40809fb5ebb51fe2aac8a25a087bd77583c0ce904794ca676eac774033e99dd0

Analysis

user interaction
yes
max time kernel
712s
max time network
713s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stckz engine.zip
Size 19.3MB
Sample260508-a5kdqsct7x
SHA256 40809fb5ebb51fe2aac8a25a087bd77583c0ce904794ca676eac774033e99dd0
MD5 766d17b25233354867fab6038f1f3911
SHA1 3a97217e87e1d87b272facd1bb6ffde7573aeac4
SHA512 04805c72b8ab74c25d08942532ed835d5a7015b86562131152eae8564a43fa77a97055676a4074a174eaba724020e0cda937ea820bcff74583f590326a2b5abb
SSDEEP 393216:lVpnSIooW0ctP35jAXw/F2avIeRpA7Qx5MVwNJ2OVaom6jU2pQzJOOQZP/:rpSI3WRgoC0rowNHPhjUGQ1pq/
TLSH
T101173374B5DA1E78C8F055B16A92839D4E31B0F52628C2802F3D7AC67CC2D98EF97749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
153	5956	chrome.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\WINTRUST.dll	stckzengine-x86_64-SSE4-AVX2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	winrar-x64-722.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
2664	winrar-x64-722.exe
1692	uninstall.exe
5828	WinRAR.exe
4180	WinRAR.exe
3340	WinRAR.exe
5956	WinRAR.exe
2516	WinRAR.exe
3772	WinRAR.exe

Loads dropped DLL 1 IoCs

pid	Process
3196	Process not Found

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\ncryptprov.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\wbem\wbemsvc.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\UMPDC.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\fwbase.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wbemcomn.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SHCORE.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\win32u.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\combase.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\WS2_32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\gpapi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\powrprof.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SETUPAPI.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\iertutil.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\NTASN1.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imagehlp.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\VERSION.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\WINMM.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ColorAdapterClient.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\advapi32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\Wldp.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\twinapi.appcore.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\WINSTA.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dbghelp.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\netutils.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\cfgmgr32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dwmapi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\textinputframework.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\CoreMessaging.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\usermgrcli.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ncrypt.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\psapi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\DWrite.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\WINSPOOL.DRV	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\XmlLite.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\FirewallAPI.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\Windows.UI.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\RMCLIENT.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\wbem\wbemprox.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\amsi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ole32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\USER32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\WINTRUST.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\profapi.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\LINKINFO.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSASN1.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\DEVOBJ.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\OLEACC.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\perfos.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\tbs.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\cryptngc.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\wbem\fastprox.dll	stckzengine-x86_64-SSE4-AVX2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\profext.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\advapi32.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\Windows.Storage.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\combase.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\DLL\iphlpapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\secur32.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\msasn1.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\powrprof.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\CoreMessaging.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\twinapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\propsys.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\cfgmgr32.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\Windows.FileExplorer.Common.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\ngcksp.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\shlwapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\iphlpapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\winhttp.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\oleacc.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\oleacc.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\OneCoreUAPCommonProxyStub.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\UxTheme.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\ole32.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\twinapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\d3d11.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\dwmapi.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\winmm.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\DLL\sspicli.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\Windows.UI.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\cryptngc.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\msvcp_win.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\shcore.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\ColorAdapterClient.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\d3d11.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\rsaenh.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\optimization_guide_internal.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\msvcrt.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\msctf.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\FirewallAPI.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\DataExchange.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\atlthunk.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\CoreUIComponents.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\perfos.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\CryptoWinRT.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_elf.dll.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\crypt32.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\userenv.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\DLL\sspicli.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\WindowManagementAPI.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\InputHost.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dll\RmClient.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\usermgrcli.pdb	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\symbols\dll\linkinfo.pdb	stckzengine-x86_64-SSE4-AVX2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll	stckzengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\COMCTL32.dll	stckzengine-x86_64-SSE4-AVX2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	chrome.exe
5080	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226750571438449"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ProgID	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\odopen\DefaultIcon	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ProgID\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}	OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\FileSyncClient.FileSyncClient	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\FileSyncClient.FileSyncClient\CLSID	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}	OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ = "IFileUploader"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID	OneDrive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ = "ISetSelectiveSyncInformationCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\FileSyncClient.AutoPlayHandler.1\CLSID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ProgID\ = "OOBERequestHandler.OOBERequestHandler.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe\\1"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\OOBERequestHandler.OOBERequestHandler\CLSID	OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\TypeLib\Version = "1.0"	OneDrive.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5192	OneDrive.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5192	OneDrive.exe
5192	OneDrive.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
212	chrome.exe
212	chrome.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3340	WinRAR.exe
2516	WinRAR.exe
3772	WinRAR.exe
5148	stckzengine-x86_64-SSE4-AVX2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
5828	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe
4180	WinRAR.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5192	OneDrive.exe
2664	winrar-x64-722.exe
2664	winrar-x64-722.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 3308	1328	chrome.exe	110
PID 1328 wrote to memory of 4456	1328	chrome.exe	111
PID 1328 wrote to memory of 4456	1328	chrome.exe	111
PID 1328 wrote to memory of 5956	1328	chrome.exe	112
PID 1328 wrote to memory of 3184	1328	chrome.exe	113
PID 1328 wrote to memory of 3184	1328	chrome.exe	113
PID 1328 wrote to memory of 4928	1328	chrome.exe	115
PID 1328 wrote to memory of 4928	1328	chrome.exe	115
PID 1328 wrote to memory of 5276	1328	chrome.exe	116
PID 1328 wrote to memory of 5276	1328	chrome.exe	116
PID 1328 wrote to memory of 4268	1328	chrome.exe	117
PID 1328 wrote to memory of 4268	1328	chrome.exe	117
PID 1328 wrote to memory of 3588	1328	chrome.exe	118
PID 1328 wrote to memory of 3588	1328	chrome.exe	118
PID 1328 wrote to memory of 1044	1328	chrome.exe	119
PID 1328 wrote to memory of 1044	1328	chrome.exe	119
PID 1328 wrote to memory of 5292	1328	chrome.exe	120
PID 1328 wrote to memory of 4888	1328	chrome.exe	129
PID 1328 wrote to memory of 5308	1328	chrome.exe	130
PID 1328 wrote to memory of 2392	1328	chrome.exe	131
PID 1328 wrote to memory of 2344	1328	chrome.exe	133
PID 1328 wrote to memory of 2344	1328	chrome.exe	133
PID 1328 wrote to memory of 4724	1328	chrome.exe	134
PID 1328 wrote to memory of 2664	1328	chrome.exe	138
PID 2664 wrote to memory of 1692	2664	winrar-x64-722.exe	139
PID 3664 wrote to memory of 3752	3664	chrome.exe	146
PID 3664 wrote to memory of 5080	3664	chrome.exe	147
PID 3664 wrote to memory of 5804	3664	chrome.exe	148
PID 3664 wrote to memory of 5804	3664	chrome.exe	148
PID 3664 wrote to memory of 2064	3664	chrome.exe	150
PID 3664 wrote to memory of 2064	3664	chrome.exe	150
PID 3664 wrote to memory of 5988	3664	chrome.exe	151
PID 3664 wrote to memory of 2256	3664	chrome.exe	152
PID 3664 wrote to memory of 5988	3664	chrome.exe	151
PID 3664 wrote to memory of 2256	3664	chrome.exe	152
PID 3664 wrote to memory of 5916	3664	chrome.exe	153
PID 3664 wrote to memory of 5916	3664	chrome.exe	153
PID 3664 wrote to memory of 3220	3664	chrome.exe	154
PID 3664 wrote to memory of 2568	3664	chrome.exe	157
PID 3664 wrote to memory of 2568	3664	chrome.exe	157
PID 3664 wrote to memory of 4840	3664	chrome.exe	158
PID 3664 wrote to memory of 4840	3664	chrome.exe	158
PID 3664 wrote to memory of 5744	3664	chrome.exe	159
PID 3664 wrote to memory of 5744	3664	chrome.exe	159
PID 3664 wrote to memory of 4268	3664	chrome.exe	160
PID 3664 wrote to memory of 4268	3664	chrome.exe	160
PID 3664 wrote to memory of 636	3664	chrome.exe	162
PID 3664 wrote to memory of 1044	3664	chrome.exe	163
PID 3664 wrote to memory of 2156	3664	chrome.exe	164
PID 3664 wrote to memory of 212	3664	chrome.exe	173
PID 3664 wrote to memory of 4196	3664	chrome.exe	175
PID 3664 wrote to memory of 4196	3664	chrome.exe	175

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\stckz engine.zip"
1⤵
PID:4528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff5609c728,0x7fff5609c734,0x7fff5609c740
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,5231311331263480628,6767689747591653264,262144 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6045259371655830461,8956614912398531897,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11864669371309848020,1356426260270848372,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,401120205826397895,9410773808874542383,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3488,i,15732895756408283567,16468445944043478674,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,10770767280944052767,5089308807997896294,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4568 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,14095336350139956493,16895466961267841254,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4912,i,4432995983900490181,13665926392900008154,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,15452057088465091273,6031399320078586780,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,1491994016848337046,17105197692609603633,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,5836478850863256797,4887334165460447868,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,4003110509029399866,8791748564212518231,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4572,i,5498585854691451783,2503179764207859017,2097152 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,11146655509818313547,1427352849276284495,524288 --field-trial-handle=1884,i,14805541394268495482,307018135612089512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4724
- C:\Users\Admin\Downloads\winrar-x64-722.exe
  "C:\Users\Admin\Downloads\winrar-x64-722.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:1692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4736

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Desktop\stckz engine.zip" "?\"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5828

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -imon1 -- . "C:\Users\Admin\Desktop\stckz engine"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff5609c728,0x7fff5609c734,0x7fff5609c740
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1856,i,9630040770914392608,13739074453473269918,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,5000831611070890276,10581743258135109514,262144 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2396,i,17870762625635745773,9439553240772122307,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,17333010377174522648,16558245116929446114,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,6546701771936914050,17370732115559782443,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,7461022694867571706,16357682256330630430,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5300,i,4801816638670717078,16720545642751368232,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5552,i,15217597744470469624,11653603686227606072,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3472,i,2859186172326074377,10512874793607295218,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3324,i,1132222621586538562,18418517294089574255,2097152 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5844,i,17807966179042193113,16214672774309221035,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5772,i,6308470047716585745,16383922339852151428,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5868,i,247926254558328687,8083063494128888387,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5872,i,13954617097083827143,1780519621128071773,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,4165097214612016666,13465294933535746859,262144 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=1140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6048,i,17320230409957885858,6875129634152661141,524288 --field-trial-handle=2092,i,10643063682444938865,5414293185125148382,262144 --variations-seed-version=20260507-090102.283000-production --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5244

