67318067cb47d58ff2b143a09d879f05485dd9f0233ccd2ad21d9e9b8f8e7fab

Analysis

user interaction
yes
max time kernel
1232s
max time network
1220s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4hnp2bb.exe
Size 900KB
Sample260531-st2sradv2n
SHA256 67318067cb47d58ff2b143a09d879f05485dd9f0233ccd2ad21d9e9b8f8e7fab
MD5 422a9c9b9487833b2487397729bcaa2c
SHA1 98da48586f40305b616c9332c2e90a6e4b4cc3a9
SHA512 33d26eac323004e40c7327045f6fb62df53cf75009d98fd7f1022d8b25110402404069ae627f360af03e4a78f66c980d4d995fdc9169f9baf9130ab27200f70e
SSDEEP 12288:4hZ5H2ggb3067PrTcmD1WOuZW/o1klZzVfRFgXmkR+ETi4DvHOl2:W/DOzPsmD7CW/oWPZfRa1JTi4Gl2
TLSH
T161159D05E55853BBC59A41B78AD1336BC261FCA40379CAF723E03F681B469E45BB1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-722.exe

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
199	2644	powershell.exe
203	4488	powershell.exe
208	2648	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe
2644	powershell.exe
4488	powershell.exe
2804	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
197	2940	chrome.exe
308	3004	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
4000	WinRAR-722.exe
5360	wrarinstaller.exe
2032	uninstall.exe
3264	RarExtInstaller.exe
5952	RarExtInstaller.exe
1824	WinRAR.exe
5180	RarExtInstaller.exe
4072	WinRAR.exe
1996	asdasdasd.exe
4464	asdasdasd.exe
1620	asdasdasd.exe
2460	asdasdasd.exe
2068	asdasdasd.exe
2192	asdasdasd.exe
4660	asdasdasd.exe
1080	asdasdasd.exe
5188	asdasdasd.exe

Loads dropped DLL 64 IoCs

pid	Process
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
4000	WinRAR-722.exe
3248	Process not Found
1104	Process not Found
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
1996	asdasdasd.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 4896	1996	asdasdasd.exe	168
PID 4464 set thread context of 2480	4464	asdasdasd.exe	173
PID 1620 set thread context of 5712	1620	asdasdasd.exe	209
PID 1620 set thread context of 2060	1620	asdasdasd.exe	212
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 2068 set thread context of 4852	2068	asdasdasd.exe	228
PID 5188 set thread context of 5612	5188	asdasdasd.exe	273
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276
PID 5188 set thread context of 2672	5188	asdasdasd.exe	276

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1996-3029-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/1996-3030-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/1996-3031-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/1996-3033-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp	upx
behavioral2/memory/1996-3055-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp	upx
behavioral2/memory/1996-3054-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp	upx
behavioral2/memory/1996-3056-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/1996-3057-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/1996-3058-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/1996-3059-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp	upx
behavioral2/memory/1996-3066-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp	upx
behavioral2/memory/1996-3092-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp	upx
behavioral2/memory/1996-3090-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/1996-3118-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/1996-3120-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp	upx
behavioral2/memory/1996-3128-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/1996-3133-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/1996-3132-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/1996-3134-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp	upx
behavioral2/memory/4464-3135-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/4464-3136-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/4464-3138-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp	upx
behavioral2/memory/4464-3159-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp	upx
behavioral2/memory/4464-3160-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/4464-3161-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/4464-3162-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/4464-3163-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp	upx
behavioral2/memory/4464-3189-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp	upx
behavioral2/memory/4464-3187-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/4464-3192-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp	upx
behavioral2/memory/4464-3217-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/4464-3219-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp	upx
behavioral2/memory/4464-3228-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/4464-3232-0x00007FFA03370000-0x00007FFA03500000-memory.dmp	upx
behavioral2/memory/4464-3233-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp	upx
behavioral2/memory/4464-3234-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp	upx
behavioral2/memory/1620-3481-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp	upx
behavioral2/memory/1620-3482-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp	upx
behavioral2/memory/1620-3484-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp	upx
behavioral2/memory/1620-3505-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp	upx
behavioral2/memory/1620-3506-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/1620-3507-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp	upx
behavioral2/memory/1620-3508-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp	upx
behavioral2/memory/1620-3530-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp	upx
behavioral2/memory/1620-3538-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp	upx
behavioral2/memory/1620-3534-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp	upx
behavioral2/memory/1620-3537-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp	upx
behavioral2/memory/1620-3584-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp	upx
behavioral2/memory/1620-3587-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp	upx
behavioral2/memory/1620-3599-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp	upx
behavioral2/memory/1620-3600-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp	upx
behavioral2/memory/1620-3598-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/1620-3601-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp	upx
behavioral2/memory/2460-3602-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp	upx
behavioral2/memory/2460-3603-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp	upx
behavioral2/memory/2460-3606-0x000001A4229C0000-0x000001A422FAC000-memory.dmp	upx
behavioral2/memory/2460-3605-0x000001A4229C0000-0x000001A422FAC000-memory.dmp	upx
behavioral2/memory/2460-3627-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp	upx
behavioral2/memory/2460-3628-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx
behavioral2/memory/2460-3629-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp	upx
behavioral2/memory/2460-3630-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp	upx
behavioral2/memory/2460-3631-0x000001A4229C0000-0x000001A422FAC000-memory.dmp	upx
behavioral2/memory/2460-3637-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp	upx
behavioral2/memory/2460-3687-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_241051968	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	4hnp2bb.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\MY TOOLS\MemPhantom.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\x64dbg.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\4hnp2bb.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\WinRAR-722.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\4rchan.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\loaddll.exe:Zone.Identifier	WinRAR.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR-722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	chrome.exe
2940	chrome.exe
3004	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247149776733993"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{18161868-0949-481E-BB12-8D3B69D32EEF}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\x64mod.rar:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\4rchan.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\loaddll.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\create.bat:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\plugins.7z:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\WinRAR-722.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\MY TOOLS\MemPhantom.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\off.bat:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\on.bat:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\x64dbg.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\4hnp2bb.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
920	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 9 IoCs

