0d40a26e2c9dd9b1b29115ac2ce7bd5c7337dc01126b63a958012ebefe391ed7

Analysis

user interaction
yes
max time kernel
1199s
max time network
1193s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
15/04/2026, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.16.5 (3).zip
Size 42.7MB
Sample260415-yk52psht8m
SHA256 0d40a26e2c9dd9b1b29115ac2ce7bd5c7337dc01126b63a958012ebefe391ed7
MD5 b8d00001f017a28f4d2be78490783ff3
SHA1 72f664c2273282e69645ada4990968df915d0b21
SHA512 aaaf0b6c34479be8574452459d239cdb01118c193c63229c7bb769c35aaba1adac35ff1ecfbfa7711b5a36bb22fdb77954fa55cf191eecfd4922916a23d8bd43
SSDEEP 786432:9gg7vfhdGodX4M2RDg6i/dm/V4oa1phpzL5zqnb7kUMnNw0JqVAWYBfW6Y68+a:9gAxEo9F2Ji/dc4f7ZL5wb7k5niuqVUg
TLSH
T10BA7332862305A8E8933F93B3556A7E3664057C0AF94FCB2F7509B651F82FF18A64F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
140	2308	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\Control Panel\International\Geo\Nation	winrar-x64-720.exe
Key value queried	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
3384	winrar-x64-720.exe
3388	uninstall.exe
3108	WinRAR.exe
5460	WinRAR.exe