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\stckz enginev2.rar"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3340

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -imon1 -- "stckz engine.rar" "C:\Users\Admin\Desktop\stckz engine"
1⤵
- Executes dropped EXE
PID:5956

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\stckz enginev2.rar"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2516

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\stckzenginev22.zip"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3772

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap26494:82:7zEvent8940 -ad -saa -- "C:\Users\Admin\Desktop\stckzenginev2222"
1⤵
PID:5860

C:\Users\Admin\Desktop\stckzenginev2222\stckz engine\stckzengine-x86_64-SSE4-AVX2.exe
"C:\Users\Admin\Desktop\stckzenginev2222\stckz engine\stckzengine-x86_64-SSE4-AVX2.exe"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 830d8bafaa773e1163ddb47ad58239bb43178d1f813ec553bfecb81f7944b01a
MD5 8473701b6ec8a373fd4797c3bc576146
SHA1 3869cf71bef24884603120a6a405ed66776e8d85
SHA512 8c53467a95edc9d84503a18eaaaeb46c15cbecc51759bbf44a0bc721389cc40805614c211d604473c91d1ce416f484df882a7d08373c2eda072d9cc1077b115a
SSDEEP 768:kodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:kodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T119B3D8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 6be275126f15aaae6fb48e028fc3e65cd4ad9f7b4febebceb1fb3c984f040f36
MD5 1e757b4a2da19953f02e4629dedd97f7
SHA1 67cddb5415645dd716f4a0a182c23965ab1f2611
SHA512 5f5022ebb3a1ee234a44c4820e46e7ff38ad108928980ca41a75d4ff0f79eff516a70cb81ae9ad5beead484ec4f07db8f4230455d9ee1eb5e7d955eec9b5f83f
SSDEEP 12288:CyrI1lJlLZHJndEB7UFJtdqri2+avBQKuk9ltyy:CyrIHJxHdEB2JbqzvBQKdltyy
TLSH
T1C9E48D09A69853BAD47FD07CCA83461FEAB278558372C7CB03A156AA1F177E0573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 b35ff0d49825c222aa5af767b2ea6d04c5324b8c2de68e2d7b257bf8f2dedf87
MD5 150ab639be8319e6b030557c434f4305
SHA1 4d3d6d61f9fdc089a7e653a98b1786f6bd91f3bf
SHA512 44823fc75f74149728cf4725daa66eaae4898efeef99b8e8fdb5e9f8f13dcd34b6b46ed8dd4b6134bf7365e857fd384753cde5dac63077a5c91629718bc47ec1
SSDEEP 6144:aljRoo4zIa63bknS2ecOTJDPvDOnSfIHbqeC2PIII+Sn5HBK7jcRkj6:KjF3QnS2EJzLOSwxC2PIIvS5ejc6m
TLSH
T125948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 63KB
SHA256 bb537fb508773b401911149eea35408d110176be59a985d559639aef3dcfbd3b
MD5 723286d7036d2fb94305b9754b751960
SHA1 2ddeb036bcad72c4c556be97d7af88bcec2fe84f
SHA512 61f943392c0f075f9b3aa85c683819a1636cafa0c2541973b0172724a38b5b38d576bcc6534bb575d1f9334f48ec936ebc9ea38297d537fc65177fab398b6ef7
SSDEEP 768:KMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:KJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T17153A4237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A7D2F76F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 68038b348e071df04fc97407f6e0d4135cda3f6520410c917533091a57f13477
MD5 943c004c4be680c15dfbf5ffb572633a
SHA1 8f19755ab1a6dfd7d6fad988a3ad9114df3f0add
SHA512 b1f1f0562a2956fbbf2b24298349766ad4672f822d8b789623cd6eebdfa1dfca18b97a529a47901a7f2abb6ded621829b4e196cd47132f2b0de642a1cfcc50cf
SSDEEP 6144:80W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSR:I9iygYuV3f3j33cKo8oDfyG
TLSH
T1CD64121E7D9E8131E4E57D71EACC07CD2320B82A00C27F112D4FAAB6A5D8FED8169794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 93197a5e32265778176e53103e56666f45a085ee579d668317fe1cdbff5767cf
MD5 a129e870a870acd3d59cc1b49404cbb8
SHA1 04121c5d4abe73472329f2914ce1c0d9f661165b
SHA512 03515ddd51ff47d16b72d267a9288c7ad484adfa49ac54c2d36eb600a839f1af278876b47dcaf378f8a81663297477842f302a323f33f81b0e3bfd07c3b9728d
SSDEEP 49152:XzksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbtYbsfUeT+uXEkjNEEBHLus:oUyhvdc8a+uUkjDBHLus
TLSH
T12AF59D0AA3E406ACE0F7C679DED6C553E776780D07B0A69F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 62492bc82b5f8c956c405f8b6229357289e5ff2bcafe1b14f72aa92170ff0213
MD5 f1fba3318ac4985e4bc948c9d75c746b
SHA1 4000fe888c25128f72cfa7584f36290ac7a4bb63
SHA512 0ba1bb9bee2cdedd2508590894bd05073301f983064f47de2bd7f5acf1c9c0ad65963f8604b4e05c87772cf1a81591a01893d81c48c5f6022ac3a77372c663e1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bb23e8d4a0046c66acef024aa6621e6d34559bce1e87b777cf7a1bd6437de2b0
MD5 bd5ab891215297034e698697af357d3c
SHA1 313d7f3a0b2020232cee85a25ed147abf5fa8692
SHA512 ee14b168ab10e6ec5496d4da9f97b73a4669cd3c09b461b73d69fc2269b40c45ce0f5162a467b47dfdb39c2902bc060ab680d9a7e51e1fc529c29fdeae427868
TLSH
T17AE022BEC822EC2B18FD07596060478AE76023972B90894F763E830C8FB063B058686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Size 26KB
SHA256 443294d3f0bc0bec0655818b05cb8f70d8f1afbed000829524c5d359997bdb04
MD5 cf69a88ea64af18a16fcdc3f05fa0021
SHA1 90d8fd946a04fccb9c17c84edcdfbd4b46724605
SHA512 3659043480a61fa1815164e90cd710bd5db81fcbf754edb34fde50def6a08619f5266c6ecd751b74536b917d7f904e81d78439c90c4162ca778787e52df4ea0c
SSDEEP 768:P5QWHxuA22qRNlcGuC3SOSovJx5Nin5svTKwevp:PPHwAtq/+G7PPBx5NinuveLvp
TLSH
T145C2E1062468DCB18687AF8B339AB57B635B1C79F8CB3D6219946D72327B031205E03F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Size 50KB
SHA256 34baa25f4a641063637a7443f48d5df55bda04dae219e88d37834d9edf2c1661
MD5 a7a4423ed8ff6cff03c0f6b2e616d450
SHA1 222bae0f65e99e6f2a354857d19acff3245438a1
SHA512 98d5cd483b445e719ce14d6daef950179096a053f0b3b47ede2859e90978e0486bbcb0e95406acca685231be1914624af71aad3c3a7c058aaaba9f3a09aad16e
SSDEEP 1536:p9GzKqPnGOKaGwSU3gE5Od9dcFG3/n6LUY:POGQr13gCOd9SUiUY
TLSH
T1FA33023D76718C67BE3D651166DEFF2CA6B3E108AC061259E19BDF4C15B02AA4F06CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 36af4cd1dac2e1227bdb3a72958676d8f2a7b171a8f76d94fbd8fffc58fa50c3
MD5 31c5bea27c172e766bafd40969c7abef
SHA1 4e274fa1a7f457ca656cba6638b776b27c1d6432
SHA512 01bbd57652ae5e9495c794364a12243f573ebf808ec29e01feee2f126ee093c60ae0f62871c8137a3822d49eff52cae65b9f1cc0e4003f17a5075480fdb66eb5
TLSH
T195C0920291D695BACFA166B3CCD7849721A8AB67480666314C8010ECF4516F26201A0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 ff09c1a3e55d00578f0d85b1971c3b00eb840c529c7f893732b2f37f78f0ceac
MD5 5facd3f6eb817392e3811c16692993a8
SHA1 726288d7a30e3c7e7cd15ca38958f349a477d7bc
SHA512 00d3fd2b3a42865232787925e0618138231e3eae9a573d46734c1923afd387c9a58b66b3fc8decd398cdbca308f6357417d08286935b181650298d340ad56fb5
TLSH
T1B2012007EBC76477CFA4D5F360A2C31371A002188975035AF4A8A0DC54073D60D80EA3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 67e98b36409e0ad54f408319238ead5a1ce6d3e410078360ff2e18734811964f
MD5 a5587d1e58f56272743fdebccc407941
SHA1 dbbd37d021c9ed75a901c14dd71d84e67328bed7
SHA512 c4c4709dcabb8a0a76c405e2cba6acf839340381f2afd3c5b239bd134285334f75af38644b5b295338bc701edd8df1718ba4e1d8a0131a35c7676d7910e29fba
TLSH
T16D51974B5B86A157FF5E8A7319E5FB337134044F4377CE6BA8A8E87A12023D50E50926
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 cd04a34c27f08061068919cd2154b89584207cc045d88ca81fd022ff976cb43b
MD5 413c5b30c5a3aa16fb81e46861bc9b40
SHA1 5352fc8e6f41747cbc81563479d55dbaeb87796c
SHA512 e088e0300dc23e2d689483afb9568f20107c20e54f01f88800a4e2aa188b2ef480165366077f26ea4dfec3662defe1c989f3368c66e8e1895ae3ad579f07b470
TLSH
T15631EA87A3C7F167CF678AB305A94F32B264010F4774031FE09CA8AB11133E10E40E96
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f54f1584304c921ff2b931d6de5d963c3df6539e8a78f69408e029156019d754
MD5 f8535ba90fc7884361cfc8cedd0b4a05
SHA1 908627d8de7934b76f444120dda93c556ea985b7
SHA512 065abfaf0dfd8242aa17478b4e6c7afff52ad08d860405409342c851ed666176919866cd430a8ad1affcdf0563bf40b119b9f764c43dc3d908a3a43ebd76173e
TLSH
T19B41A64BA386A257DF1ACAB31DF5DB27B134054F43374A1BE8B868BA11033E50E50962
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 20be19873d219116d2a3e0a7c7dee03e5be7a640ef6ee343c83414d908b87352
MD5 60eafc2f238c761b26513efffc2e9999
SHA1 cc855320eef5e69d43e5b79da860b2f97c1ec610
SHA512 5ccc4a2b31265026ecf9893f4c0f46e084b681902d0f8329121818b006f390b3639744a9d8e93777ff6fe725bda89f6cf50a519a10ab19ad49a0326786be4b04
TLSH
T17E311A87A3C7F163CF678AB304A94F32B228050F4734031FE09CA8AB21033E10E51E96
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 9bccba3c43af074b4fd5857251049062b1b86ea35a8790f62cbf63715bc879e2
MD5 06ce1d8b1ce09b402f309197d428ce78
SHA1 3dd2c376e54d3429136ced458fb909dc4b89c35b
SHA512 577e78eb5e33b5bb7466529e43967edbfb49cc61f6536f8ddd35e1b33d65f0bdba3639bb5ed7e2d07c413a6453b57dec7160e04aa2ea1e92e49592d4e0827d34
SSDEEP 3:MsEllllkEthXllkl2zE/lfa:/M/xT02zl
TLSH
T14A4404157FC41507D70011754055C3545370F41D07535FC334510533DCC57400C00440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 27ac952cd37ae0e3ba10aeaaa5c0b67575b445ac5e2e91f9aa7b45909c0da423
MD5 ba41a6e634434c9287eb01f6cdba7477
SHA1 2e16a43b6acb0d7d72b47404a7bf4dfdf7032133
SHA512 5ef45d50a0bf57855ab30a0841adea9f29066d7fb37aa00e8dcb5119e561e29bebc0ed81eb364df9ba0dc1fdb6c6c0d28d1b0e812bdbb3ea49c4a2b0be4be906
SSDEEP 192:DrLuHXWbNQRBUpSo7Vp9CaIadmtILiKqHiEukajIm0uTPL/1udXFYjiYDo:DrLuHXWbNQRBUpSo7Vp9CaIadmtILiKW
TLSH
T1C542BDF3C3D4C66DC81166F4AB247E1FCE29092453283D6BC9E5EF4A93E2472E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 060f1b697a0ed369d515d03431eea3b6dd5d7ed16247ab0528f1fe27a83570a9
MD5 2d56c2ee8c606d652765ff2e6e3e651c
SHA1 b2ddd1f0cec0515faa2a32fd1d8e11406cd0a946
SHA512 29d1d6f7d0ed1cdd0426fe929b61672feb65197c035e9507ce9b5ae3867da933420e43a88bdb3892bcb83253bdfc40a01fb6eb34e8ba3b8293fd01ba7ff77fa7
SSDEEP 192:DrLuWtGwHQRBUpSo7Vp9aGaIaditILiKqHi7ukakqm0uTPLVZXtjUWjhwJB6Eb:DrLuWtGwHQRBUpSo7Vp9aGaIaditILif
TLSH
T1C832BEF3C3D4C66DC91166F4AB297E1FCE29092453283D67C9E4EE4B93E2472E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 4557476ac2d946130f75e7f4c3336b2c58192a02dcb2bfbf25d70ae4944ec8b8
MD5 846a78739969f6f3fbeea82290173be6
SHA1 c41083ed5551dd14ff492a272c8cf2509e04977a
SHA512 b4f9296a5d7c848cb9b25327b205d0252c9c7d9c309dfb389ef62ac208475b682d3237435386fcb591f2e6bc92a3ceaf0fdb4102c1656bee0c90159bbcbfd7f2
SSDEEP 192:DrLuWtGwH1NAW/gxqG9auQjSaIaditILiKqHd7uZakqmNpzPLVLqjhwqRIx3EZAx:DrLuWtGwH1NAW/gxqG9auQjSaIaditIJ
TLSH
T10A32ADF783E4C62DC90166F4AB297E1FCE290924532C3D76C9D4EE4A93E2472E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 8920da5d6d02f6bce4c0b3be8fe92573502d8a4e3c08274b0a952bcaff135e7b
MD5 42f4ac3d3a9f5fcbabeaa6901eae61aa
SHA1 ad3074605615613c1f8bdd55cea4fa9bd258eeb9
SHA512 977e1a2847cc1a9150fbafd034cd13fc6275255d64392d437128848fb6fdb8cad5b41f851651c0056072f99b6761c43a2c958dd0588aac12dc08b0a63d59e489
SSDEEP 192:Dr+MHXWbNQRBUpSo7VxaIadmtILiKqHiExkajIF0qOTPLLY10qc8o:Dr+MHXWbNQRBUpSo7VxaIadmtILiKqH7
TLSH
T1E932AEB3C3D8C62DC91166F4AB257E1FCD29092453283D6BC9E4EF4B93E2472E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 aea94d9a157fec8416b5f071eae56cf68c5597786f060c8df08e4a70d3e7c9e2
MD5 3557f20a06610395d87973cc130eb569
SHA1 6dc4ea54ad2930e886a091b4b4355afaee8eacfb
SHA512 1de29effc048184f9bc4963ec4b78960f6519d7a6f31e042a8b3d6a4e904c7bc0caa10b9529108bf34b5cf66f23afddfb5cbab7ddc55df28f2b45c8d2f256fa6
SSDEEP 48:YALlqlh/hhhChGhpPhohiaXYfo7zsEgmzsSfswKsJosWtsFJfJzsoBsNqzsNI2sg:DORfsQPKwaIadJdbG8XutILitkODmufT
TLSH
T102C1ADF7C3D8C56DC91156F4AB15AF1FCE691A24431C3C66C8D8AE0B93E2871D2117AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 08e8adaa576b1c28185565eea47999edf1e21b995dc7f4ca0bc6ba420ac1443a
MD5 40a299f5fdde0a155d490d04a9527463
SHA1 90bc3278dfa33db2c9551b392348dbd1733ee8cb
SHA512 88450d5e2d5a25dece98f4a4ba612bcb7c826d56421d5bdf29c9479543fc0dce58001817054ce1ff4f0d64a17b8d530711d6e27da62923e6765da24956128793
TLSH
T1D30194ABA66DB897907D49671E04B84558B7F471034118E4DE6A826C70589F30B15403
MD5 SHA1 SHA512 TLSH