pid	Process
1996	asdasdasd.exe
4464	asdasdasd.exe
1620	asdasdasd.exe
2460	asdasdasd.exe
2068	asdasdasd.exe
2192	asdasdasd.exe
4660	asdasdasd.exe
1080	asdasdasd.exe
5188	asdasdasd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe
3200	4hnp2bb.exe
3200	4hnp2bb.exe
4580	4hnp2bb.exe
4580	4hnp2bb.exe

Suspicious behavior: GetForegroundWindowSpam 12 IoCs

pid	Process
1052	OpenWith.exe
1996	asdasdasd.exe
4464	asdasdasd.exe
1620	asdasdasd.exe
2460	asdasdasd.exe
2068	asdasdasd.exe
2192	asdasdasd.exe
5056	taskmgr.exe
4660	asdasdasd.exe
2392	taskmgr.exe
1080	asdasdasd.exe
5188	asdasdasd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe
5056	taskmgr.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
4012	OpenWith.exe
1996	asdasdasd.exe
1996	asdasdasd.exe
4464	asdasdasd.exe
4464	asdasdasd.exe
1620	asdasdasd.exe
1620	asdasdasd.exe
2460	asdasdasd.exe
2460	asdasdasd.exe
2068	asdasdasd.exe
2068	asdasdasd.exe
2192	asdasdasd.exe
2192	asdasdasd.exe
3568	MiniSearchHost.exe
4660	asdasdasd.exe
4660	asdasdasd.exe
1080	asdasdasd.exe
1080	asdasdasd.exe
5188	asdasdasd.exe
5188	asdasdasd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1040	3200	4hnp2bb.exe	80
PID 3200 wrote to memory of 3952	3200	4hnp2bb.exe	82
PID 3200 wrote to memory of 920	3200	4hnp2bb.exe	84
PID 4580 wrote to memory of 4200	4580	4hnp2bb.exe	88
PID 3696 wrote to memory of 5104	3696	chrome.exe	93
PID 3696 wrote to memory of 1412	3696	chrome.exe	94
PID 3696 wrote to memory of 1412	3696	chrome.exe	94
PID 3696 wrote to memory of 2708	3696	chrome.exe	95
PID 3696 wrote to memory of 4708	3696	chrome.exe	96
PID 3696 wrote to memory of 4708	3696	chrome.exe	96
PID 3696 wrote to memory of 4720	3696	chrome.exe	97
PID 3696 wrote to memory of 4720	3696	chrome.exe	97
PID 3696 wrote to memory of 2256	3696	chrome.exe	98
PID 3696 wrote to memory of 2256	3696	chrome.exe	98
PID 3696 wrote to memory of 2752	3696	chrome.exe	99
PID 3696 wrote to memory of 2752	3696	chrome.exe	99
PID 3696 wrote to memory of 1964	3696	chrome.exe	102
PID 3696 wrote to memory of 1964	3696	chrome.exe	102
PID 3696 wrote to memory of 920	3696	chrome.exe	103
PID 3696 wrote to memory of 1108	3696	chrome.exe	106
PID 3696 wrote to memory of 3452	3696	chrome.exe	107
PID 3696 wrote to memory of 4876	3696	chrome.exe	108
PID 3696 wrote to memory of 4700	3696	chrome.exe	109
PID 3696 wrote to memory of 4700	3696	chrome.exe	109
PID 3696 wrote to memory of 3280	3696	chrome.exe	110