Loads dropped DLL 1 IoCs

pid	Process
3304	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240841109	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2308	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207563908002491"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 6a00310000000000505c260410005a454e4954487e310000520009000400efbe8f5c219f8f5c219f2e000000a483020000000700000000000000000000000000000017d2d9005a0065006e0069007400680041006c0070006800610043007200610063006b00000018000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903610002-708294114-949261322-1000\{7FD381C3-E7DC-481D-A003-49D33528399A}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000096f887acff8edc013666ac13078fdc01b722b81212cddc0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3108	WinRAR.exe
2452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3384	winrar-x64-720.exe
3384	winrar-x64-720.exe
2452	chrome.exe
3032	chrome.exe
4708	chrome.exe
4436	chrome.exe
6120	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 5820	4640	chrome.exe	84
PID 4640 wrote to memory of 2308	4640	chrome.exe	85
PID 4640 wrote to memory of 3132	4640	chrome.exe	86
PID 4640 wrote to memory of 3132	4640	chrome.exe	86
PID 4640 wrote to memory of 5124	4640	chrome.exe	87
PID 4640 wrote to memory of 5124	4640	chrome.exe	87
PID 4640 wrote to memory of 440	4640	chrome.exe	88
PID 4640 wrote to memory of 5320	4640	chrome.exe	89
PID 4640 wrote to memory of 440	4640	chrome.exe	88
PID 4640 wrote to memory of 5320	4640	chrome.exe	89
PID 4640 wrote to memory of 3284	4640	chrome.exe	90
PID 4640 wrote to memory of 3284	4640	chrome.exe	90
PID 4640 wrote to memory of 1100	4640	chrome.exe	92
PID 4640 wrote to memory of 1100	4640	chrome.exe	92
PID 4640 wrote to memory of 4880	4640	chrome.exe	93
PID 4640 wrote to memory of 3032	4640	chrome.exe	103
PID 4640 wrote to memory of 2744	4640	chrome.exe	104
PID 4640 wrote to memory of 4352	4640	chrome.exe	105
PID 4640 wrote to memory of 2384	4640	chrome.exe	106
PID 4640 wrote to memory of 2384	4640	chrome.exe	106
PID 4640 wrote to memory of 3840	4640	chrome.exe	107
PID 4640 wrote to memory of 3840	4640	chrome.exe	107
PID 4640 wrote to memory of 4516	4640	chrome.exe	108
PID 4640 wrote to memory of 4516	4640	chrome.exe	108
PID 4640 wrote to memory of 6128	4640	chrome.exe	109
PID 4640 wrote to memory of 6128	4640	chrome.exe	109
PID 4640 wrote to memory of 5724	4640	chrome.exe	110
PID 4640 wrote to memory of 5724	4640	chrome.exe	110
PID 4640 wrote to memory of 1152	4640	chrome.exe	111
PID 4640 wrote to memory of 1712	4640	chrome.exe	112
PID 4640 wrote to memory of 1712	4640	chrome.exe	112
PID 4640 wrote to memory of 3512	4640	chrome.exe	113
PID 4640 wrote to memory of 3512	4640	chrome.exe	113
PID 4640 wrote to memory of 3620	4640	chrome.exe	114
PID 4640 wrote to memory of 4620	4640	chrome.exe	115
PID 4640 wrote to memory of 4620	4640	chrome.exe	115
PID 4640 wrote to memory of 4704	4640	chrome.exe	116
PID 4640 wrote to memory of 4704	4640	chrome.exe	116
PID 4640 wrote to memory of 5844	4640	chrome.exe	117
PID 4640 wrote to memory of 5844	4640	chrome.exe	117
PID 4640 wrote to memory of 3408	4640	chrome.exe	118
PID 4640 wrote to memory of 3384	4640	chrome.exe	119
PID 3384 wrote to memory of 3388	3384	winrar-x64-720.exe	120
PID 4640 wrote to memory of 3108	4640	chrome.exe	124
PID 3108 wrote to memory of 5460	3108	WinRAR.exe	125
PID 4640 wrote to memory of 4616	4640	chrome.exe	127
PID 4640 wrote to memory of 4616	4640	chrome.exe	127
PID 4640 wrote to memory of 4596	4640	chrome.exe	128
PID 4640 wrote to memory of 4596	4640	chrome.exe	128
PID 4640 wrote to memory of 3812	4640	chrome.exe	129
PID 4640 wrote to memory of 3812	4640	chrome.exe	129
PID 4640 wrote to memory of 3504	4640	chrome.exe	130
PID 4640 wrote to memory of 3504	4640	chrome.exe	130
PID 4640 wrote to memory of 4988	4640	chrome.exe	131
PID 4640 wrote to memory of 4988	4640	chrome.exe	131
PID 4640 wrote to memory of 4444	4640	chrome.exe	132
PID 4640 wrote to memory of 4444	4640	chrome.exe	132
PID 4640 wrote to memory of 2452	4640	chrome.exe	133
PID 4640 wrote to memory of 856	4640	chrome.exe	135
PID 4640 wrote to memory of 856	4640	chrome.exe	135
PID 4640 wrote to memory of 3032	4640	chrome.exe	136
PID 4640 wrote to memory of 4708	4640	chrome.exe	137
PID 4640 wrote to memory of 4436	4640	chrome.exe	138
PID 4640 wrote to memory of 6120	4640	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\1.16.5 (3).zip"
1⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffb5cbec728,0x7ffb5cbec734,0x7ffb5cbec740
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,16578332258497894667,6425742265802843382,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,7861318043370859728,4150557913298299965,262144 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,6177519050334389560,16759430336214848106,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12630447803196212210,10185372938992124967,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,7004000503622970659,4129411065645400362,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,2899266482986653909,7508395960916576708,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,5637388770178893184,1752572344573587203,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,9722725372122222379,13466418001326874916,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,15011838647895809525,16284349112874196420,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,5168669307320296823,12033651048389586901,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,2241806168570668112,2125925573929852927,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5840,i,7147533747564671008,10340574612544044351,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4868,i,5128549159787687168,5566257565809361065,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3444,i,5833471446537631867,1697393140745614625,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6000,i,4306308700727662411,6103065029897768991,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4772,i,5896767814595276050,15217506894871650277,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6480,i,18283217617430790643,13594875961469295263,262144 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6568,i,16133363369350027658,1535743116672523905,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6696,i,15674728232130474515,16179956633700413884,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,14110798722336320527,6401714748028537301,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6916,i,13179706049824612804,16229303649493492985,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6692,i,868915604383931732,509358008906781138,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,13158714900153531622,11633170056570969432,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,1429825527807275653,7662713519380526404,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:3408
- C:\Users\Admin\Downloads\winrar-x64-720.exe
  "C:\Users\Admin\Downloads\winrar-x64-720.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:3388
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\ZenithAlphaCrack (1).rar"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files\WinRAR\WinRAR.exe