Submit Download

f9cc1069-4997-436c-a30b-5ae91ead9c92.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f9cc1069-4997-436c-a30b-5ae91ead9c92.tmp
Size 10KB
SHA256 99f8049ee223db0cf8334b459f0e23fc162af7d8da5d56600ee98d748ca13c44
MD5 052a7494b19a5a8a9d89dae0a55f3c5c
SHA1 095eb11018f94928ca7e91b8843f6abfc3900e2f
SHA512 1c86ed9aa251a45b45a03901c4607947b205519c8e6ccf81aa0bf27d9094ed3f5ce38851916fd2f06fe64f1d12beb9aa5c870dcc25cabdfa7acab710220417c8
SSDEEP 192:DrLuWtGwH1NAW/gxqG9auQ3aIaditILiKqHd7uZakqmNpzPLVLqjhwqRIUXTiJrb:DrLuWtGwH1NAW/gxqG9auQ3aIaditILl
TLSH
T12932BDF783E4C62DC90166F4AB29BE1FCE290924532C3976C9D4EE4693E2473E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5efb9bcb8baf47e9ccd2ae7b2be913a3becb270205930b85f289c43a0251fbb1
MD5 f339866f21fa942ee9abf07a90fec190
SHA1 2661303489fe2ed762bb7927ada4f65bceef2852
SHA512 bb4057370b6b76c2cf187ca2bf577260f5915f284655592e0319c326c8b98ca2494a3eb83207ae7933bcca61415dc322189020388370d13e8d78f9010829e9a5
SSDEEP 192:gRAcBz1LU78O3/Ev7SpAPRp2xRDs9QHsb+WNx4cz45eYSB2ifa2pVyIsnAUgraJ:gRAmztkgeUX/Ww1TYO2yame
TLSH
T17D52E72FB920697B5CD6C269F922771BD7F5203161D42E88E7F88A2C25E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 eba61915e068c38d14a044c3662fdf015a55bc1af5295e008f906ad9e9db9c50
MD5 f6c7db2edb9e6f9477dac874ec8bea92
SHA1 96ca7ce857ad83685182d084a3fcb95412d085ad
SHA512 0430be311d7ae597b7be44983e140586ef73500964f9a97557dbe195464d3a7969b04f565c41b0a3f7f9a799630d2c0f6bf64caff163f4bfd322e0ef3c995bbc
SSDEEP 192:yRacBz1fU78O3Amkv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/VaZ29B2ifa2CVyI6:yRamz1jdeRX+Wwx3m2H2yahe
TLSH
T10662E92BA954697B5DD7C219F921B71BD7F9202261D02E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a8b5bbfc78d572d66621edaf8a697379bcce60d58a6a4d4f5a1803812ed6e1ac
MD5 52bed9fa3fb1651c62559877dd2f000b
SHA1 e6b11f8ab140ac8f469f3d9351d407565bb0e7f3
SHA512 3d849a7062b66f621b72cd51dc9060094e061543571dcf5d4cfde4dd4c6977cf6402289a1450c9738d1e9beb287bba375fb8a9ed9485f7a9adf56af400e41596
SSDEEP 192:gRo1LU78O3/fv7SpAPRp2xWZ9QHsb+WNncz4xe2AB2ifa2dVyIsnAUge:gRotk3eUXdWwYT2k2yaSe
TLSH
T19A42D72FA950697B5CCBC22AF922775BD7F9102161D42E88E7FC8A2C14E75CD322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 61896e0355565b2336b51970cb1ada7c60ad743fadfdab0776cb74ffaf4ea7c4
MD5 01e2dae9c8ef128d8ed171861289d1d1
SHA1 e685141286bd58eede5e8fff428e99d6e8201fe3
SHA512 12710fafa015bb7726b5095f864b5a8dc8d9f917bd00699a1ca78fa4d0207cf4dabaed16695b310b96d458b3296b35fc08ba8de128c2b23d833497b1355129c9
SSDEEP 192:gRAcBz1LU78O3/fv7SpAPRp2xRDs9QHsb+WNx4cz45eYSB2ifa2pVyIsnAUgraJ:gRAmztk3eUX/Ww1TYO2yame
TLSH
T13D52E72FB910697B5CD6C269F922771BD7F5203160D42E88E7F88A2C25E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8239660a5591d8a6f2a807cbd7413c2127cd0956138eb9af9685c857a15fb168
MD5 58d6b18c6edc1340db61e26560dee26a
SHA1 e92b6b7431020541ce0ea5f591a7417e5b50d7db
SHA512 b45005c74dcb0963d4a8d7fb15f14e5cb74ed2fb88da5de51b46bb9423a0a2b75d9f11654a06924ad8918510859714a82ef7d2de894c26413296fd83788a8bbf
SSDEEP 192:yRacBz1fv78O3ACv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/KctLaZ2KB2ifa2CVk:yRamz1YOeRX+Wwx3bk2m2yahg
TLSH
T1E262E92BA954697B5DD7C219F921B71BD7F9202261D02E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e11a26487e61472adb420ae455c827e1cefd6f22d585cd1939348f2189db3068
MD5 6fa317b7bd8621a45cec8f22b7cc18be
SHA1 efb6d7a5b51aee3f5919df615176ecc8d254d91b
SHA512 2e0d5c40217df1cbf4f09ad12b083f177a00a6074ef8724d0d42b2d3d380695b3d00ee8ddbcf19188b97fc7e3a7f662e7a005e4c5d7b55e190fcfda518469f49
SSDEEP 192:yRacBz1fU78O3AOv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/KaITaZ2EB2ifa2CVK:yRamz1jqeRX+Wwx3gM2g2yahe
TLSH
T13562E92BA954697B5DDBC219F921B71BD7F9102261D02E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7ad2ebb94acfd2f4b21624d0859c00ec308b37d6a6a99e5cfdfc4709863e1261
MD5 cd20dd7355cf95caf6b73a374c3d7bed
SHA1 547ec3a0a4a2d952ab57efd65ff60af54007adb0
SHA512 e9bb54e083f48b83e4fb5d762332806b77aaff8084c34d13e6a458b6ddc9b4bca3ba20f683da9027f3fe350f63a1131760babafc331474a283bae445013f7ee6
SSDEEP 192:yRacBz1fU78O3Apv7Sp/PRp9xvjf9QHsb+WNxPKOUBfd/VaZ29B2ifa2CVyIsnAq:yRamz1jpeRXfWwG3m2H2yahe
TLSH
T17962C82BA950657B5CDAC219F921B75BD7F9202161D02E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1987a9a74c2b870971e0301436f9d7c5bbf024fbcc5d4ced11677c7d84044fcf
MD5 f1c0dbba5e4f83dd54552816c252d696
SHA1 f1a7bd56837a204fc550d787143bf7105ce3954d
SHA512 cfb70e46a1aaf402e58644cc793f56de929c80b01c0373efaf0b95f5acf3d13b70977dbd472d8bd24926e684e86f6859e9c85d9f5ef093cac3dee351408fcd7a
SSDEEP 192:gRAcBz1fU78O3/lv7Sp/PRp9xRDf9QHsb+WNx4cz45eA2aZ2IB2ifa2pVyIsnAUp:gRAmz1kVeRX9Ww1TAt2M2yame
TLSH
T18852D72BA950697B5CD6C269F922771BD7F5203161D02E8CE7FC8A2C25E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 62ea2953582656a70f9b394af670091e399019182b57e8c1deacc6155867f81e
MD5 0ebffc0f1b7bedd360f066adcb59f8d5
SHA1 aa65be0c35244011199badd6da1be1daafc53bbd
SHA512 33d4193bf439954ce1c9b1a333cbf26e87a54d20f3f4c88025e7c488701a62b8c5dabdf7a28e6acfe9dfb852e4e59f62b3db0099be00346ee127936fa179e24c
SSDEEP 192:yRacBz1fv78O3AOv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/Kc6daZ2WB2ifa2CVK:yRamz1YqeRX+Wwx3wW262yahe
TLSH
T16A62DA2BA954697B9DDBC219F911B71BD7F9202261D01E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 de8e5a604f6dda22b2e8861e7cfdabc419053d1670f12cd007e83834afe0b0d1
MD5 ba18519df6d9c37369c2b5efde384d43
SHA1 a0508edda4ae2c534f3a44365d240a18356fde4c
SHA512 c07a912f34932652d03227ac3a3cb1e2f3fc992970b4b7bc6acf5caa0c2675806bee46567c309c7c321c009776f8da06c060d8009ad1426dbb14c5b0dbcff398
SSDEEP 192:yRacBz1fv78O3AVv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/K4PxaZ26B2ifa2CVk:yRamz1YleRX+Wwx3JC2W2yahg
TLSH
T18162D92BA954697B5DD6C229F921B71BD7F9202161D02E8CE7FC8A2C24E76CD331B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 47dd61bb6e7d6b0e222b7123f15be7f76d93eb2326c8d07e87c3414d76aaf374
MD5 c6e61c724d4e06917a1649a8401ebae6
SHA1 8c185bc76bb0712cdb19b56b212736509057a5d5
SHA512 8a6931162471e887f1f93afbd46f8089a7df86a14e77cce9714008183fae5e82610eddb243ab7b30b1aec2f787ae892201433eb76469ffc8653d3eb846b84b7c
SSDEEP 192:yRacBz1fv78O3Abv7Sp/PRp9qUvuFf9QHsb+WNheKOUBfd/Ks1paZ2SB2ifa2CVk:yRamz1YjeRX+Wwx3ra2O2yahg
TLSH
T14F62F92BA954697B5DD7C219F921B71BD7F9202261D02E8CE7FC8A2C24E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 167KB
