b74c52e32690d3177b318bf270a98f24a25bb83a0d0bcba2821bef9d7e4454c4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2960_389040964\Icons Monochrome\16.png

Filesize
216B

MD5
a4fd4f5953721f7f3a5b4bfd58922efe

SHA1
f3abed41d764efbd26bacf84c42bd8098a14c5cb

SHA256
c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3

SHA512
7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
92KB

MD5
aeef8b7b61a6884ed4f78c44ec5516e0

SHA1
757f118d5f750c3b943c01d18f2d70c33c749605

SHA256
d43e5c249ce79f72f7f7faab2598aaa0433852ca20ec8a3ded73485c6b20b950

SHA512
a62550c0b1cf42de415639bc33bf6f1310f16c219959709fd7667f64d1049248d5d5dd6fbd8569809ab26886efe44e5e7f0e733adfe339f91c7a52bf7ee67275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
0df4f8960792e7a049340e54dd98c2b4

SHA1
59ed347adf48524d41266775c1d4139d188f4314

SHA256
f2aa4310baf8d1ff88069e37d023264ace952ebbf1ef712bd9c498f7835b1009

SHA512
c84ba301e7d54074fe120ff73f08dbbbd022fecd6e34d1a03f2be3645f27ce29177088ce80d0bac47bd718627dc1eaefc0e83f8e55662a259cd8755637bfa4a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
32e0010e129bfa98eb2b2d0e0d6f9efd

SHA1
0c027550c3a56aedbe0d254870b214dfd31745de

SHA256
f3ae4738852bd7ca925c73eeaced7c3d6b3acd6d336b629ee1d98f635fca6763

SHA512
7c971f6838c5b7974b513af783d944f6d9fc54173755f0eb6bf3e25136abd22d64a2ee67d4536b36ebd93e116903b8a5e4e61f5c88d9bf1a5f393733059a3b1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
32e0010e129bfa98eb2b2d0e0d6f9efd

SHA1
0c027550c3a56aedbe0d254870b214dfd31745de

SHA256
f3ae4738852bd7ca925c73eeaced7c3d6b3acd6d336b629ee1d98f635fca6763

SHA512
7c971f6838c5b7974b513af783d944f6d9fc54173755f0eb6bf3e25136abd22d64a2ee67d4536b36ebd93e116903b8a5e4e61f5c88d9bf1a5f393733059a3b1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe593afc.TMP

Filesize
111KB

MD5
0ff9ec986925e2d1c90ee20da1f9c98a

SHA1
bd04d759dfbf48cb9f8e8e183a670d46892162eb

SHA256
ba64794d3d8a3453b1a2765453a2f6550af8de26a2441e2097bb194a5472b962

SHA512
bacfd476260a7e41e80af575f9b1c216437f92975851342185c3fb03d43d2ca91a21aff862c71101f409753737064121a5ff1dd4989a88065e704055c76c1212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dc8366bd-0000-4e04-b4f9-9da2332deb4a.tmp

Filesize
113KB

MD5
6d813a49df608c13cbf5abec73059db9

SHA1
4323785f9caf2717088fe5806285f825c82791d0

SHA256
f98bf4ede4f536719e5f6382f36dbf32519ef6e8f5bdcd70f27e5c8b85eb56d8

SHA512
a1c07c4055a2933b53801a28456cee3a93ee50c12152cc78dd0a33a241f44ce7a6e858d7d0f2d42f53fb495915653698755df1dece7214474b5b5e97adf20189

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\480JMPRZ\BatchIncrement[3].json

Filesize
163B

MD5
bedbf7d7d69748886e9b48f45c75fbbe

SHA1
aa0789d89bfbd44ca1bffe83851af95b6afb012c

SHA256
b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

SHA512
7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DIb408.40878\README.txt

Filesize
100B

MD5
998406187e872595c63b791d84010813

SHA1
5daa70d15b0b648f82aa3989d4c3cc89f2364f71

SHA256
2091fa667940e3674f2182f1b0ae0549f2add79591ec8af657dd954d555b7a45

SHA512
ecfde36ce0a7e66114ad5a270d8af0ce9b3c39adcc2e83332fc0ad81b0b7e37de8a04cc8032e1c98c1ae9fed7980695baedf8c3b8864fd724c1d981e0df492ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb408.28476\GUIScript.exe