    "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\Admin\AppData\Local\Temp\Rar$DIa3108.13888.rartemp\ZenithAlpha.rar
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7152,i,16079479850693156808,10726684179527918680,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7128,i,7914727715674951005,4844102483636441329,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6212,i,1541180628035673061,189174967028225521,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5812,i,7985517392000407738,6795042266961568185,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7288,i,15613428614525016045,676240896144346088,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7312,i,8483319378602928951,5360490477721697181,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7560,i,17194954019201902080,3907786245788356090,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7488,i,1958338845870671968,868396470635973619,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7596,i,4338675140496049009,9758946725266359933,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7480,i,17876359471726248490,9285874951537667210,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7736,i,2255456752062028227,4981014400197670570,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7432 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,10066720752767378195,5429119327815948218,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5444,i,14622430346256558462,3049952598898714934,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6188,i,8254199429471989484,10536055535734911046,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7412,i,12935086659217220063,2468052925450477754,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6168,i,5543932875696907072,4846705212164247257,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4792,i,15625833032678671060,7858737511751678919,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=3392,i,14678196987428199642,8454883343978915189,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7528,i,4851837469663291339,5552475007534178598,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7472 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,16668471509779417427,16168182569973465104,524288 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6632,i,14578054767024227196,5686944113189134896,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5700,i,10611172509982713232,10528957329091526369,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=5504,i,15043997158187175462,12904974073822628171,2097152 --field-trial-handle=2068,i,10853349571337270181,8491031977367052135,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:2736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x16c
1⤵
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 db7b1ea456bd12028e03f9d88af543ca27ebe68101afc81b846e127590b70006
MD5 76f8c35620b734c2a715c3ba41d7ec00
SHA1 7f8d1a4c8a69da6c3afcf141889552b6816c1b66
SHA512 286981f9f0e8640e495082fb18a33a23da3b7fc15bb761655e61e4b9877e4675f5b11bc96826d7315bf55da70b6d8d5eb190e027ad866ff9c7a7c9acf0be78b4
SSDEEP 12288:QegJaV781ACnH5AC+6Fni6GR1AR3jUXloBQKuk9ltym:QegJ87HCH5ACFi6GcjUXloBQKdltym
TLSH
T1F9E48D05A6A853BAD47BD07CC683461FFAB2785583B1C7CB03A51AAA1F137E0573E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5324abf77d845d7431c372af56a1e991b91ff7e1b2eb7091906f4de646bfdf14
MD5 a6343950b555a3a5fb79b98851f3c935
SHA1 85efbe7e6579bdec89aa850c54c4a62fd4d4c248
SHA512 f585215398aba51cb0aa59d30cbe0274170f877997a95e192fe0438a794d2b74b0bcafc0d442cd5a1673055c8a69708ce9635c98e47c0825198cbd966912b5b1
TLSH
T1FEE02BAEC871DC2B24FD4B1951441646EE50131B1751495F3F3D92088FB257A594695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 65KB
SHA256 7bc424130eda2bae7fca759b777f9af68b2ffdd1db9799c7f5b482bbf3375a2f
MD5 2bd30bcdb6172c371ff17cac2fbc52c3
SHA1 17b341c22afa48bf9ac82b7525da4969ce516ec7
SHA512 6e5ec1b1aa0558d9ebc3439adfee842b7f31e9e307ce221f9c463ba6b1d40dfc938d9dbdcd8537980ca600778a97db6b76c15e5915045a9f817699000efd5016
SSDEEP 1536:uYZknOit3uYJaoHyR2Ebg/dEgINEX1b25IjcpXQzv3zC+VFNB:uYmOittLyRHb+dEPsb2Ojc1QzLC+VHB
TLSH
T1CD630202D4949D8DF6F31853F73309BA5F669E70E628CCEB64F8CF6F6818050740A5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 49KB
SHA256 62d5877360957e64ef19c7069fdf814570611b1ad2a4f874c5771efd9e0de663
MD5 745fee3492501d9fd714d5315d084b3d
SHA1 7f97590b638e816ce2e126fa81ac72cfe7a15c6a
SHA512 ebeb50cc98ff9f55659a4ea6cc0be44ed9b0b7b0f459de23f4e1b2e97371ff2d3d5af87359ff5cba6ae2a8bf3d9fe193ccc46aefde924ca52dbb1c0b4afe858e
SSDEEP 768:rKoJu9KjiwioLz/j2ihwF2q62Jp7pKMW+AxTX2JztoRjIxYr3SpX6DEBPXNeIru:WwuKiwiE2iqFZJJhpAUJUBVDSPXNeN
TLSH
T16E33F2D87EBE6382B7EDD95AC9A4BB0C05F5CBD96EB29AC014514F4B72B2A31C441073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 26KB
SHA256 443294d3f0bc0bec0655818b05cb8f70d8f1afbed000829524c5d359997bdb04
MD5 cf69a88ea64af18a16fcdc3f05fa0021
SHA1 90d8fd946a04fccb9c17c84edcdfbd4b46724605
SHA512 3659043480a61fa1815164e90cd710bd5db81fcbf754edb34fde50def6a08619f5266c6ecd751b74536b917d7f904e81d78439c90c4162ca778787e52df4ea0c
SSDEEP 768:P5QWHxuA22qRNlcGuC3SOSovJx5Nin5svTKwevp:PPHwAtq/+G7PPBx5NinuveLvp
TLSH
T145C2E1062468DCB18687AF8B339AB57B635B1C79F8CB3D6219946D72327B031205E03F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000073
Size 98KB
SHA256 963b03c8bd4fbf84e3804038c3de02fe564b1d698f1a8d0f1b9267fedbd22732
MD5 ea5c67d75d2e248d3e8db23842d7ad5d
SHA1 5c350974455e84e7d901dcce04f5630f5f984964
SHA512 f7d16f1755aaeecd25a377f36b76ea781029eb5490f805928428e4d4f10547117b385867cb90ff3df1a46b9643a9dc8adf0f3c59f731378a967a47fc5242cb7e
SSDEEP 1536:qvj/s7balccHlzS/hiMrK2EHJgxxczVkvbwni5ifPgXJ+ZgjxurP3AyCkD8RiZ/:Y/s22/hHrKHHJgxxuVtni578mEw2gRs/
TLSH
T1BAA3029DF054139A2FC3387BDE90C8D6F1517B28D1DF1D5082A34734B3BDA8689E9541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000074
Size 165KB
SHA256 d1f245da33787b0a0c340a1a0a053be2ae91b05bbd6ca279c63b856e2cea164c
MD5 831b323098f11d63bba6b78d7afcff4f
SHA1 dbe05dda85f8811d6a0780d193c0e2a702d6e104
SHA512 e2899569286b3fbe5292d03d9d02ba87157f3854460d8513ecfdd00ce88ea33294cbcd657b97a0ce388f2938ae093d3af6c39cb392890e8aaede64d3e272a973
SSDEEP 3072:y78S+lYaoICdP/wJtNCzuFmtkPHTWTBF9+rOtuC14nhrf/1dTmMESFnk10fOHDL/:y7hrbIBtrFmCPHTWTBF9+qVCnmLrHn
TLSH
T160F323A7050272BCB41F07BC2447B270E62172EEA75DF45B826CB74A18E9934B2E57F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075
Size 104KB
SHA256 e26e47afbc880f6bf71fdc27387fb2ecc9afee78d9cc9309a9424fb955093a35
MD5 61204b563cc4d67a353dc208ccc6dfe2
SHA1 f63cdca71c0f05315b54da8a40d43730b0654a17
SHA512 69f54350ecbcd77f0ec5c9bd7437fed60411f411ec4e60374d16429bafebd57baf6a9e84a8b088fea3ccd298f83fcd6ae2310ad447fee2fb995f38bf20d7834d
SSDEEP 3072:R1zdabWUDaSo7rnyqGRmWZ/K3Hj51kgp/X5L4WC:DZgF8fnLG5Z/KV1pFX5L4F
TLSH
T168A31234ADAEDBE1F7FC463BEBC48E1AF82A7D569C8425917425EE3080717F63801199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000076
Size 103KB
SHA256 d6d5bd921470979f064621acf27b139f7cff8caf20b5a7fd4f61590be99a4c35
MD5 0d701b9ec80292e7e676a9c010cab605
SHA1 044a6a764b9bf271001bbecdd04217e677a8367c
SHA512 bc023d90e86c952bf1ef3dc4c9e8121b893c565122b203e85ebfc46daf8163fac84a06290e352e815821239d17528166745fbc65dafb4164806840ea0c8f1239