SHA256 5a28dfef8666d1a3a2a79594a6dc3861bc06882c2e05e67cf8b20c13954cbb43
MD5 8c31fd77eeda1d579124bcea92419ac4
SHA1 f25ac01be20abb6d2116a286061a47fcb74d1566
SHA512 282c02fe8968224c7579c061976e26832f66892a8c6f986cb0327c4105e308b835620f90d669205cb8cc3ad4f0b494457023d96e3a7d16d028683bd9e662723a
SSDEEP 3072:+Qe+sswSjnxPCA1joGiM1z5NvawiHvwRUt7m1KULC1/Tq:+csswL0z5MwCvwRUbTBq
TLSH
T1BDF38346D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Size 241KB
SHA256 66efcd8459a595d050d7f3e5a8bd1cdb33adb75682da7561bcd7667da09ec5a7
MD5 316fcdedc4d3e19321a0879fa1d4fd6b
SHA1 4e10cc2d11c52e7cff1e2b0f0a0bc132ea440794
SHA512 eaeeccf99f13e17fd1788ec44b5547450a3977f8e7c8f4e309efb2b569671328b6f55e785bf6433ffc197f8be163b6b737633e22d1041883b0d724aad8fbc875
SSDEEP 6144:6bL98hpeoxxJOW6FJpusceFWb/1LDyjsUg:T5Mp3ObNDyju
TLSH
T1A3343F8A6326137FDF3943B95103BE5123210144AED3C1C6334A5796682EAD7B6BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 9fe5595425fffc80862652d8f7f2e74772d76b7ef527b850f5fb1cf7f89ef4d2
MD5 d3df490b110ba6eeb95a55c0f102d149
SHA1 4946ad4ddf1df8243aa76156676dcbbbf5e66a95
SHA512 22e1e984e8fd93dda9bab7b66c1c0f04554d4a72b02c9839a35f7bfaed84565b58640285f90d2324403d72dac7977bb0b60e0ad209e944c69429fd5e14f226f0
TLSH
T123C01252C005A121C42703B91CBBCA9C36189F25CA09334453F1ED76D8399A1881D153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 77811a9d2bcfd0413dd0650d034d29d8c9fff7db1936fb17eda1306ac62f3e2f
MD5 2bcdd73458c61fe8f252f794d0fc4a83
SHA1 490f4ee50c741e3ce7b64f1ff27d1240b1ee8be2
SHA512 f920bc8c3b1f152e018926e57f80c89a139abdd58b70672f49e018dd7b0c05cec7d45485e1c6c12fc09a7804418ef1db497dfeee3bf7416b74469d2e3f2361db
TLSH
T176B0126080415501C01302FA129214887119AF149705130153F06975D82B2904064161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a802e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a802e.TMP
Size 96B
SHA256 74ee180a83d4f18194d95268480602357b74c81067e2488d7a2e69e660d8f33c
MD5 1b124048d5c0e89f277916b9f978870d
SHA1 d9baa8cd3922878f348b5ac7bd0990a7fa6f079f
SHA512 a4b9daa5080e33d2d8bba16fb67805583d066194ccb009fd6f34e936904c3e773d94fa21c891803f5748f028ecb5c6bc788b4dbecea6d495cb519b484e84387c
TLSH
T112B0222CE0032302C00303B838AA80CC30A0EF2EEB03022AC2E0AA3ACC222300232030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7807abae2a049b59363436cd2843ef61cf12dd26f01f6f438bb33d2a024f0e7e
MD5 95f3bc74ce01637b8f33babff76a3be7
SHA1 13085cc18a63023920516a0caa946e2a0f2fd2cb
SHA512 7f3ff7b0f2793d2089a3c71da008a800ce1c1f8e03234850adb25d355e19b631dd0d5860b005ffa05a988033d8eb0b1d2b8532bf740ed1c85e5b7d99d5b62e49
TLSH
T1E3A0021097405065C10336F321C10F80731058544796474B92D05A68AAB16498A7E545
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 4b2376ebe64ddee3f96f2e31ea892148f3a5f22a8e14bc3b711df25d818e2b9f
MD5 35f098f940e7519e6cbace9a332568fc
SHA1 02162bdb95692fd349bf3c8f3f489d4599561948
SHA512 795e480a6524fca5e545fadccf355b9aa972e8d32f4c8cfad288b8a22308ba5524a109b5fa6b3c631b02f90bf53cb7854326302984ee60dd2b8c84ede4026198
SSDEEP 6144:8AlRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEEX:dAhhUtjO4rOjuGdF2X
TLSH
T1791412B7090B0FFB9E7985B1709F6D09CF67429D70FBB4D41168B28DB28554A2B22933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 7bef5e960954d26c2d87e804949382dacff4723b7df11c846e3308f878039bff
MD5 97f997adaa7fe3b218231e222c0aa689
SHA1 bff4fdb8265eb513087e096cf7f6634bcd13a3f8
SHA512 397743fa049ccc07b293f5157b8526ac711c5233f8ecfcca4e216bd441244619c404c603fa5eb0e9810e69ef1c2d0f32984bb3b991c13150bb80cd39d6c87afb
SSDEEP 6144:jhtlRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEEX:/AhhUtjO4rOjuGdF2X
TLSH
T1EC1413B7080B0BFB9E7E95E1749F2D09CE57428E74FAB8C81158B78D71851462F22D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 50875931686978a35893ee142fa2a07c4947656c906416efcaa8905fc7fa005a
MD5 45bd9c407d25b100a54719f3e75578a3
SHA1 8a70786db2d2787fe0a7c37285d2d0c375faba85
SHA512 38ab3b4b61cf500e4410bddb5321e9c8a263d963b4644aee713ea249b2d2dbb7f09924eaed2dfae4b64bd8faa39e2aee61e92b776f87c0826010379448663a12
SSDEEP 1536:s3jxrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:Sdh3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1C19312BA5E2646E7957D4AC176AE7908CE12130D70AFA9CC326C638C61D01CD2B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 4aed4748ca81b0e1b4945edd76d8ee0b2e016d4ca9805b3b1d876297abad2531
MD5 feaa181b8c7c40954d77802ea60a7e14
SHA1 ba4eaa9371eb9ff8f756982f44ed276187450bc2
SHA512 a7d78449bbaebe1a84366f2f8878de03d51631bc17b873e0763724dfcfb0add4e45418f3723d832d19e3daec5116caca338408beb915139b188e502b5fa86ffb
SSDEEP 6144:jAlRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEEX:cAhhUtjO4rOjuGdF2X
TLSH
T1411412B7090B0FFB9E7985B1709F6D09CF67429D70FBB4D41168B28DB28554A2B22933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 941ad872d91ee4604e41e5c4f339c74af9a53e76ca1de6c618062944a7ede157
MD5 8fbdd794c2afb1dad7b7312cf9498796
SHA1 e4c40c6c893d7d4255560d5b4ad5d03d55d105cd
SHA512 dbd00f6301f101e61931c736c46d021d21bbd5765350ecb5f0b28b47bed8aded8e33f527f19345f77e723d20ecd1b447f5c906b9f0e0f9b285c66fc21dbd176f
SSDEEP 6144:jzalRUhDlUtHJhjkeM4C4rOk0HOGm/SFyEEX:yAhhUtjO4rOjuGdF2X
TLSH
T12E1413B7080B0FFB9E7D85E1749F6D09CE57428E74FAB8C81168B78E71851462B22D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 4ae49fef7f52f0ea2febd6a3721bf47d554cd4bb11b2d8dbe2fdd36e70585451
MD5 fed25b38aca72ba3ccdb12f8521e8d74
SHA1 24d6725e38fb325ff0c66990c796bff50110602e
SHA512 b5279d2aa324b8692db6ae9bc33b74fc0e91614dd172f9bdfb219a9322051c4631edba26576c8f0c57199c31fbd84c1f602be874864733f1533fc706612691ff
SSDEEP 3072:AwCYzo/YMQN2vt8RUhDUZziUtHfRhjkeM4g/XR:A6lRUhDlUtHJhjkeM4CB
TLSH
T179C312B7000F0FBB9E6AC475B04B0E56DFF744EE5CF1789005A4BA4EB2D691A271A436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6f5c57b2a127fb97091501a378a30406999fe0bfef532d8e87c7ef2788b6317d
MD5 1519a300fce881f87be696238707b1a4
SHA1 6456404e70dee02474eb1f55ddfa14321c3b8850
SHA512 bffcd7330fd44cd090a9de62ab3769083e30a143a6d0b2c63e67558847079b55f67f913c37e56fcc215885a6ddbba73081d32319da667c490f063c8ee3ec2952
SSDEEP 3072:UwqfYzo/YMQN2vt8RUhDUZziUtHfRhjkeM4g/XR:U5wlRUhDlUtHJhjkeM4CB
TLSH
T19AC31273140B0FFF9E66D4B1744B1F16DEEB81EF9CF0B8540894BA4E758A9162706436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDRESSES.TMP