PID 3696 wrote to memory of 3280	3696	chrome.exe	110
PID 3696 wrote to memory of 3036	3696	chrome.exe	111
PID 3696 wrote to memory of 3036	3696	chrome.exe	111
PID 3696 wrote to memory of 1836	3696	chrome.exe	112
PID 3696 wrote to memory of 1836	3696	chrome.exe	112
PID 3696 wrote to memory of 3192	3696	chrome.exe	113
PID 3696 wrote to memory of 3192	3696	chrome.exe	113
PID 3696 wrote to memory of 4288	3696	chrome.exe	114
PID 3696 wrote to memory of 4288	3696	chrome.exe	114
PID 3696 wrote to memory of 3284	3696	chrome.exe	115
PID 3696 wrote to memory of 3284	3696	chrome.exe	115
PID 3696 wrote to memory of 4376	3696	chrome.exe	116
PID 3696 wrote to memory of 4376	3696	chrome.exe	116
PID 3696 wrote to memory of 1108	3696	chrome.exe	117
PID 3696 wrote to memory of 1108	3696	chrome.exe	117
PID 3696 wrote to memory of 2868	3696	chrome.exe	118
PID 4336 wrote to memory of 1000	4336	chrome.exe	123
PID 4336 wrote to memory of 4544	4336	chrome.exe	124
PID 4336 wrote to memory of 4544	4336	chrome.exe	124
PID 4336 wrote to memory of 2940	4336	chrome.exe	125
PID 4336 wrote to memory of 3300	4336	chrome.exe	126
PID 4336 wrote to memory of 3300	4336	chrome.exe	126
PID 4336 wrote to memory of 1980	4336	chrome.exe	127
PID 4336 wrote to memory of 2264	4336	chrome.exe	128
PID 4336 wrote to memory of 1980	4336	chrome.exe	127
PID 4336 wrote to memory of 2264	4336	chrome.exe	128
PID 4336 wrote to memory of 1208	4336	chrome.exe	131
PID 4336 wrote to memory of 1208	4336	chrome.exe	131
PID 4336 wrote to memory of 3328	4336	chrome.exe	132
PID 4336 wrote to memory of 3328	4336	chrome.exe	132
PID 4336 wrote to memory of 1320	4336	chrome.exe	133
PID 4336 wrote to memory of 2512	4336	chrome.exe	134
PID 4336 wrote to memory of 2512	4336	chrome.exe	134
PID 4336 wrote to memory of 704	4336	chrome.exe	135
PID 4336 wrote to memory of 704	4336	chrome.exe	135
PID 4336 wrote to memory of 4156	4336	chrome.exe	136
PID 4336 wrote to memory of 2820	4336	chrome.exe	137
PID 4336 wrote to memory of 4156	4336	chrome.exe	136
PID 4336 wrote to memory of 2264	4336	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe
"C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:1040
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "VgcYamlGuard" /f
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "VgcYamlGuard" /tr "\"C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe\" --patch-yaml" /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:920