SSDEEP 3072:dD9/U3M/Rk6kQtjhCz88uwFG5WLPtNBlkQ:dRa4kQttCz88u50Dtl
TLSH
T133A302FBC7CA842BC517D53E486111F3B2405C36559E972B8CE45A0D3BEAAF0AF08D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000077
Size 136KB
SHA256 0536c50a5b094a6a90aaab895fd7e812ae5e67f01a15b7cc2885050cd10d312b
MD5 d69770cba70f3a6704931b6e1acf9317
SHA1 3ab0174384f23a07b5f7c6e7187375acae7328f8
SHA512 b8b5960f288ab168567296df7dfaf26dd303c928451a787e00eb19919e813c4a33af9e635d97447ba90349cdc49250a957d45f1d783d6138b664ab3709b2ca53
SSDEEP 3072:OWxAST31UgS4hVLkWucfZATNjKBHB+kDzvPxL3Xs6SK5Is1:OWxAk9GOfmxjSB7JTXsFK3
TLSH
T1B3D302252781D5E2C9F46FB007C74317EF83B989D3E6459487802A19288A3F4BE9757F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000078
Size 79KB
SHA256 d1fbc4539245d8357c597d2097afb564a1a7ab63ee5bfd111b4112d5c1a60a9b
MD5 8c7dbcb48e32e69320ba3d624da84cb5
SHA1 95aabb6119ac7c16af0ef82e3513875191e6ed87
SHA512 69a5062beca8b758c3b6d5ac56fdd15584e0647f3293cc6107cc5f19098d13bd4dcd9bb37f284ec738fe3d67776307af95a4303d7504a79590a2405201445a71
SSDEEP 1536:PX5meRi8PN0U3HsfjATucNgF77zGXedRvI8ozhFmUpQTmu7geKplyFajuTMd9FQ+:Nk8PN0xKRNm7/jdxEFLp0mu7gTyFajbP
TLSH
T19F8301F330AA85F74930F541BC39BDA43182B35E444FBA532A650FB1F09A4813B91FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000079
Size 170KB
SHA256 781983ce3d0c5a826d8ba70ca22b425a7e57269f1ef78324c2e7d0d621aaf159
MD5 4a991f4916020cf377a330d8118c3861
SHA1 719d36bb14fccd058c8e630abc3449ba4a2b5b03
SHA512 38876df5ea52a719c1b0d11d21b44713405582af61ebc915609c9e6e36d527963b31874d8ff311cc2d1b0185d2df34f5aed0416ffaca59a562be53bfb21fc32e
SSDEEP 3072:g2RzqqwzRQ2HK9+QZ3qBnVcnHvQ28bjg6+jSFrpMDxGczGE16+FVuOVaLKZvjT:g0qqwu2HTQUhQPQXbjg12FVMDIczGW6C
TLSH
T1030413AE524D8ED1FC403371A19AF396A71DF6683FC6C9C6101AB93205326D2DFC9963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000094
Size 82KB
SHA256 b9493fce618e099c4afa747dcc2a4b996dcd406af14734837c699292023450fb
MD5 30830262cc0c627e56c6c485bc4d50ba
SHA1 da98e9aff3ff79eb0c42a5c6ce1c9cd873c941a2
SHA512 6f38054eee91eeaa9469e73af3053ad7d0bdd047cada098aeedea991c4a55bb2ab34ef1a9d1d8b82dd94e88d78d3f9b24d40d55df7f384eb9d597ecd12c4e54f
SSDEEP 1536:me+zoxGPSoHlwUX8Lg48g6Azkx3cFv4s0vgRNLELVrJYt97WmnA:mLoxyOBE4r65e04KVrJYf6mA
TLSH
T1A78302536F5919F2E4FCC1B413B8D79BE2D319ED57E2ED0244AC2D832492F18252A32E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 06b449996711a7bd7959344fb5079c3c534adab219f1b8e6bb08a6aea75abe1d
MD5 915f947fad1c239b5e455a648f745ab2
SHA1 493147eefdeb7167cf5e3407a78cf81b9a4bd7b4
SHA512 cd8e63b6e8bbb81b3f90d52f4f602b18f22730e3604e8f8bf200f93c0522e389c6c522bfb5ec31c6c6963ee17cd90edce77be7cc7bb1c34e0f172cb239c21c0f
TLSH
T1B6C092A3A1C0E859DF98A6B1E691C74A2120DD1C2F14296A82D400A8F1695709640290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 02f971a7fdf11ba958656c614edd6b5df50cf0919ec0d9b06e8ed4dac7f7076e
MD5 2f9fd961a579ef6a90f6652e456d0a27
SHA1 6d8c268307a9f08dfca57b4384ae3c424e862a4e
SHA512 a5248f7447fe231e57d066e8e8b28b724590d152555e351a38269d4c695eec734060fe45af2be3c0b3d4e5aad920ec622fa2216d4a16906c634e286fb3e44de3
TLSH
T192C08C1365D0E808CFA42B3492C7D35B3134EA1C1B112EA782E840A8E059170E000260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 f605fa8d0c2a89a34e291516656a93bbbe637cef16b5757afa3be1e739a3e460
MD5 82671a7d2f6fdbbcf2c35c82c482164a
SHA1 69404e50134e5615aa33be1e79a9ad5db4b3687d
SHA512 39335c6457ecb997ad41fc0de4bf5d55316b835d7229e6e36bfe15df7e757541d76551833a04e022396eaa93eed9d52234ef724de515fd16531008c0b23392ec
TLSH
T1FDF05C0B91CFE80BDF745FB161D5AE132129FFC41F171A2E85D9C598F1476B0858E250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b154550f326bbc96fed83b47ab5cd0e3baa0e29c5b2b5456ed60fbb5cdbd1af0
MD5 b5744bfd1ddd506a489ac23ed24b1f73
SHA1 55a74ae3e1fc85261e1a938c0f5cbed35dd967d5
SHA512 3c80828889a9f490d715ef41322f1dcff03eb1969af3bfa11609658cd084135bf85dbe88bf625fcef2f43975241ef6d11a3c02d73992ec4afffb928b7e227566
TLSH
T1E24188C3A6CDED09FF05D47095CAAA227534F5B60D1B2E3AD3C498FC52D33B06598256
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a98b4270ef8a72da04bc549e84f6067712b21cc031a98519319312e4eb0dc4c5
MD5 1a847b5da896b9ce4f5a3e7be47746f5
SHA1 9285e3a129fd617bd86a03888dcdc15f9fa71ab1
SHA512 050a3ffa50d4c595a9d2820d4d5ae3dacb78673087400b55f93caf7be44e1e6308171b899d02d849c60bbb925592b558f69b2a77247a17a35697d3f0b0956faa
TLSH
T1714186C3A6CDEC0AFF15C47096CAAA223530F5B60D1B2E3AD3C498FC52D33B06598256
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53087b6e30934ded0ab6e386d7b269b445fcb78e347b880731f1f987a1b228b7
MD5 ca63e2a35464d621d98ebb8d0d3a65f9
SHA1 4fdc20eabc94f1700c71f2764254fbf8d6e2dc56
SHA512 33905ce18a9432da8b928b5843fbb8faaa012e9f36d92120526ec87261f6da543a1186cf593ba33ee4f3324207654ffad394ed37a9cb8cae50ac19b1e2de6eee
TLSH
T183517687A9C8EE06FF14D03055CA69363536E9614D1BEF3B93C854BCA1CB3E0A44826D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5aba0b370cb494740712de37770c1f9b4ab009939445e59e49facd25f04effbb
MD5 5781246df0eed445465175f75d5f00bc
SHA1 f7037f2fb53819c112a9abc208831824c1b13b31
SHA512 a858258b7fcec40eefda1b45a9540071712c8d138a628940d2ba70108be5487c8e6169ae7c5aeda872254ecac99a043a7a9a2b17625efd8e0765ff8720d00129
TLSH
T13D71CCC2B5C9DF06FF14D43051C999323133E9654D5BAF7E83CA44BEA1C73A4B548259
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fff82fc5b56d2ed4288e148e141cc648552c4ee1b44ecc63d7044b7a684d2218
MD5 7b92ba98a0b3bf1ca0edf49724640dc5
SHA1 d461c7aaf7292d4e7cb3a4fbfda911b0c97a2efe
SHA512 ac522971ecb6413d115e1fb414f38afd1dfc4e0abe7251572a922f7585d60a85d6ea2595ca2a8056ec43307a76956d85cb55d78c3dd798e37fd45589db76d3be
TLSH
T19A519DF793E4C67D851196E4EA146E2FDE6D0A25131C7C62C9E4AE4B43F2972E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 87f84ebb7c93ad148f8172ea1de22e5f768e66cc5b68bf1233e08ffb6725edcb
MD5 71538c93669626182a43be661b3a0100
SHA1 8718b14ad3166bf2f21db864f52a64ebcc099c8e
SHA512 3f888691f547109b52fb7f07fc6b28b6d217c828669a8f9d6fff984302a6e5b33d141884f5a531a1167cafe1155e84628767b5d3b225af9ef17f6f1e3893a02e
SSDEEP 48:YALlqYqqhqjx9jcMUXYafo7zsagmzsE1fsqosEKsSNCxJzsVftsqzsk+sJks2Sgy:DHbEr4rIaav51f0INC4f9h3qViVlt7
TLSH
T1A8B18DF3D2E4D66DD61167F4EA106E2ACE290929132C3C66C9D5EE4BA3E2472D10074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 c238fafc802a7b023b27501cb981e8ee7acf0a99d4f96067234ed274240e54e7
MD5 79a1150ec18ac70e4dbdab25845f6c03
SHA1 e3fcfffd59cce3f655369672e7d6683964a3bd2c
SHA512 96e2af84fb73203c453f81f3ac935dfff20ece70fc1536a482ca6d41412c641a6efa2fc5ed891499dc66e3e639b051857f88b0b9331b597dd9de78577a57fff7
SSDEEP 384:D01MNMktiqZA+kd7el/WPqxeGEvXteL8keDD97IoEIaavZgqViVAIUlSkqutSI3l:jg48TOAr
TLSH
T1D5B289F793A4D6BDDA1166F49A146E1FCE2A0429132C3D76C9D8AE47E3E2473E10170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 53d7d7aa59f7ddf3672eb46a0ed3ea3ec249679f54cb72470e173a5bcd017f1c
MD5 324d56db13f84b3013c3483be8d7e882
SHA1 814b20864a54a2e50947441cafa1887bb6931036
SHA512 704777c8fa45c711ebe441136a35b8598bc8376400aa6e3a6c7695c850c231fff700ec18c6f90153d4a86970b0fde85d2375019664016e253a011e88f341b95d
SSDEEP 192:DHbEr43rxeBIaaviCjwqViVlJqcCVokzRCgI9rNP6:DHbEr43rxeBIaaviCjwqViVlJqcCVokD
TLSH
T1F5026CF7C3E4C66DC91156F4EB156F1ACE290928432C3C66C9D5AF4BA3E2872E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 820d968cb7ed071fbf9526f8df32ad2049e1ebc8325d97cc4e5e221d6f886abc