Path C:\Users\Admin\AppData\Local\Temp\stckz Engine\{1A640ECA-EA2F-440E-BEEC-D70CC923CE1A}\ADDRESSES.TMP
Size 21.4MB
SHA256 2fa0e09c2d4b5df2c5c65e9c3b9ab73425185643de9bde34e049d01fd92fb6ca
MD5 4e0aac7103f8988a811b6e1ca3085e4c
SHA1 ff266a96cf9c949919cfbdd32537a0681f9e2569
SHA512 248b11c2ef2dce4ad744785473174a5813cff31c0e06d4c375d359313c2ad372e4cd599ac47a3ab51a3491172ea5c37d0cb8d6029ad75e27488878f7d4084c69
SSDEEP 196608:OWMlv7rbYPaNH8xNjam2dTZaft3ibx1gqR9K:LMlDHYPaNc/jaPdVaftSXgqR9K
TLSH
T11E375BEAEDB888BD0FA69168B919DF425F892532657CBEF00012D0E4A0C571E7067FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMORY.TMP

Path C:\Users\Admin\AppData\Local\Temp\stckz Engine\{1A640ECA-EA2F-440E-BEEC-D70CC923CE1A}\MEMORY.TMP
Size 10.7MB
SHA256 0a85be9a10b3e26050350e3287cb73439d689f3cbf79569018bd2b5c68ce0136
MD5 080b5c4bdd06acdfadab0c22d2ef8745
SHA1 7b85f4247365fafce607732840a51cd1d1476c72
SHA512 f272a897afa397f72eb46aab45c57077002c955a92154fcc96a61309eb39cd8a3b5376ff1525c2ebf33edfa151cfd39852555544e4b2b92c0480c0ac8c16bfc7
SSDEEP 49152:4TWYThluhLvPqNPZY7JHGLTnlmHr3PU43qXTSO8Wm/G59:ULyyTHh
TLSH
T1F8B686516AE88E7BF3B72B7359B9C072DAE6BCA16B35C11D05131C1D2962B01C861FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 e53613db3a9fb0badf9a93bafc079805d42d5b17048a9b340113380f80c2908a
MD5 0f0bf2ba50b9640b61f6644b641bb113
SHA1 c12cae7e9efdc6a41b893df166adae7d5dcb1351
SHA512 b75819039f25697dc3aa64f055ba0d89de0fbf0aa9a2e97584aa059a44950f1f4b539618a6e258a6ce8a768d777dd67f43722aa2ff19d52db20d7a5fdbf495e0
MD5 SHA1 SHA512

Submit Download

AddToNewGroup.LUA

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\AddToNewGroup.LUA
Size 1KB
SHA256 87fa0d759d6b36cba2b5cb0a8c5c3c43312b0ee6f03e077c4ad6b9f748c5f8b0
MD5 83bdbb1ba0dd3c8c5a18f125951c9325
SHA1 bd0a80c6bfe473209c04800fd295c0c5505513b0
SHA512 dc2959e6fb806d8bb617bfd2f8be7d524a8e8d639f842a31b37d5c8ce445634a44df03cf03d9aa2f7a74137d7fa50966e284dbf02d3662fa78f68acd5ebf80b3
TLSH
T10F41BF0B5729A53810D58BF1E8D32CD66B11508A498C4966B7ADC28F1FF03AED9B73C4
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetInject.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\DotNetInject.lua
Size 7KB
SHA256 f93774c321fe590b26f6838889654b7639d251e0190e3509c3e50556ba0d7989
MD5 019537c21e839ed2dcf6372d4ee5437d
SHA1 c70622fbd9922a1f98ea100dadb1cdaf73a407df
SHA512 9cb3a81c77aea77cd12b87fe981b06096760da6d32f83b856a454f30d88067710261f6ded11a75c01181d8a789b6d39c9861f03f237a1da36cc0801168e222a3
SSDEEP 192:YyiTmTvRu8ff5A3bvoZjCEA5Ugcyqoeg0Ex:YxmLRu5ga
TLSH
T162F130113F42F9BE4F42D3DF0D259489FB80E643FA359950B6CC92672F6816A42BD328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetInterface.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\DotNetInterface.lua
Size 19KB
SHA256 952bc6a8bfd0070566411ee88ca84f5a7f54c452a4e77790c84cb150595a443b
MD5 1dce4c5122636604f6ef299e5e6d8211
SHA1 b7149b4539315c699711403d85fc7b7d6943fb9d
SHA512 705620c3b2a1bac7de12778fe953ed96c956f04b53c944907e00086fec2774b1202d424e6428c9e1daa0d49376a6f03b4de5b33e56c778c02f6cdcd76cb3ebe9
SSDEEP 192:DmA6x6gnQPYg7Zlzgng7/QgVgigbgggQ/egegmgKXh5XCZ1C1TRxvnW53ZgmdUMg:D6hQ9i27lKmUgQm
TLSH
T1B392CF8D76867ED303FA817477860469BA2B504323156BD4BEDD8CD0FB84A3DA0EB794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

affinity.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\affinity.lua
Size 3KB
SHA256 6fdfd20755b3ff4f71abbd9f834a916d7f8a9d85fb5e5dca6bbd859cac6de758
MD5 736a8bbd0d34eefd4c1eb6d02b2f35e2
SHA1 9adb98705ca79049c9ac9357ad95cb09ca5277e3
SHA512 5890c5a73beb80acfbe9828d62e54510d02b28384fa97ffe853b16d910cfe39e83a93fb9f7c6e79823a694bc08c658afca6b1430d59a48691e27b88b87d519f3
TLSH
T19771CDBF1F1F996A2DB1D2201C07BA06C323D65B51B6064871D8C8A29B7A35C4D7D2BC
MD5 SHA1 SHA512 TLSH