C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe
"C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:4200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa0702c728,0x7ffa0702c734,0x7ffa0702c740
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,6849226521646384586,2006551873994200768,262144 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,1755093159816117543,657039726158694977,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,14568950174135830542,2329484483698608191,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,11699067335084671487,17401586024395338332,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,9790568634574208943,14268991553897867861,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,12951744236240350485,11935155102509010604,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,17931825493109601380,16372413275927259813,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7708468517498029048,16313339237130936688,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,12820998430563521791,14256327227302439857,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,10278494962211689525,10326859934074419205,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,5688344331009343164,6781139782815182395,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4352,i,1784808611977512851,13355062323767053734,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4724,i,13846169734604050170,12732511710336514414,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3708,i,5181965333749973319,6216000989171139014,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5952,i,9309043022628892007,8125192594272869042,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5880,i,5817399960304570004,677612431644232236,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3644,i,12545502092812430035,3159698555790392513,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5924,i,16651159787526527851,16337355477556744587,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4376,i,10871327399929271749,2109051171059345513,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6244,i,17809951682448857960,17602433465614396929,2097152 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,10120314879257457571,17639248484190618668,524288 --field-trial-handle=1908,i,10240325673971101213,14173020882825539626,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0702c728,0x7ffa0702c734,0x7ffa0702c740
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,6957301018392240243,16075128177384628139,262144 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,1695839191941738422,1846125311101490302,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,5437679336874567724,1627116541640894822,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,1258136487195634006,15334116416031708651,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,5990066501660311483,13112517558001722482,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,14328012081894784902,5046255659866094216,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,13535913261678343102,8908741945823557038,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,12945375398370433576,15481901626434593206,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,1726907652961733172,1948641559473379282,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5372,i,434446733921633327,13158103298913605344,2097152 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,6661624625244996252,4074944511983136374,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3452 /prefetch:12
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,4735766818169472329,17273420629040044394,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,14064461891379455610,13326864644991330700,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,4760186615842479009,904975014211047311,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,10578166407468823847,15628201917637715049,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,3875172970636487523,12638018337749266963,524288 --field-trial-handle=1884,i,10905795056629825047,3000831814875641355,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2552
- C:\Users\Admin\Downloads\WinRAR-722.exe
  "C:\Users\Admin\Downloads\WinRAR-722.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-722.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5360
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Drops file in Program Files directory
      Modifies registry class
      PID:2032
    - - C:\Program Files\WinRAR\RarExtInstaller.exe
        
        "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
        5⤵
        Executes dropped EXE
        
        PID:3264
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2648
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"
    3⤵
    PID:5776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:5952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5124
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1824
- - C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
    3⤵
    - Executes dropped EXE
    PID:5180

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Desktop\x64mod.rar" C:\Users\Admin\Desktop\x64mod\
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:4072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5772

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1996
- C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:4896
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:1328

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4464
- C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2480
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:3412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0702c728,0x7ffa0702c734,0x7ffa0702c740
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1548,i,2075922538144507020,9125249483594871996,262144 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,17673731436609043164,10029362780117716517,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,13414754216033601033,16944412747817799355,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,11107190109606712913,11312590597386605199,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,9962434240730761425,7501864673444066573,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,14082646350199240377,2879551351319813046,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,17508301237474334545,4550310421153540377,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,7348397420421929463,1672922135298345048,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,15588318058892294466,6622156491509211604,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,596394643307010891,18071844865784996209,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5576,i,17650483308803696978,3170462344250482859,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4556,i,11481291220136264916,17860641636221090634,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,15661786313097893211,13471363642623999925,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3276,i,2166243631350782649,4207791598010394798,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3444,i,409780527117468965,13538582205081473237,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6084,i,3515398705714616896,2580219872427462596,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3348,i,5438274060211236337,10096828003906503005,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5280,i,840026058900729602,13876933241397339653,2097152 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,8714828282682394009,4332224931225611523,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,7148544149545587872,17978725306188568388,524288 --field-trial-handle=1928,i,1966940093764367530,2102515586624628068,262144 --variations-seed-version=20260530-030043.971000-production --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5644

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:1900
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:2068

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1620
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  PID:5712
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:5560
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2060
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:2428

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:4724
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:2232

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2460
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  PID:3592

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:3268
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:2404

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:4852
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:5240

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  PID:3884

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:5860
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:3600

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
PID:2292
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3800

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3568

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5056

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:5300
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:1368

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:2392

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe
"C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5188
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  PID:5672
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:5612
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:4644
- C:\Users\Admin\Desktop\4hnp2bb.exe
  "C:\Users\Admin\Desktop\4hnp2bb.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2672
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "VgcYamlGuard"
    3⤵
    PID:2996

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
PID:4052
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:5464

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:4628
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:244