MD5 36262e152818c8d7afa766137c2518ee
SHA1 19652e92350f89c5d847ca28e6f09062dd7de89b
SHA512 e7b0168655fbf98f16c358e73e4b1eaea7820b3c053569c06732487ddb29df391a8066d3130d63874c6dffa484e9f1f7da333eddb64ed8308d9db723c4b151dc
SSDEEP 384:DHbEr43rxe5/GIbFveLlAo6BlCIaaviCjwqViVlJGUPOd0AsmvqutSI32rnPDr69:w+cgi
TLSH
T18F628EF7C3D8C62DC85166F4AB157E1ACE1E092853283D67C9E8EF4B93E1472E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 75271f36ff7a3356d65fd1004213ee13cfb3157f36b6d94f72e065655e4738fa
MD5 e532e9372feb72bc7fddedd31bcd6e79
SHA1 d91063c0f131e63d099a3b7fc5ae7d964c754829
SHA512 f84cee6fa684aee65423bf5876fb76315a77458ad107a12535fa318713c0f30b88ac6de43e489996273c686cf395450a11d62fc2b2463492f0bbfd7e14e120b6
SSDEEP 384:D0bwr43rxe5/GIbFveLlAo6BlanCKLe0zkS34UIaavZwqViVlJGU+mvqutSI32rB:4Vg4jOA+
TLSH
T1B3C29FF783E4D67DDA1167F4AF146E1BCE1E0529132C3D26C9E8AE47A3E2472E10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 8dd3d10743fe04ca8fa69946368753965429ba038e5f22e001b801e06e5ae8ea
MD5 6ff44646406a88f1f22592789389e25e
SHA1 b94386dbd1a70fc731f4feed325d6f2484522e10
SHA512 b45d509f882e98f48155e3bce505876261592caa37e562edbde6b074c62ba0c25e6a59a82d3647c4016ab1fb0cb59a09e1c6181d131bba8ddd3baad4fe338521
SSDEEP 384:D0bwMNMrxe5/GIbFveLlAo6BlanCKLe0zkS34IDsIaavZgqViVAIU+mvqutSI32t:AggQjOANC
TLSH
T153D29EF783E4C67DDA1167F4AF146E1BCE1E0529132C3D26C9E8AE47A3E2472E10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 3b28f9b2f60229951be2bdfd87b2b6ee2b805f5f942c5418b7842bb303afe593
MD5 b850ed363e98cead5f6a1024f31399d0
SHA1 fd43654cb3e3c69e077c39ec003452a1973ff622
SHA512 20ce14c1aedc3df8d57da6776b0cd032c17e1cfc52a702cb03873620f345cd55b93643179f0501dada5f855d7217ec71e48a16b1d80638e7045ceef6fafaee30
SSDEEP 96:RUx5hUN6U+ieUjUrUJUcUFUEL9UKUeUpTeUmU+wUX0UoUdKUZgU9kUpUUOU1UZUJ:RUx5hUN6UqUjUrUJUcUFUEL9UKUeUpTO
TLSH
T182A15AA7D3FEB81F206C48AB5D5578492AFAA8394291A4F5EF7B813D70815F32B12016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d8ce190af5c0cfdfea8a4d0bcd0b3bb99e37190c37c6f650ed287c06984cebb2
MD5 94fec50248f3c835be6dc0122be92ad0
SHA1 5c8d0e338399b7dbed35f2aad6b740b3624598cf
SHA512 8c5e3670b5a6401c17ba61262b43a90cac02356ae76cb09123159e52c0c352ee8ef2879eab03d6c179e5a59e3cf5943d42c205fa818a9862130d92d0c9a8f9a5
SSDEEP 192:BRvhYrsNDKgIcv7TpAPRp2A9bHsb+WNnTA06zOpykw3VyIsnAUgraJ:BRvhMMwI3UXrVws0UOpyxe
TLSH
T14B42C62EAA14753BACDBD229FE623B63D7F5202161C41E48E6FC8A3C11DB6CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7bb9751b26bbb4dbec8d475990f7fd2c22c72f814e1ada980cc1af6eb301fc0b
MD5 55c89c0a074352923dbdf4dbce7b03b9
SHA1 f07fc95f44cbbba1a992f577a47a059e56ae485f
SHA512 4e35ab8f2c3fba8d1d202ea026261e253fa153292a35076c3a2ab022e8433cf67c54bec0850d4970720d1d9d3a165352c0df0f0384899d891ac16fb2c19ba344
SSDEEP 192:HRzcBzPYrsNDKg0qv7TMxPRpZuOpuUo9bHsb+WNocqPao2WLj2QzOpykw7VyIsnb:HRzmzPMMMm3aXSVwMcy2+OpydvE
TLSH
T10A62E76EBA24693B9CDBC229F9627F23D7F1202561D41E88A7FC8A3C14E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8521fc41e81b4b87c22f159960fb080519a71f1b1ce2801c3e222d9e5601e85b
MD5 d6fac64eb333adb8064bb2be20e07b0c
SHA1 44bb2c21b1cde573925ca5fda4ec06e391a8641e
SHA512 cb379bc9c4c8267dcf67d84f0e92ec6745ad87a0094b184bca1736c8c5ff5b68e4763ef59152331ee351b072bb4431ddcd74e7a313a4c9cc429dba399aae2e61
SSDEEP 192:BRvhYrsNDKgiqv7TpxPRpZuDY9bHsb+WNnTAZo2enzOpykw7VyIsnAUgvlaJ:BRvhMMKm3bXdVwsnezOpydvE
TLSH
T16852C66EBA24653B9CDBD229F9627F23D7F5202561901E88E7FC8A3C14EB6CD2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 490a28188b3dc173ae1f759d209260cfc498b3f823a88c6cb298f7b4e9cde321
MD5 f977d5abdff7b4d300d44fdf0d90249d
SHA1 196fc0503ad107406b0663da1fb0b69694bbf84d
SHA512 9f44b1755191c344c4e57ac64d499d3a43d316159c6b4d759988ec0dd2c71a7f74896b210ddf692707b4bbe3c5c568f1ecd78d335a81871e3b5ce771d71b3145
SSDEEP 192:HRvhYrsNDKg0qv7TMxPRpZuDY9bHsb+WNnqPao2eczOpykw7VyIsnAUgvlaJ:HRvhMMMm3aXdVwaceSOpydvE
TLSH
T12752C52EBA14693B9CDBD229FD627F63D7F5202561901E88A7FC8A3C14EB5CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 86687565f44ccd4e59bbdbfa58c028e023529451594e46f99203c12f8e5c94af
MD5 f2452c9ebb7bd7fce53f0d9a836e4fe4
SHA1 9e5289944678b1ac46b568c371a666ccfc3d1740
SHA512 166eebed310cfc8c3bc4cae0756ee3a3698f8aad04498786e33367f6899aaa828932fd8db268519dc4e4f253ef9dfe8a74bcab191268c46a577d5599bcbfb5fb
SSDEEP 192:HRvhYrsNDKgiqv7TpxPRpZuDY9bHsb+WNnTAZo2enzOpykw7VyIsnAUgvlaJ:HRvhMMKm3bXdVwsnezOpydvE
TLSH
T1CB52C66EBA24653B9CDBD229F9627F23D7F5202561901E88E7FC8A3C14EB6CD2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6154b639ace0d8a43962804a61c0d103ead0fabbea40fd3720e67a778e1f1160
MD5 e0c5e68d6ce6c877e6c17afdd5b4ec38
SHA1 586aa39fe53837a9a962c3ede81aae6edfc0f667
SHA512 c8b3df14d4092f230ba3c031ab8d0b05fd61151c689fcb7cd14b75aad8f16555f8b77a7e2c3cee56caad45870c0f421eab545a318dd11a2b5a6a585a835169c7
SSDEEP 192:BRvhYrsNDKgicv7TpxPRpZuDJ9bHsb+WNnTAZ9r2qzOpykw7VyIsnAUgraJ:BRvhMMKI3bX4Vwsj2kOpyde
TLSH
T11D52D62EBA24653B9CDBD229F9627F23D7F5202561901E88A6FC8A3C14EB6CD2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 95b542af0f91df3bbf2ac01dca555d2fc013406086d15c34b4d44acf92d3e666
MD5 a7d7ef051808568f82dc5d2e10673c4f
SHA1 f4f15d359e2f8e7bbf7f60756ee927b195d21e1f
SHA512 d0d92835181ef61abfe190565656d2081bee017fdc5d6043a38804664a7c5f65d6c1bc1a0c93cc3ede8cfdf50bc03b2e19d4189aa76846ca4ab22fdd49f55c95
SSDEEP 192:HRzcBz6YrsNDKg0qv7TMxPRpZuOpuUo9bHsb+WNocqPao2WLj2QzOpykw7VyIsnb:HRzmz6MMMm3aXSVwMcy2+OpydvE
TLSH
T1DE62E76EBA24693B9CDBC229F9627F23D7F1202561D41E88A7FC8A3C14E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 110e87fda1e6e7b38f5b414c4de9b194bc8deaeb44b011d92595c559c9cf5e2a
MD5 758cfc9ac7e25c9bf32fc9dc340d5c9b
SHA1 46f1d9a8112f22ad9a81ce3e1f2aebc7cf850a8b
SHA512 94af87d99d77d299acf66b3057ee5b87f95fa4b05736cb8462f0c1cf396ecb9af75cd6c3d23b97a910221ebda855668a2b62ac018879da22791efabffae6447b
SSDEEP 192:BRvhYrsNDKgIcv7TpxPRpZA9bHsb+WNnTA0wzOpykw7VyIsnAUgraJ:BRvhMMwI3bX2Vws0eOpyde
TLSH
T14852C62EBA14653BACDBD229FE623F63D7F5202561901E48E6FC8A3C15DB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a6bed0492bf3de114efd25d6895c27e9ed7a25e4b930dda750c095e1a7c57d06
MD5 5024af4371785e256ca94146f45002aa
SHA1 16b04cd1620636ef183f2c6767eee70a8c62660c
SHA512 55e02d002dc670092553a49b24923d29eb400282ad8a2578c275ed76273c225c017a63e2c16e844f6d9413051b42bf662f08fff16093f4fd4ee80ecd938ddb7c
SSDEEP 192:BRvhYrsNDKg7cv7TpAPRp2A9bHsb+WNnTA0czOpykwBVyIsnAUgtaJ:BRvhMMzI3UXrVws0SOpyH8
TLSH
T19142D62EBA24753B9CDBC229FE623B63D7F5202161941E88E6FC8A3C14DB5CD2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ec54d739923d7f925a456700f80d960c18a2502152f687f9575dc7fa0e10a47f
MD5 f8bf7c7abe00470f2565c8584855161e
SHA1 92acd966ec00d7b7bad24edebf78a406ebc074c2
SHA512 2d14b64bdd3fcf1d8da176d3116a7086dd770c9c9d0e955b061a8271529309e39673d7aab22c98dc831cebd19e7b999bfce8cfa5361af2b7029dfddd536becc1
SSDEEP 192:HRycBz6YrsNDKg0qv7TMxPRpZuOpuUo9bHsb+WNocqPao2WLj2QzOpykw7VyIsnb:HRymz6MMMm3aXSVwMcy2+OpydvE
TLSH
T11F62D76EBA24693B9CDBC229F9627F23D7F1202561D41E88A7FC8A3C14E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e474679b01ceb416e404f43b3a2c7556b11d4113970ef36d7fdab8a919e8a965
MD5 c06c4c9b408e1fb6cb7ee5b158e3e169
SHA1 d54a8cd6b1ba21f3abb874f1d19781bf53deb8e4
SHA512 0c724f7db9d53169bcaa7b4ebf3060489418b3afa798e57d31bea54a54c799315ba4e48fb3012d61606f652de5c7b0cc41c256584d4dad1dd9bd30b1667daf7d