Submit Download

andtools.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\andtools.lua
Size 7KB
SHA256 1142b59d9b5a918b637006fbcd7199c3d561ce08722ecaf192fbf2bcb9b0c3f1
MD5 dbea35855b986c3e529d5f6dedbe5ef6
SHA1 3cc8db2ebed5b515ddb6a1cdf54066e8dc0485a7
SHA512 030fb90f1caaffde1dcdc72d74bbda7874e62171029704efb44e521eb46f2d1eb75a99e8314b7b72843bb1edd236c38f4266c081d471a56951bc29c5226c7250
SSDEEP 192:br0u5yjRAJgkv4a0vmIVn4vAP9dno/wF+j6IV5yG5A:b4uAjRQgg4tmIR8+95WLj95A
TLSH
T149F14322E3B6263426D74597BACB00024BD718AB412610E27EEDA0D43F3D655D3F7FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files that should be here.txt

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\andtools\files that should be here.txt
Size 275B
SHA256 d7c2c90253b29e2e7ad9f2fbb38305be1fa774aaac47fb8de389a31a96c294ce
MD5 b49879487a12d62b4f3b03ed1909d9f7
SHA1 6851bd57974bf4521c7a011cf9d01b44a698d97b
SHA512 1f475f6ef15f817e831e1ec9ea5f51ff52ad9164858df43b6a93dbfd196d824d12883908ede1f22856586e6e0347d10a99a25616ad78fb32dc532294c731805a
TLSH
T158D02B0AF39BA1256C529631A95C14E356934D809BBC0520C44E82E15F0C3ED6256744
MD5 SHA1 SHA512 TLSH

Submit Download

autosave.LUA

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\autosave.LUA
Size 8KB
SHA256 2102c2a017fe0c15d924891750f2108734c1f616bb8155db075109e4368a931e
MD5 005a675ddbdf7e8359aab9af19dd7000
SHA1 2dc8ef7abbacff7c11bbdc3e7edfe95a9b2ddeea
SHA512 a756d3f6b4cfd8ac91d30f768f4d4ce3571250f484c6fe00e3e439062cb6a7eeef506799324c97b02e9367482dffb72ca599361a3261e95d203d645ac8bd267b
SSDEEP 192:77ODPchjfwp0nUubFgqXz/C/cozwzQtHdBLRs6:o90UKXxqXR
TLSH
T17F02522ABA07367C6A0943B5A0C749156631214B05139E78F9DFA0803F9177D52FFBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babyce.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\babyce.lua
Size 14KB
SHA256 1a0af003b24d7af4aac1da4f635dc2654b909ea4e377aa7f8100e1423fe56156
MD5 2752eb057b40d4490c866315c6f50055
SHA1 0e228ca74cc7c15922e8fce81067cc0c6630257f
SHA512 33c3e6493efb708f06ad3ec2f6072cc24a0f62474734a2307347f43bc4a6e669dc03df9d954337c57aff4e3f7e19cefa0d9740390b2e54fc797c8e8f50e27ce9
SSDEEP 384:aapaXjubrqWBIsICp4vgbWj5fP24uH8pvn1ehUqmWcCGcZhaGNFwytpeuwFda:aawXSbrqWBIsIq4vgbWj5fP24w8pvE+Q
TLSH
T18352104630421AF5A8F297BA5A970CC1EB12002369633CAB3C5D95DC4FB8A8B56D53DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigendian.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\bigendian.lua
Size 7KB
SHA256 ef24f8176497dde496d3cf57f9b9ffbc0b78082bed1c3a15afcc6604668d6366
MD5 bd004b82ab30dc86a2459d0f70392837
SHA1 eccd10ddf4584cd9089ccfdf656d281f461fff7b
SHA512 ca7278f2ec1f8d00de7d0a17a021b0d0e331af35a119ee0280cab9b4b065b79db743658370aa12782db3bb29c466d82ed72f943b37119119f802cc9b28947f24
SSDEEP 192:AQMWG73KlI7UQUWi7lKli7GQYWp7G7wDrcHZfrQQRT8Rw+:ANK7DKJP3Tm1
TLSH
T10EF198693E10AAFD070196E7698E4DD71382E4E720E4438834DE58594FB10BF86B77E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

celib.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\celib.lua
Size 1KB
SHA256 f601d853c4f6f3224c32496ae7595c5b28e4f1e429400cf877802011d48185ed
MD5 71d6e0185b6841b5c47600a2fd4700a1
SHA1 d8cb206d8fefdb21317085a72ab350af4ff3ba92
SHA512 f43ee6d64e8471224ad635b7ed709ea200d886704eada7d6892d3d70c8dec78f2b4d9870b0b58fd428e7d3ccb3956c92a91d8b2ed4ef1147c57c7ccdcfdc529d
TLSH
T1384153271B3232B19753C5767F8B1350E515906B2AA48C31BDBDC2202F983695BB2BF7
MD5 SHA1 SHA512 TLSH

Submit Download

ceshare.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare.lua
Size 13KB
SHA256 c0a7ad4fd5bc521b04fea71e9d1023d9e36f88bb8f6a53e4e8e014923de4c7d9
MD5 b58b18c87bde2a935dcd06ded31b3c77
SHA1 ba8e40d11883ad892bb939dc0317393dc7399b0f
SHA512 2785aa8957b07822f7e66cd5a9ef0369c21afba29d89bc525de13da43f9fda85a9635d9f3e1dcd56bcf45887645aa795355b0da1bcacfea511a92251b9bcaee3
SSDEEP 192:p1mSfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:/fPjylLNkKW6tE
TLSH
T1EB5292677542A67D94F2CFB5F8E70451F216404362A6482DBACC40463FB278CE9AE7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_account.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_account.lua
Size 6KB
SHA256 0765d83f004386d898aba55a9bb53d032ee38a422b6eef0770e74f7693e7e69b
MD5 fb24f06295b3181d16c2097ed6dd1747
SHA1 37d0f0071cba48aab9f2eec7acd2b1f237bb10e6
SHA512 6699d2f27d41f9c415a7f3300b019a8afe5f3618be9d1a20e4db201b1026abbb2f3a79ce567509590fc43b77516689d5b7b28d7ce41e1db374cf83ec697bc67a
SSDEEP 192:9mEzdE7OvG9VfHAemV9HmIcqH2E8VHo09CSADseggWXHaOYOKQWnDYW+VwHiPZJz:9mEJvGHo9NruoyFGAo2f
TLSH
T16CD1EF37D1254E645B65DAFA34D70845A885D9031300E8BD38ED96443FA3F4E8CEA9FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_comments.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_comments.lua
Size 3KB
SHA256 67b02bfd7d1351665447d1e6309f66685e762835256e9718bd68f1b0212c059b
MD5 43c3d935e0ad2cb1df42b20f43a56ad0
SHA1 a8f4ec68d2bb6235166c54af1afe5bc7859f5d29
SHA512 47c190dfd1274d44c51ce873125aa482876a43b57208ee8d284638e65b06399fd9dcb120466a99d4aa48e163d074b2ea2c32581aacc80fad42923934f4ecb3e0
TLSH
T10881EC7A31E5367C80406FAE3AD3260B66E1132B1105294EB2EC918D7F91F7A64BD3DD
MD5 SHA1 SHA512 TLSH

Submit Download

ceshare_fulltablelist.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_fulltablelist.lua
Size 12KB
SHA256 d67c3f857954e7c49e94bebf62333378408235b2273234180ec0e16f35d9bedf
MD5 725139185a5ca226abee128b3e04295e
SHA1 019ead2182ff6d2394d13e38da2ba0b4a25a4b93
SHA512 6ea119aa2846362fae22cbb488ad31b95b2698b80b4ca9f1ac7624e7d89e2d9dbee8d3075b1942299df314fc196c4791abb0c3515b72c508f2e3d7c52b209322
SSDEEP 192:0nXu6OpWQ1urJJrYN3FJ/W1O0f0SjBf25Csy4U5nlFJR05O2xBLWplHWHHApN85+:kEWQ1qnsFrseL+K5rHckVuWG
TLSH
T16742486AB61A712CC2C38FFAB4B74E069792E01352851D2DB6DC41493F8139DA4EE7F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_permissions.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_permissions.lua
Size 3KB
SHA256 3ff8fac3d2fb9a00af04787242eded48a16b4cd7fec923ed28d33bf5806f6885
MD5 d2bc857c62a33e4bf7398e07cd3cb5bc
SHA1 ac6324ca159b785dca907b2180ad3b6e97dbb097
SHA512 262e6220340ed18c777efc5dfbd27515c4dc08cf34d106b8b3cfb377542a40a81e285d044fee86db045aea577a8201737f61327f22a59095000f77b157d47bf2
TLSH
T1BF715867AA1D13784084CF7634B709C1AE69100331852A3DF6BD12993F5139BAAFABCC
MD5 SHA1 SHA512 TLSH