C:\Users\Admin\Desktop\4hnp2bb.exe
"C:\Users\Admin\Desktop\4hnp2bb.exe"
1⤵
- Drops file in Program Files directory
PID:4620
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 b35ff0d49825c222aa5af767b2ea6d04c5324b8c2de68e2d7b257bf8f2dedf87
MD5 150ab639be8319e6b030557c434f4305
SHA1 4d3d6d61f9fdc089a7e653a98b1786f6bd91f3bf
SHA512 44823fc75f74149728cf4725daa66eaae4898efeef99b8e8fdb5e9f8f13dcd34b6b46ed8dd4b6134bf7365e857fd384753cde5dac63077a5c91629718bc47ec1
SSDEEP 6144:aljRoo4zIa63bknS2ecOTJDPvDOnSfIHbqeC2PIII+Sn5HBK7jcRkj6:KjF3QnS2EJzLOSwxC2PIIvS5ejc6m
TLSH
T125948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 1e4f54776b1b40b456dd805327615b3c5deffcf2db33e589d5bc6b52bbcd1933
MD5 56b10e1e74b6706b57dde96bf766dbf9
SHA1 56a34e375e70b12c244295648d6e0641f33011f6
SHA512 cf469396d294424e4fef7dd376eea71d95d97f34c8e8a07031474ca3189e64ade1b89bd27e7df381f2778fea721f119ccd253914777f827b6f0f4644ac130a61
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a4d139cf6e85a8b9ebc7580f6da3a5ba171de7e4d517d503c1ff0325efb382a6
MD5 e7fe30b3e8165903628790fa8a15d9f7
SHA1 821cd4efd81315c0618827d04d8b5c979beea04c
SHA512 8747f59acb44b0a97f95d3c01844eb31add78f77a15d1c42962176156d9bec54d16ea57318c471d37b9c6dfe00268466739ff9ceab61ac1f757a643d9bc08d2c
TLSH
T110F0D1A6CC21AC3718FD172920A41B47F755136B2B8149AF3A3D920D8FB463B418596C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 374KB
SHA256 aa5482a1cb0e0e9fc7a09d90ce82d48765958ef2de12bb567c9a9dda0e70fe08
MD5 573e467d73dbee9c030ab6dd911a4ba9
SHA1 a7b2b2064ed4736ef28f3cb83c8d465343516927
SHA512 bc46278aae28a4c5952e9db988efae23e53d6e1eb3edf8bb92535ac93aabbe5cd97ed43b301722c61a0d692fa1f99d356822ade6f0b769d47be741ecff5516fe
SSDEEP 6144:2FMjqfaRkLaFLdTF5AHl+qC6naJJwUISq/1uwj+mN+MBtpc3WhHfVl:JjjCOFLdTF5I+qbaLV+yA+AtqWZb
TLSH
T1C98423A376B1F0AFDEC8697F03C63363A598B531B7D019C61D48B2A6122735C9FB4264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 bea9e31f9c0641ddcef010bc9ccd034bd3b8290180fab3b7003492ffe040a856
MD5 b78e082c093622ac49540fb83c345b57
SHA1 8be5646e62c5ec37e2297ae03878bb84b867a3ac
SHA512 8c473b9fe29392ea07fd57f7722ab2fb66a24ba6cb2a276452e5f0ec8ace34ce93efcc53b1a6ee244ce06afd7ff3becfaea47e891ad163cbadb1050a22495865
TLSH
T1F001F41474C0183AFFE5417248F00C5D24F059290D2B6F236B57CCE85A837ED908E9CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 07b8485e797711190f3b2f28b93c5cb753a59596e7541e24100569176a836efe
MD5 995c4cd7114d5e38ab662dffe3276d17
SHA1 c6f5e45278437632da805f2265cec5c89a0fdb4c
SHA512 26c31344f77ae7971a6b8d05886ca7a8f96cce99c8fee140746d7ebd154048cbbde3a275414152da28c49c7cf482ffc9ea3c188585235dc2f1dc69be7d666f9c
TLSH
T18A419928B0C48871EFF51A7508E15C9D55E1BA980CAA0B57CB57DDE4AA43AF8A0CC583
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ed1acafb2c07b869c24bd5d7be3f6bc73adbc5d425c16a3d8efdde797fa4f47b
MD5 78ad7f157d0fcaa5ca8425f3a0d68371
SHA1 10b3654235a95825b022486be7165e60806b3a1a