SSDEEP 192:7RzcBz6YrsNDKgjqv7TMxPRpZuOFuL9o9bHsb+WNUhXFZo2WGsWdzOpykw7VyIsb:7Rzmz6MMbm3aXRVwynIWNOpydvE
TLSH
T1AD62E76FBA24693B5CDBC225F9227F27D7F5102261901E88ABFC8A3C10E76CD2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1869c5bb1c17fd0f5e92ff760e1aa5fa858d0ef6d600f11a4b88bbb1f1c2b75d
MD5 671fd9a8060321a3e972d648ec199419
SHA1 4cf5bf0777231a70563f91a569f8c6021a69b118
SHA512 4f5dd5cbc2fbb0bcaf0090ccb22730d4643f08b7cdf670f9ac3dabe5e98b91655b22b02f22d057d28ed6785eaecdef86f077344cec236869bcce8934a4419975
SSDEEP 192:cRzcBz6YrsNDKgCqv71MxPRpZ2pOFXL9o9bHsb+WNUFmiHl517zLo2WGsUvVoQz8:cRzmz6MMqmZaXCVwMN7JRI+o+Opybvs
TLSH
T17772F96FA924693B9DDAC225FD62BB27D7F6242191D41E88E7FC8A3C10E76CC2117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 0ad95d9c8deb846a40ae47e3b49647c2e67d279ead399e98a00d0a4f08541cf6
MD5 2cf492268db689e05c8913dce79051e3
SHA1 cb1d7d2576c6eb7bc81445afa12591c5493db971
SHA512 c2c8370e2839d3ee9aa51be2c9c6b0fae1aa853f26ba772e9dd14d6d579bb281426c6f96cd53c421b3475e5a974ac608566ae8f4e11d17a3824b6a99d7c0e855
SSDEEP 192:cRzcBz6YrsNDKgCgv71MxPRpZ2pOFZxH9o9bHsb+WNUFmiHl51vwFo2WGsUvVoMg:cRzmz6MMq8ZaXyVwMN7+7I+oiOpybvs
TLSH
T17772F86FB924693B9DDAC229F962BB27D7F5202192D01E88E7FC8A3C10E75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e05e419e57b2f46ff245bdee922db54661cf65ac08b23f71029900b8f733aeaa
MD5 6b4efde2b8dcab0c4d6815dff468d151
SHA1 ab80ff7b05d96729a3e7fe1d52b69289ec0a482d
SHA512 f0299bc37f3e42ef7246cdb5d7bf5e16fac4e4106ce62868a97fa3af8856d72a4b48edb170ec060bb009620028cb8c7350557e6bd19fceb18029b9bce043cc3d
SSDEEP 192:cRzcBz6YrsNDKgjqv7TMxPRpZ2pOFuL9o9bHsb+WNUFmiHl51o2WGsUvVo6zOpyb:cRzmz6MMbm3aX/VwMN7rI+oUOpybv3
TLSH
T12972F86FB924693B9DDAC225F962BB27D7F52425A1D01E88E7FC8A3C10E76CC2117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 bd4a51c7cbe091fae27499a8d15a793817abc812cd7987f7c7d59d797908a33d
MD5 aaca0a1e8e92fe2dc18e26d0e5988098
SHA1 a506d38454255909bd0799731143a253facab758
SHA512 3041deca413b0cf06329893cc7c8930a7bb0703c68446bfdaa9048d7779fb2ef978e99d03614891ccbf033eb3adf820a17696c8b66fb35cafd550ee60737a055
SSDEEP 192:cRzcBz6ersNDKgClv71MxPRpZ2pOFZxH9o9bHsb+WNUFmiHl51vwFo2WGsUvVoMg:cRzmz6CMqVZaXyVwMN7+7I+oiOpybvs
TLSH
T11C72F86FA924697B9DDAC229F9627B27D7F5202192D01E88E7FC8A3C10E75CC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0e11e2cbfed0fe61def4d5dcd2ba1920c396e023faf026c274d308e1575e2bf5
MD5 c63c3cb087a2de0452fa72abfd721caf
SHA1 5412f9fd41ce8854e57b9987065f34e5902a6976
SHA512 5cd7a5ff8e370f4760b062c8f0e422e8e6f74096dc12e1addf485359b9a51be6865f4c78a5289f98dff2871c559c20e5726954761e0daedc2458f55d38dcf2be
SSDEEP 384:VHjJc7KxkXqKf/pUZNCgVLH2Hfgslke7pLuLcifD+XODJE+ErU33WHG9EwF/:VDJc7KxkXqKf/pUZNCgVLH2Hfgs6e7pM
TLSH
T18B7209A76C4C9A374F94C68CD816BF4F9DB5024B65ED886883FA981503D5ACB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 164KB
SHA256 3c2ebc42045da729104fce0b3f34a61792bd4cfd7f42e438c812bc8f64064f7f
MD5 8caf2ffeb6cbf09cd956e28223f5b42c
SHA1 bbd2859e64a4f975806d27f87a3aacf62f90e7bd
SHA512 1db8903fb7034d5dc1788fb0357e246a01a5c2b6439837897a702e675e5881bdcb5b3d4c1adca4d76dbce39486f18f24b9cdf333d89e4e470f547a36b6a8fec9
SSDEEP 3072:+Qe+sswSjnxPCA1j6mLv15N/HwiHvwRUtxm1KUnC1PtTq:+csswip5JwCvwRUF5Pq
TLSH
T179F38246D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Size 238KB
SHA256 c6d11facbe0e2f4d7e1cc10b8714dcae1c273a53a995968357ff7b11cfc3337a
MD5 c379dddae9fd5352a5bb48288d1081f3
SHA1 c5016d22580ecda601abfa5cad743727f49962c2
SHA512 d425ae20ad0299fcbe2c7c74eb03fdabfe8ad4829aa50b0367956942da939a2669589e3123d351126d7b94c73ca788ed982bb23b4148c66074ad1b731d063565
SSDEEP 6144:7bL98hpeoxxJOvJ4HgpdsceFWb/1XMLsU:U504HgpaOb1ML
TLSH
T176343F8A6326137FDF3943B95143BE5123210140AED3C1C6334A5796682EAD7B6BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f18e8919a2a9cf4376b44748d491d946225e4b477272fc694106f8d3101fc28d
MD5 aa9eddef9476bf9fa1af41804581ad09
SHA1 cc9d96dbf003e22df775f2800b7e2c02aeec1021
SHA512 116a0c3a7d7189c5698466bb232c4ed1afad852f71293277e0652eb4763791296fdd77da4b0765bcc6496f4b1abfb9c8f576425ce7574b70cf56263583bd512e
TLSH
T1D1B01214C0029941C08302F01383148C31149F15D705330553F469B1D8271E141285B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 1a44db412f23b51fee95da94c008e6d23ae6077cbc085b56cfefab583be1a3d5
MD5 74eb9e9827626a734ecf3742616f5e8a
SHA1 600e5315dbca598804793adb6c7d5b9a2873e1da
SHA512 0401e91cf29c6634cef715800c7b55dc0f4dbd8499756770dcb36c9c59864657332f002c0cbd206d4cf1aae69d9804f9b771943f2248d22a3090f9907da6ee49
TLSH
T1B6C02B12C600F010C0E503701556555C36408F3D9B0103400794752588352100038119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 2ea7a533faf0ba70cd981515a9b0f08983cc43a4b31436170dad05cb59ddbef6
MD5 1abd7464b11dd81859e957e7203edac1
SHA1 37ea7dbc57a6607614171f007a156cf9220ccba2
SHA512 b0dbd3eb189a9600e936a921e9036b32b4c70f0cd8a879d20820a87f355806031ff36bd9a4b5eddb4bf22b5a7a8d8b3c2f8d8706e7ae2cefaf925d9cdf34e859
TLSH
T115C092128201A022C44A83B415968898A2A89E29DA06074862A0692AA87592182652A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58509c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58509c.TMP
Size 96B
SHA256 09d2fae44be37da4fbbb3aee56d0fee73c9ae26ffd3ba2deeea5f45e9f35c993
MD5 0fed256b8f5f146cb043a29bac285802
SHA1 955b964e80abacdc3220cff783722ee06b42a6fb
SHA512 741141606d91dd8ec38e1159b640dfaf701e115678c6f92a27f3799920e0f3fe102740a8f75447302cd31f93787363cc6e3e7a57b5670b902c3082caed502934
TLSH
T1CDB00255C607F212D08263F06599B5EC7160DF25C603521296E01BABDE356714536161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 13c6b6f55af60b47483d89b10fa0629cbd2c0d571d21e67412dab8f5e7e5c54f
MD5 5f12e0b21eafe1d39a9af8d0016e324e
SHA1 d25ba84406f946f9b106e3a4cf392aed1bbd3327
SHA512 4754d90aa3a4358e1cd666e8cdd311c4baae873fb9f5a6409e024110e2ae7f026dce8014988db54b01984bcbf8284873290f5994b32e352fdc6011ab5b3babb3
TLSH
T135A0029126E85D01C8808371239115D12314D8100F559A1394A1408598AA34751A5320
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 27af238ed2d8ba7f502f66cdc5b43fd3be1175d3334bc78c57936f15ca4fc61a
MD5 61815297389bbba49d1af55eeaeeb8d1
SHA1 494eb30bca942ba7ae9b6d565343a89fb52cd683
SHA512 1608c73f012c348c86fa506d5495e8b95c0f92b9c8c8edb920860a3bae964047988b4adbc808806deafddea8ac98fb0031c34b9df597040bfaf889c51c0a6357
TLSH
T1C4C08CF30A51404B0B30EBC83018719DD50781084CD8CCEC8408801A2438E270182639
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c21b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c21b8.TMP
Size 157B
SHA256 0577dc55de5088a74d1f655c8bb69116542a5630616cf84249079eb14eedc7b0
MD5 ea47fb597e96dddcdc83621cebe01ea6
SHA1 c5f0b28a8e5762055c7a553170605daa72d07391
SHA512 94182b19ace6f04b12b67e6c580df6e74b3e41238b29e8570d0c82cbfc0b6990b925112b0d4bd6b0d24653b0132f0450c71a009ede5a8d1d4e5717d66c04650e
TLSH
T1C9C08CF30A6100470B31E6C93028718DD41BCC484CC8CDEC900AB01A3038E274141639
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\4664c383-4c7f-4e19-8d08-92d7c99d8a09\index-dir\the-real-index
Size 168B
SHA256 7272ad8300c7facfbf03be3a5e1a13c473b03f618560df15a8bc0b831bc1d48d
MD5 2d13ef26397a1f6e5d4495fd34a5f083
SHA1 080567863a357f29666cf8343589476bfe50b3ee
SHA512 fece95ce8b438f5d747058e78561c00a04cfb5dbf9b5425b473440979be69f2d87e022fb2119f3de5179ec049e87ceaeab5215ce818144e3297b9c1a6a044049
TLSH