Submit Download

ceshare_processlistextention.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_processlistextention.lua
Size 9KB
SHA256 ecdb599d5ae02ba220948a8d2f7c2af92d7927a228eafb86cf414f146dd54eba
MD5 266e292c27213bbbc1b23fd7109c46b8
SHA1 7884ae225adf631a8252ebf214c3fa8987e68f73
SHA512 eb768bd8fd249c1285df4c243e70cd0059232c870e890f7f0ac0e5c332fd0e9815308a2bc0ddce93063dfab91900a5a642572ae262e5a9726ac9ab339a0c392e
SSDEEP 192:3SsWLvI11mbmG74oh1289DVuMiODVa9bHqL6ZmyzoqhH6V4jrRA8DClk4h/DkJ8v:iuEp1Bz4e8DxOzcw
TLSH
T14412201BB21A753C41D54DB5B8474D432B96501312B64D3979ECC28A3FA134EA8BE3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_publish.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_publish.lua
Size 20KB
SHA256 54d886c65f8dd7e5dd07f653ca449a6b12e64fe5bc1a741cfe48c1a978cfd3ee
MD5 97f88eb067b9b902079f6a432133f365
SHA1 afae319799028bcfd842948f20aea014826656fa
SHA512 97fe3761d83aff92559ef1f19f4cd7fdd0ae433ea72e56c48d205ea239eead332c73f0fe4b992a1338fc77c5f5250d7fd1f069151dacbffa9de445de66ddc808
SSDEEP 192:KPE/fJQNX7Yp1hpDdUegFx/R1hLFMqTmYQv8f/dJL6FXz0wU+Sms5zcChvZbC4t6:KP77sDdUeQhjiX8Su4ny15t5wBf
TLSH
T13892A93B7618327CE17F8EB4B553150E2BE950432198081DB9CD86693F5A32997BE2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_querycheats.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_querycheats.lua
Size 23KB
SHA256 90eadb9b816de06bebf10c393924e0bc5f90cdd10e876e83d5aa3aff8a77cc90
MD5 dfe5c77e0d743c7ffb02065bd3f7e085
SHA1 6238c5b5d3046b8ddd2bf0429274d27272b37e66
SHA512 fc753f4520f1627957a731422f8a79166252aef7f0f8ae2e368b1981fad0810fa25f489063bfbbb84dc6a56fdf25314fbc65c636d052ecdfbceb5c1ff64929ce
SSDEEP 384:pDdUeQN/3V2Zq5S+dv0U9cb/TphQPHjW+5h243ybQ6mG+OreIWBLTRm92px9eu18:pDdUeQ5F2q78rPZ
TLSH
T143B2F03AB21532395097CEB8B8C749127D262053118A1A1D7DCE82D43F9275EA2FE7FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceshare_requests.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\ceshare_requests.lua
Size 5KB
SHA256 42e006575047e84cfcef465958a1aa3880f8444459ff8a81415f72a931c3f30d
MD5 47b43f823355983ba06923b31c01f1ee
SHA1 e65fe72e1dcfb68ee378a5da4807b649d90ad372
SHA512 d1f0687bc614b5f621d5e9ab473729d511f84c5dd8dc93d3355f8b952e1f4009031a3f0aa2bd4855fc78da501d06ccecef9fd2a56dec21fac77bd3fc3cf83c62
SSDEEP 96:w59RxrwzeHiOvIDYzL9cH+VzDPb2VNtrUegV:w+eHiOQDIBoQzDb2VvgrV
TLSH
T137B151677015227CC1884EBABDA36729BC6122233206353F75ECD98C7F8136921AD7DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowseCheats.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\BrowseCheats.FRM
Size 8KB
SHA256 1cc47113d130f553904a782193f24a70b6889527639dea0d43bf41a53b12c39c
MD5 e5c6e0a2cb06d7d88b12b9743b2a839a
SHA1 d7e1d47db322ddd51da52b15f95745933e8334a7
SHA512 fc62ee4efabf86dc0fbd2bc208fbd44842603be9eb1244dbbb0c0a3fadc6af77c35eb7cfeec7f3bfb391de765a1ed1ee230c0e9fb4fa098d380f565af4589db5
SSDEEP 192:HmmNyxgIf4EwW+rLEUeD0qdYKjj4vxs78t+ojoFv3Vg:HmniIf4ERWrPM+O8zjoFv3Vg
TLSH
T19312AE8EBA7E2D9E1B081958C4214F65F63BE8CCA4524ECD97C557CC43FD454E4BC04A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommentsOrRequests.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\CommentsOrRequests.FRM
Size 1KB
SHA256 279d62546aa6fba4e685af9eed63d5c8578c9a40b3c44348d5f7444de88ee048
MD5 46df3fc19fcecbef339babbe6ac1ab2d
SHA1 981c78cff4e5bc7c4d0fa194d4253e59bdac618c
SHA512 43b7ed1683fcc2ef14c1335a1560e23f60caf09e8c97aa7c2972b26335e872090ebd9a03461532ed5d4418df968c93f1ce7dc1962d91dfdb285db7bf2d897821
TLSH
T16321DA6E8B8CF1B8D9591465A3EF24964CB7F31214500E4929A9EF304A1C78170FDDED
MD5 SHA1 SHA512 TLSH

Submit Download

InitialSetup.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\InitialSetup.FRM
Size 1KB
SHA256 3442fd7b468296a50763779454646f7626fa65745a173d83d08f37fe235a7877
MD5 3e2d9eccfaf4af4892657cc78b608c08
SHA1 84ff1d8bc8d7f43562dc4284f6d14408510d1ada
SHA512 38dddc3d02421b6e54b1254bc2360e68989f1366a469d203b8ed42b7478c67373586bb30612c3971e1c824962b0aed19f92ec1565b62fc3dc5f2b85134e9f66a
TLSH
T1CF21EA3C5EFE492257A80F764B571E1683D8B9133E5920F8515072C7A54DAD174DC738
MD5 SHA1 SHA512 TLSH

Submit Download

Permissions.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\Permissions.FRM
Size 1KB
SHA256 5a69ce155c10aeb4bad9897c833967f8464f30756f6ce0a0e758ae4c9672ad6b
MD5 741c160390d89d28d9f4ea77660de5a7
SHA1 bfda02e89639e6c86d19a519f32943ac99df4a1f
SHA512 86751b0ed889f42d7e8014c997ffa462515a92eeec0ffc79dd5f7164cad4c6b9ec25bc6b2fe2167c7a11f305e83bab6856f6a49c44758419e6c7a4cb80e1f9d5
TLSH
T18D219823A266A233A1000DA0BE77C6350FD8F369F605178AE44BF2E0D3ED40815B6A29
MD5 SHA1 SHA512 TLSH

Submit Download

PublishCheat.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\PublishCheat.FRM
Size 2KB
SHA256 8a13434fdb5a8be6703e9e5add2537832d3bb5ea8ef2dc9a09667722de61a8c7
MD5 2605d731d9f06cfe9291e5e4add3c563
SHA1 2ab0d52773c8eb1d609852b52d49c557c523e039
SHA512 a1c4a2da046dc4238fbb2de7a0154c7d656cfc5924189d2b49a1bcce52143b3815fae1f17645998dbb16a1533d6440961122e0c2367cd4bcf112e4bc6a7c5cc2
TLSH
T101415B46A9536DF692819614ED3683DCC68E960A31B2FC107FD79E31152D83324DA37E
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateOrNew.FRM

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\forms\UpdateOrNew.FRM
Size 932B
SHA256 c394f3deae793f061b266100fa8c68b94a44ae372f0727beb450a70832259474
MD5 442340b1ce1a2e210ac26fee6410c0f8
SHA1 67c5d40ca3e0a1a2f7f14bf099d6fccce1eb99ba
SHA512 f85d69d609a317f900ff9e94cc7e3b7b1564af257c898d06ede0567e441b222045e2825153d3793ed90e784b88f6df324fe6b52a45daba72c6143510cc3c951d
TLSH
T19811C8483CC8487635089D230062299CB900749D2C4134A09FAADD67F16C1F6E66FB0C
MD5 SHA1 SHA512 TLSH

Submit Download

link.png

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\ceshare\images\link.png
Size 1KB
SHA256 a85170d26b9344dca793c3b2326ec709d2f2d01578e78b855e82b14795b0025c
MD5 0212208fd406500388f08bc4189cc57e
SHA1 79a82f1ac86d6c4be3c3e4b0a790bfd4e2f6b27e
SHA512 33e7e2ae0b3d36d8e909cffc993e6b36923e8775e780832f5d689c15d04712ea412b62cc709c53128d9acad34f1922cb9fee90304da2f879bebeb4f3a67b9523
TLSH
T13C11B9E39E408D56C30C21846811F564C973B0BB196A0959C672E8DC29CC17F949984D
MD5 SHA1 SHA512 TLSH

Submit Download

copytoclipboardastext.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\copytoclipboardastext.lua
Size 695B
SHA256 2a1439ea28c66ac0753eab3a02beb29653683fc438901abd2f5aa426b90210d2
MD5 f83c9de409b7a119a56462385ff846a5
SHA1 fa7ce23fe60bb20c7bb01ce73b6b41eb6ac0c675
SHA512 b36dae4a02b21855c861ed2d99a1bd4f0a8b7b9ac0121d3f811e5dbb49ac12ec05d78f9b1b5ee443a4967182e3ce2e5a6a191977588f6eee8e4f41bdaa4b6dfc
TLSH
T125017B426642A55E80E712A69DB60E0DF3A1500B49AF36A6773E9D492E7432C01F3B7C
MD5 SHA1 SHA512 TLSH

Submit Download

cpuid.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\cpuid.lua
Size 1KB
SHA256 e23eaa1942ccc7acf92a9ccbc69aa0e4a4d1310de5e2ad92ae688dd3276b4afd
MD5 fa2ef4f82b9bdb07a9e719ce4d8b094d
SHA1 7402f942f6f65020919f2e3bad1c7cce3809e59d
SHA512 0be764d11a9e00723c222f59f3b5aabbd7966be942f2ea5c2e8ae18903b3fe7aed8d6174c164e8ea561d1ae5a56d651848700b34580baf7acf700dcc08bf88c7
TLSH
T1CD217DE7372E51EE77B933655B02751B8A56A78D34B48C387344CA3701868E9576502C
MD5 SHA1 SHA512 TLSH

Submit Download

Lua files in this folder get executed automatically as well.txt

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\custom\Lua files in this folder get executed automatically as well.txt
Size 85B
SHA256 308c1d972eae5fc20b034f480d3786d384888fe369ac15ff64cae16c49e1871b
MD5 1dca89c3bdc766f7c64cf6d45518810f
SHA1 ea82ae79196abab20e8953cc84d3dc513f9e9f58
SHA512 3be5cd676734c4cb25a941a98ad48c57e5c1703904d2cb29ebc0cc230100fd16576a70c1c5c40cd56becfe5205946e07045f24608447e56a9113d1a033f90f17
TLSH
T1C6A01246A942A2700474814D12041CC0330A85A1C051C009ACBC407D90929CC0932CD9
MD5 SHA1 SHA512 TLSH