Filesize
827.9MB

MD5
1780d58767c02be64d8ede48c1b82e17

SHA1
1151855a08878b68c995396fc6f2c63e9f1295de

SHA256
57ecf695b76c3afecf1cc131129e6628f9c842e767460ae4b58b4798e8f7942c

SHA512
4a8c34826f8ab29f25ed69461f6a2d243f302aa3a2dc7653f5cd7268d476cb4a6f00601c9c8de17e1b5f605221c761efa1233d3bcd79130fe0c42b24a138375e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb408.28476\GUIScript.exe

Filesize
830.2MB

MD5
3f80b57e19083ba73d35405bf1167c5f

SHA1
5ceaabac394186236645260bdd77fb359f139102

SHA256
fde0c7ff832171fa48b3151e6e3cfa0f874a4657ff84f19b4d9ee55f7617f5cf

SHA512
2f19fc5021b478118d0982902f7351140bdf593d099237cf9feb4d17493e85ee9ba4a2f8b96f23e7627a42638e29f29f72939e415c9b3fdaf7e5029eb7fbf772

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
ea422ffc74fbfbd6d980ae8e4d3513e8

SHA1
1f1b01250bbab5d1b893add52c1d6654336c2f00

SHA256
47d56b778f5a1815155fcb5c6a782df9a5b85866a1ced4d3cf1c4bc8dce8e17a

SHA512
806b4d93a6435f1771b6022e9380c4cd7e039aaa659c4fc72b0d89b197432cbcbddaf72ed97c4c2d2078e250e421cfe8051c601122cbc324696219a25e63c3d3

Download Submit
C:\Users\Admin\Downloads\Script GUI [🔒 1515].rar

Filesize
3.3MB

MD5
dc44d9ac63fb3f7bc9ed4543a7bef843

SHA1
e5126b4fdd8b4b687270d59408f4e191843b0bd0

SHA256
87738c9f89b27de5d18545ef1a64f588674aab995c2fbcaf859e5795d225144e

SHA512
2bdd17eb62a87b88c37738fac75e652a6509b0610fc85b7dbae4c3c894c40e192c53b04c4f69705013c6a099e78d189c01bd01dcce3846f4f18e4f9c5f22961e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 26019.crdownload

Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe

Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe

Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
memory/3012-1618-0x000000000BB80000-0x000000000C0AC000-memory.dmp

Filesize
5.2MB

Download
memory/3012-1412-0x0000000009E40000-0x0000000009E50000-memory.dmp

Filesize
64KB

Download
memory/3012-1419-0x0000000009E50000-0x0000000009EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-1411-0x0000000009AB0000-0x0000000009AEE000-memory.dmp

Filesize
248KB

Download
memory/3012-1404-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3012-1408-0x000000000A030000-0x000000000A636000-memory.dmp

Filesize
6.0MB

Download
memory/3012-1409-0x0000000009A50000-0x0000000009A62000-memory.dmp

Filesize
72KB

Download
memory/3012-1410-0x0000000009B80000-0x0000000009C8A000-memory.dmp

Filesize
1.0MB

Download
memory/3012-1620-0x000000000ACE0000-0x000000000AD30000-memory.dmp

Filesize
320KB

Download
memory/3012-1429-0x000000000A9E0000-0x000000000AA72000-memory.dmp

Filesize
584KB

Download
memory/3012-1413-0x0000000009AF0000-0x0000000009B3B000-memory.dmp

Filesize
300KB

Download
memory/3012-1617-0x000000000B480000-0x000000000B642000-memory.dmp

Filesize
1.8MB

Download
memory/3012-1616-0x0000000009E40000-0x0000000009E50000-memory.dmp

Filesize
64KB

Download
memory/3012-1582-0x000000000A990000-0x000000000A9AE000-memory.dmp

Filesize
120KB

Download
memory/3012-1433-0x000000000AA80000-0x000000000AAF6000-memory.dmp

Filesize
472KB

Download
memory/3012-1430-0x000000000AF80000-0x000000000B47E000-memory.dmp

Filesize
5.0MB

Download
memory/3784-1315-0x00000000005E0000-0x0000000000628000-memory.dmp

Filesize
288KB

Download
memory/3784-1403-0x0000000004E80000-0x0000000004EC4000-memory.dmp

Filesize
272KB

Download
memory/3784-1392-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/3784-1418-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download