T189C092ACE8A05780D26001B094AA03A673380F54FD44881684DAF2A9B08A6AA89F307C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf7f4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\4664c383-4c7f-4e19-8d08-92d7c99d8a09\index-dir\the-real-index~RFe5cf7f4.TMP
Size 48B
SHA256 5542352593cb4cb51939946ff07441c7b46ddc843efa97141ae26090a07f2308
MD5 a5afb3d865550d667daa052df13b0538
SHA1 8b346243890363ea928ec5bc095913bfac93685e
SHA512 c53b80433b758d7aa2fdf7c834f88ae05ac954bb649dffbd454cb558b0bb4675d91f7afcadf150b57529bab98caef317af4a92dadcb701ee3f9165a8876fdb27
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 79B
SHA256 45a81bd4ece414b090d92cfb71c4c25422b8e905f34886d201f2d36caa401933
MD5 42931fc71a3e019fd00c4bf1f051b512
SHA1 cbdc68951a535dc928a262213328e0e054d4d680
SHA512 2020260303f08e7e11535d5f168a60cd70dcac8633147e1499251d031badb5c7c0766e16e65d40dcf1382776565abeb12c22c2fcf61af7fd3b7919c514cfef20
TLSH
T1FAA002FB1805948A4F70B9E9B534F79DE14B928C8CC0CDF5C40A91566539E369492820
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 160B
SHA256 8faf1425c0a4d80b560f2c769b11fb97622eb11c721d511c4e54ae152cf3e146
MD5 0b43fb097ed0d27335359613ef459da8
SHA1 bb5513c07eec966e5c82b4a12ba5aa86911c09b5
SHA512 29a0259b20a54cd88a3a1fbff73f56492497e60e01ae5c064f427a6dbbd31423326ee60be0c01e4e172842590a81659f5a6727b0a8b2682dc20bc73010bbbde9
TLSH
T143C08CE302240C860B3266CAB020B68DC1878C2C4CC1CCE6840A30167474A13F590434
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 154B
SHA256 64f7ffc13c7db8794fd05529e5f2d5c23f63bafd9b812f2c0ce9b890b73efbc1
MD5 2e1448be235b0218cc16f34e4adb8ba7
SHA1 cafd001fc8c01fa4124ef5f6ead4721c8c494b61
SHA512 0f66427af08d93992f6b383a77d01f2f8d49f6ffe5ba4815d09ced276efe07271f36e15ab150932ba14807af9c05fe7e86657139852f05d288e2ea7606d0f3ab
TLSH
T12EC02BF302244CC60F32B6CE7020BA8DC187842D4CC1CCF6840910167474F13F4A1834
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5cdeee.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt~RFe5cdeee.TMP
Size 163B
SHA256 de967e108ff5f650c23dcf69d65d9ae55539cee9522476d4d8c51c13876a4220
MD5 bcce2e7de0e1fd4314e29f096e0ebddf
SHA1 7b929221157409bb72c59ba8bf5d3cae34c5c4f0
SHA512 451e410b5a4c6c5bff97bade5b1cf4fe80740d8d835f4c45cc780f01a1857fe4648b246fa6f1fdb502017bffae2cb336f1e95805cb961c506c3d1fdc433ff9ec
TLSH
T1FBC08CA7A63194029B24B4E4B834729CE2635E1D8CC0C9E58886B0A678B8722C402A30
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\IndexedDB\indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 f48dccfeda45ffab1a0c9b4f62d61508069d26948c506e9545aa9662db79bcc9
MD5 536f6a1a6f53570bb0fae075ab5b58e5
SHA1 661d82eee05105db615c470be635c773b0dc6c70
SHA512 e4f7e5e6b99bd96365ef971eb4d71e1ecdc3faf3d67374877b481aad690c21057e3bb6c6aa21a19134147d3b81013168301d00de0f07e9397c85e23d8a61bab1
SSDEEP 3072:EzyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:EzyEn/ct/gwWNalOozCuZuGnj
TLSH
T1B5141260AC732765AE5D906D601A2C33D9DD2E5AC0684DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 64ed484ae33d28c51bdac8a6317d75bd96b86b4a15a6ba2601c5a386a511153c
MD5 e7dd5242d094b4261916cbc495e4170a
SHA1 96e30e5ee67effce541b37f86a0c19e85adec767
SHA512 3ddf594639b71d3ebfd605720774b8e4487fa8dcb41f7268a43063960bf8fd54209fd9f7573e92a56e4f9b04d3ad7bccf29659e0d7129e2374be0e8da797da39
SSDEEP 3072:hzyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:hzyEn/ct/gwWNalOozCuZuGnj
TLSH
T177141260AC732765AF5D906D601A2C33D9DD2E6AC0684DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 189KB
SHA256 ab4851fbdc84243fdd244b7f1ee6fe17b5848219d2bfd88f46ee2647d9beb8ca
MD5 b9e51dd598be0d350c9263a1cb65ec89
SHA1 51cd640cc5888f87bc0a54e3283a81ad1965ac2f
SHA512 1a6b1da613e87217d24fe57a4f94c3a836b0a2c8d3dc37590059eb023dc9125592771b7096c3118a8040d19528b5e46357d5253e375cf720499149e0b2223e28
SSDEEP 3072:tyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:tyEn/ct/gwWNalOozCuZuGnj
TLSH
T1D1141210AC772766BE1D906D702E1C33D5DD2D69C07849F6A7A42F6B82A8F0CC74DE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 68f50d8871d91ba7d3c58cbb68d357536273c7ca864a0e3fcbc57582ac7a6e1c
MD5 2ef52115a5e96423385b15ef7fa91fa9
SHA1 d82654a355e8ca4b6dd22afe0cf8865d0e2b6cd5
SHA512 6d158068aa80e4c3b4f922a778db662ebd07e6aea8bd6e107d57fd57283c816bebd031a704a727806b0c4628478cc9f87df1fcd04d2167ecf75ff1a8afcc4b5d
SSDEEP 3072:0zyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:0zyEn/ct/gwWNalOozCuZuGnj
TLSH
T10B141260AC732765AF5D906D601A2C33D9DD2E6AC0684DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 85KB
SHA256 d5998bd5fe0b6aa232628e0843bb2af6ad73324dd44dd207059a6e489074de58
MD5 78a60bc07c14490987fbf2861cd66a03
SHA1 0e6fdb44d4dafd55e0d15bdc503374b36cedf1ea
SHA512 29385d9035990f4aecc6070d02a99a5b4d72edc177bfd77afa72717f95b9fd84e50ce0df3c1744105948108ccd4cc9077fac2d53087a7518b1ea45aae99ca034
SSDEEP 1536:vvb9YWQn+F0DowGIBSnu3lfRHGKgxVAw8wgvAmyzCT7O:l0crICu3dR1uGUeO
TLSH
T19C8302259EB7133AED1DB199B0176E23988D74A4E2044FFF67E02F27C291F18C749A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 189KB
SHA256 9c0750e2a38b441d7729304cecc3cc3a5459502c10a6315cb9066c8a57a88142
MD5 bc31ea8c3810123734f9118a522c4f0a
SHA1 b113a083ebcc377db5374f29edd7dbe4eea51467
SHA512 6942ba247e1678039f73f2af59ff8c31b45d8c0b95de9901a0d935f8d86024c454b8187e17fc04a4bdc0065b28ef2afb929a20ea399c163aafe6cc6fe08af974
SSDEEP 3072:iyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:iyEn/ct/gwWNalOozCuZuGnj
TLSH
T1EF141210AC772766BE1D906D702E1C33D5DD2D69C07449F6A7A42F6B82A8F0CC74DE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 7f5f93d85b5871558a4fda070b7686b9f46e983580cac06ead0f228cf4ffd41b
MD5 995ce4f6d11370e0958650ce026ac8b6
SHA1 bb55aa325869b7d29987987bd13e7c8688ae9945
SHA512 c8c7e644b5b72d6c68807f60647862e1ff84b02c3d6946d2cbdd44a7c379595bd8998e95fb98300e7d5edc1a3f35aa80695df2d0254eca94868f1559f29444c9
SSDEEP 3072:vzyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:vzyEn/ct/gwWNalOozCuZuGnj
TLSH
T1A2141260AC732765AE5D906D601A2C33D9DD2E5AC0684DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 13be6d897dc58ca06b56517142390ca9167de8fd43bc84067899d57cebb2bff2
MD5 f9067b099307ba2daac5420fe43dd4fd
SHA1 ac1b1d00b79bab06f635042f44682c23dc695393
SHA512 42fa98e9510b80ef85c91add634acd2995752ec04532af5e69e291840c3eb217e74de868fa62ecbf9d1dc40b284a9c57de047a418ae160e92b3c7799eafffa53
SSDEEP 3072:xzyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:xzyEn/ct/gwWNalOozCuZuGnj
TLSH
T16F141260AC772765AE5D906D601A2C33D9DD2E5AC0284DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 190KB
SHA256 a0a0f1b65f37dcd0d8d89276a2c7945635eebe437b0c4383ff08477656a6a231
MD5 d1258260a61d8795fead0c6c4868e3b2
SHA1 6656c0114bd899f60a4226201aae257dd2d1be3a
SHA512 6a438b7630294ff0944100d0f1ed934eded1ecaf0974eff62322a5772c37f3439152877220cd44b853ec82aaf0d3e189a7d7aa10a9d9a39132bbdf5726b2e3e0
SSDEEP 3072:BzyES3ahl/ldBBU/td1gB6mnNalOnNTqBWB0crICu3dR1uGUej:BzyEn/ct/gwWNalOozCuZuGnj
TLSH
T130141260AC732765AE5D906D601A2C33D9DD2E5AC0684DF9B7943F6B8298F0CCB4ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 9fc276c624f47a6a467db7947aac3fa6147a13819c5cc650a0c3004f21a6b528
MD5 adbc1b7db5ce0c8b7c97a3c6472fbb59
SHA1 c1ca75d9405ba4296712a6879fb76bca77339261
SHA512 93e4cc3e344fb05d35019def806642c0ee07e4ce914b0df622f7b24e91de0bf26056ac7e8b8869d2213ed9df7b2b3a60c6f707ef247a1d0729088780a63432c8
MD5 SHA1 SHA512