Submit Download

CEJVMTI.dll

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dlls\32\CEJVMTI.dll
Size 49KB
SHA256 7bd0d77fd790215bb67337f9f210b05aaab0193d105b8ff86ec422e9875eb033
MD5 b02fa5c8eefbcd010aaac97a94ff62bb
SHA1 fd88f2fc529515252cbcab507f322b080853c38b
SHA512 1d18cb2cffbf83ef949c2a34fa28c4e011c623c62ce743c7f320db1acfbd41bea2ea6d3f0d93a34874973fc43367d6562c630f8b7912b22be7ccc61851001a18
SSDEEP 768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR
TLSH
T16A330943A7064CB3E55A277870A2E376846EF96973CC09C75F222F0D47912F1B6B835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CEJVMTI.dll

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dlls\64\CEJVMTI.dll
Size 60KB
SHA256 f107dd69b4115864d289f364fafc0e045fd3e9fc4bde5586ce8c1bcf59cc65a7
MD5 cefc5c56720ca850ccb20faf47733bd2
SHA1 55f25cf4a7de12607b085e8cfdba0383f0207e9d
SHA512 1b6fba56feac4f4345b2f6ced82a3dddacc3c0cb6f49c1d30105a8156b8de851e34b9e31478c658c60d907c9f26237d2efb7c2ab85adb49905fdcca6349a4dee
SSDEEP 768:wm0hfdOrlHVzBkzORZN2UE0TjwNwqGN4cOlA/eQ4z:wNuVBaOohMFOlA/
TLSH
T13A531509F61554E0D86BE47CC257AAB3E67270D99B68A7CF4F204BAA1F173F0B130619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnetinfo.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dotnetinfo.lua
Size 86KB
SHA256 6860e3ce3127d0b7ed33e5b7769806bd365bc55b6f60d6c2926a55470b0ad94d
MD5 4d543ddd563353fc5c94d3d819f87a50
SHA1 3060460adf8a7ffc75d68d36c62a75b98a17a91c
SHA512 84b54468715e01afe64a7f76b2919a7507e2e1977bc9a314a8bcb8be922437d636d8eebf2d8a8511b733a99d5a7a30365808142f53b0590313826ce8d54db346
SSDEEP 1536:L1asR9DFrlWVneu5BYfZMB3tkFVZBzKq3mp9P53MZwvLdbKE:L1aKFrcneu56fZMB3tsV7D3mp9qZwvLN
TLSH
T1E783224A751337FB428B416E64CA48025F133023D5496EA4BBFC40963F6836EA5FE7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnetinfoCreateInstanceDialog.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dotnetinfoCreateInstanceDialog.lua
Size 1KB
SHA256 f6f998ad838fd8a851d342b0a7d36e62acb411a6d3d2b8350c27f296b08c34eb
MD5 3aa2eb16e228b8df69d907d4f49de24c
SHA1 9194d0ebae2f0975aff5df051169e4404b8c12d5
SHA512 8198e9ddd0883602695d5e3e15f14ac8c65886a7aac58a5067ab22ed234b32ac57736338e2db60ddcefa7ab3a22dc220b3b4e9dc926e681c1df649628f29d9b0
TLSH
T14241BB4D772273B165CE81EA68C2191396862057E10D6E89BAFC80203FD637992FB76D
MD5 SHA1 SHA512 TLSH

Submit Download

dotnetpatch.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dotnetpatch.lua
Size 7KB
SHA256 ef25316d45ad4e9c95908f24ce77fad3f9064178a18bc87fda02001cc835617e
MD5 01105e6712c4a3bc94dfafd16b17e174
SHA1 39c267a31e15d8a49467c33d883fc5a388282e85
SHA512 78fe71cf3afc2f5433df65052a349e6ec153547a16217912a911e6ec40908df121d5c0b7b29e41c7eb62f5e3258ec248cf5dfe9a0b55f9041d3fab0f6c3ef35d
SSDEEP 192:9saDN+JwDFJvJBomthd7HZmMgm7ZNpcJA1dH3:iZqFJvJNzMG9V
TLSH
T135F1D1061D037279835ED39EA8CB144F97992093201F2D51BCECD1552FA17ADEABE3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnetsearch.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\dotnetsearch.lua
Size 14KB
SHA256 bbeb416c5f937a565ab4acbc69754094a63ea95ce61e6e6b0696a21766b038f8
MD5 ff21e8fdd315b89045cb9226e8899889
SHA1 681fc211a566cf95824b2f4151afeb1800da9cc5
SHA512 4bc7605220421f4934a6ee6b96d5292ba3156937f0ddfad0af6ca6fc1ddf6954173caf07b7bc33a66ea61f47963a6a3a431a104925cc20acfa972069b5ad6264
SSDEEP 384:qeJnJ0JEJo4JEJqDJRzJv3wD7RH0TYQ6Nc+RItzIzIiOP2x0WI3C3+jyTsgfEJY4:qeJnJ0JEJo4JEJoJRzJv3wD7V0TYQscB
TLSH
T11662341B650032FA51F3447D29D398DA1A22610389C11F54FEEE90C23FB43AE65F63AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emurpm.frm

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\emurpm.frm
Size 1KB
SHA256 931db1b793e0921713998b0789732e13c8d479f15186456b1e2fb9746322732d
MD5 fa01b87f59a9a20a794004e1421fde53
SHA1 d14059dcbaba7cfa649256c711e68adcac9979bb
SHA512 5d77e5635efa2a4928aa28b7f77025ce87bdf4656ea2b9376d699dec92689e7cc7186929d775c1d605261d799c0fbad6367da0759cac6d199aa75f33f598b40b
TLSH
T19521B62FFEA761595F75D362436AC3C23400A725C400EE4AF9C0E6C6E11A68AA8C2E58
MD5 SHA1 SHA512 TLSH

Submit Download

emurpm.lua

Path C:\Users\Admin\Desktop\stckz engine\stckz engine\autorun\emurpm.lua
Size 8KB
SHA256 8806ea82a0115d322110fe9fcc60796398daeff28ed1c220fe36269462dc99dc
MD5 d480b6929eb8a674ceb6c8b33c75d446
SHA1 f590d9aad3a756c6255b2c3d45997bf7107afc1a
SHA512 566d041d96c50742cf9d048b89aa1cf71eb713714f902fff147c45494308822f14044c7aed9b7792e3a27b261d0e9201bd4efa224e9e662e3f2d29c68327ab1b
SSDEEP 192:FKC00Sa8kUuoCzC9c/nmJffso1BrsVj1Am+CD+0Ap+FcfzZQ3aka:FGBnLA/nIffso1VGj+m+CO+ufzlx
TLSH
T1FD02A975210E7BA91EF143A8FE812293D705D0874CBE482875FCC02297F56B98BB966D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stckzenginev22.zip

Path C:\Users\Admin\Desktop\stckzenginev22.zip
Size 19.2MB
SHA256 c7ab4b699d82cc143d682400931bc1e26b26025bb42065722a9c6ba9dd53b412
MD5 bdf8478903febb1434ffabb57833787b
SHA1 d87d8bf571c3f6ec31ddba81efe0145b78eee8f1
SHA512 a593c004c26f68091bf5c2c79d5cd3fbb6981aa34bb585df87a28188bc6e7a9f44205ef1c7805190c3827ee934ee9b6ef9c842c2185551a674f593e8fd46f057
SSDEEP 393216:ysS3nZhj/+FkDqcaFXous4pQd/qkXUqLCv8WJBTlWotfim9AkZo8:ysSuFkU9pQBqkkqOvzB0otrAkZo8
TLSH
T15E1733B0D4B4082AC36EE7743CF52109FEEB49A55592D4266CE4278369CF283377A973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-722.exe

Path C:\Users\Admin\Downloads\winrar-x64-722.exe
Size 3.6MB
SHA256 bbc088fc6e1b99042567144cd6601901d955703d8062e299bdb91ea7f869436c
MD5 a03af0edbd39e51377977a17184b0960
SHA1 35039beb903ed4d8b45d89d2165bea330d78a08f
SHA512 b064aebe7e9c3362d7509ed735fa5e045ee78957caecfe65d01442ffd256fb064f6f8ca11d7ef4cc773d79a31542511d1a7b038bdd44f328b2b113bec7d6d1d2
SSDEEP 98304:x4BA9vcjkuKA1ukzK5P/HVPpu1l700HzTEt:ftuKA1uk25nHVPE3oEct
TLSH
T12906232DE3D154F8E27BE634C8A28607E6B23C9E5760D2CF23E5169A1F376904E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-1378-0x0000022180E50000-0x00000221812C2000-memory.dmp

Download

memory/2664-372-0x000002530B450000-0x000002530B8C2000-memory.dmp

Download

memory/3340-1296-0x000002E4E1590000-0x000002E4E1A02000-memory.dmp

Download

memory/3772-1397-0x0000019C8E210000-0x0000019C8E682000-memory.dmp

Download

memory/3772-1396-0x0000019C8E210000-0x0000019C8E682000-memory.dmp

Download

memory/5148-1759-0x0000000007D50000-0x0000000007D51000-memory.dmp

Download

memory/5148-1755-0x0000000007D50000-0x0000000007D51000-memory.dmp

Download

memory/5148-1761-0x0000000007D60000-0x0000000007D61000-memory.dmp

Download

memory/5148-1763-0x0000000007D60000-0x0000000007D61000-memory.dmp

Download

memory/5148-1751-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

Download

memory/5148-1749-0x0000000006FA0000-0x0000000006FA1000-memory.dmp

Download

memory/5148-1747-0x0000000006F90000-0x0000000006F91000-memory.dmp

Download

memory/5148-1746-0x0000000006F90000-0x0000000006F91000-memory.dmp

Download

memory/5148-1753-0x0000000007D40000-0x0000000007D41000-memory.dmp

Download

memory/5148-1765-0x0000000007D60000-0x0000000007D61000-memory.dmp

Download

memory/5192-9-0x00000000005B0000-0x00000000005F5000-memory.dmp

Download

memory/5192-1745-0x0000000002DC0000-0x0000000002E93000-memory.dmp

Download

memory/5192-1375-0x0000000002DC0000-0x0000000002E93000-memory.dmp

Download

memory/5192-27-0x00000000005B0000-0x00000000005F5000-memory.dmp

Download

memory/5192-12-0x0000000002DC0000-0x0000000002E93000-memory.dmp

Download

memory/5192-10-0x0000000002DC0000-0x0000000002E93000-memory.dmp

Download

memory/5828-1072-0x0000017369480000-0x00000173698F2000-memory.dmp

Download