Submit Download

CrackZenith.exe

Path C:\Users\Admin\Desktop\ZenithAlphaCrack\CrackZenith.exe
Size 207KB
SHA256 fc9fa03fcef78c4538bfa774ec940056312852bd4d07b803113e0e94347dabf5
MD5 da0b2f30c8c99cac773830277504288e
SHA1 b40d3759ae7141b8b3871e648544c3d429723795
SHA512 9628cd7fdd2504a99e4f8acd7091bf8ba049213c07a678d0c0a8b0bf59a5602e9cf314ab3fe375d9f5f3b81182dc2e4c9969cd86c7f90b95e8551ee68bc1e982
SSDEEP 1536:EeD8rUtxpRl2LIRYlnNrZJGjMATlf4yzKz/s2FO18osYADBJzBBAAjl27j9T2qE:EeZpRlHRjxisOaODBJzBz2H4qE
TLSH
T14D24A529726518B2D5B7C07AEC42832ADDB07056033DA5FF92C1CDC97F217ECAA38A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minhook.x64.dll

Path C:\Users\Admin\Desktop\ZenithAlphaCrack\minhook.x64.dll
Size 23KB
SHA256 94220672b615c8bfb55e26acdc7c19931cb21d46b5cb8e7a48a21ecaab6873e5
MD5 c07e905528e717d5f155ad259d3c8d06
SHA1 6879d2c242f1e5bbef02a76f5ce105521612f80b
SHA512 372f07f84f9257689fe9ca6f0c5cd96d34579ce34305647fa563be0e6a53b2a2bb25c7a062fc4360ad6566e4c50cf91df3a262a46a9411d462bc64f3a4a4ad8b
SSDEEP 384:KUy7VTTlf0RbStiW5fmGAu7t1zJ7dHbVUXK605Q9RdxOGofP8LW:dOlfasjAuh7HUX+qRuR
TLSH
T17CB25B59B76408EEF86BC034C4A2065ED2B27A252B11D7DF37B252690F937D3163D702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zenithAlpha.dll

Path C:\Users\Admin\Desktop\ZenithAlphaCrack\zenithAlpha.dll
Size 222KB
SHA256 e21be912b68210ea9280867c32add5b211faa2cbfb3234279d678ff266d5e8f0
MD5 afbab42819d2f7652be32a340e69a951
SHA1 d6ea45c2eb01cf9a0f4f57d0bc62dfc07a2dda86
SHA512 2b9fdb119d25a477b8568158a3bbbc32a82ae8849d9e5f7a742be24475e6f2f934148ad2e05dc49d24a6fb2346a3fda0d1bb3be08e4d0b81aad851e306701483
SSDEEP 3072:h9Ejzzmg3oKHUxPL9eHljH1tXRbBbRvpUVnpHMjrbMZ:Yzv5oReN3FBEGu
TLSH
T178248D19BBA54C7AED678079C9534906EA727C410BA0EBDF03A04A96DF2F7E0473E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zenithAlpha.exe

Path C:\Users\Admin\Desktop\ZenithAlphaCrack\zenithAlpha.exe
Size 32.5MB
SHA256 5ba2e6fcc2fb172ef1c37d87976e6c27bf9e88dd789ce3310847b03822aaab28
MD5 9718ea87002801c70bbf959b8a05d486
SHA1 e85b0a9acfe6a980c5ce7cd2dfdfe406fcb91649
SHA512 fa78a1b6a75bc913b63aad4575e793196df1114f42e0000cdfba47e9bc22f86fbd43197f072867041f13709ac38ac5304a503de9b64ef0f38ed0b7aa54749755
SSDEEP 786432:BH1QI3qmdUm6r1STJDDWGUUCO/NN610aQ6yLpGT3J:BDHx6heDW9I2056yLqJ
TLSH
T12077336F6DD862E4C0C74624D74F47AD21E2957901AE181D3AC73C027B32F9BAB4A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zenithAlpha.py

Path C:\Users\Admin\Desktop\ZenithAlphaCrack\zenithAlpha.py
Size 68KB
SHA256 c19679e28d0c99106ea047f01f3ff0472c0962f81a2fad00c9f4dbfdf4fb6c4c
MD5 7954601eaedd53ddf79f76537ef882ee
SHA1 e1b2cf0bcdf71e2f2c11339a7ba1c8e99652b65e
SHA512 b5df601d5685328769d1f959fcbce1d747c7157a22ed8c88ada4a1a8e3696428e133c143eacec3a3b140a7c0cdb6572c9df23fa29dacccc34b677b0fa926daca
SSDEEP 768:P/ToWtnZK/+Y/T6WDEAzVaRK7P9jYZ7AeBRB:P/TH2/+uT6WFVz7P9cAeBRB
TLSH
T1E8637640DE9001AD12735791F011B1E3A350E285599EF64EF9B8D30DEFBBB067A46B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 348503.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 348503.crdownload
Size 3.6MB
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3108-446-0x000001BBAC960000-0x000001BBACA2D000-memory.dmp

Download

memory/3108-447-0x000001BBB1FE0000-0x000001BBB1FEC000-memory.dmp

Download

memory/3388-429-0x000001C01D840000-0x000001C01D90D000-memory.dmp

Download

memory/4440-188-0x0000025F56A00000-0x0000025F56ACD000-memory.dmp

Download

memory/4440-65-0x0000025F56A00000-0x0000025F56ACD000-memory.dmp

Download

memory/5460-456-0x000001F243F30000-0x000001F243F3C000-memory.dmp

Download

memory/5460-455-0x000001F23E810000-0x000001F23E8DD000-memory.dmp

Download

memory/6112-1310-0x00000225E6940000-0x00000225E6A0D000-memory.dmp

Download