SHA512 5c5b6be41fc68c40e3c72f05c521662945a7fd381484a8ef4dcdb5dce1b5c74b873dcde93906413b5f3363a0d737fcf89fe960b785ecac00586dcb0f092a228b
TLSH
T18F317724F4C44875EFE513B208E18C5D24F09AA50C7A1F678F53CCD8A643BE890CD587
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 984142bc0cb34bd1e53acab107cd9f798f451d2b5c188fc31898f353f48f9919
MD5 9cce0f5a0ca3bcdb187ecbbf6b74e519
SHA1 37858954a02436a85a887e9d46148726ab4be16a
SHA512 8cbd59f2b8d28e94aa799f70c39102948b46678dd43e60a8ac0f69ee57677963f8a34d9751fc8e9db6c655bc060136a2ed0d0b42186aab45bb2e42725649af27
SSDEEP 3:MsEllllkEthXllkl2zE/lt/QU+l:/M/xT02zsQp
TLSH
T15644040C7FD0DC07C55011704051C3541371D4110713D743355104735FCF7410C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 314B
SHA256 aab64ac8320348adf4d4320f9203a7b84b2b9c39a2b114996b532aea74cae9cf
MD5 f0dd740bf2eccb87c1b9b0aedf329c27
SHA1 e36a02815a2e9679fad172d1ef0bac2932aaf673
SHA512 c1ae36ea625994a8a8c7f4e7c20e9c468516058d17de78bca78fb9b6e223c6ab2cafbbe476dc5174a09afcaa153821dced9264a3e4322559f88af8953cc3ef4a
TLSH
T17DE08685288DD7AD616484F387BAA34CCFD43405E6D83C531705E480329290462BC2A5
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 20KB
SHA256 260f52059f23bad5c66c7bebd6262c9e373936e2e611e16d28a747c3ed0134b7
MD5 a0f8f0f434818992ff0bb080287d49ab
SHA1 2bc2c1dfceb6ad81054ea38a70b224251dc269bc
SHA512 654c419986878250394d4741bbcc7e28b9799d0253a7fbacad81303343bf1a0fb5d4200a7a130676a5ee2dcd303d479df4601607e92a2fa6902528ee35b0a5bc
SSDEEP 96:deBCP7Gt1+wwwomw/zIuGkmy/g51PO2ud:dcJBwwDwrIuzmy/81a
TLSH
T1ED92C5979A343907EF955DBF220E21F5CA37C6AD6FE69C6C385408348D7C292A03467A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 4e7ab052bc3c762d876ff4aa1dbc47b9887ec3699989a6f8123ffdcfe8baf66b
MD5 4a3e3a25db5928172b847844931e14ed
SHA1 5899a71233fbb839c06b2f09385e61a2895cef69
SHA512 427821b8139d2b38a99edddd278a2a0676069bfd54ed34b15faf17f10a7125dd726a6757e9ab2b29e7b38ed714e19bb5e271208ad05ce3d63914bcd7750c7e4b
SSDEEP 96:Z8/j5jo/uejzH+bF+UIYysX0fxQp97JEHt/DfLcLq2piRk/E0Ttx:WFM/tH+bF+UI3iWGVJWNkqp3Gx
TLSH
T1E0F320AF5F343302CDBD817768E345F7596DF06F8753668A5C6508B0CEE2652A06C0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 7KB
SHA256 329fab6b3befbdc66bc22a7171dd38c8ce16aaaf41be60c9d2037849f0ed6e80
MD5 25f912e505afd149b1097123f5774d75
SHA1 9a7712d9275b16df20216ccbb009daaa18f5da0d
SHA512 c8cbda1b314d7eaaa538d8e933fe1ae4e8467c678efa8d0c5535480ed9a57b39aae254e2ba184755bd7e2111a0d678aa34da91e154fc7b9be0f0f3a7386b8d7c
SSDEEP 96:gWeEnNEWAEJ+LEJHEJ6EJIEJTEJkEJeEJ1Mh+kjyj+5kdJs9jDj+noqmFEzBwdR3:tniWVB+dfGLhzQHwBM4YHN07ny1Fq+
TLSH
T10EF100E6EB914F359FD387E8FED1204AB54FBD1B384FDAAA42415A0C0D324191B51A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 16242d00265b01e52ed34ee52a560b101edefe1f4d8fe3d08f03a545fecf1fba
MD5 d2bbbcca38cca3bc6c8518fb0d2efcda
SHA1 28c00113cc39df4ac5a570a3adb0da7cb2990592
SHA512 4f27423ba249366d18aa2e144d76d0987c7bdff4b9890cda4f9cf9d47fd2dc357767fe0688b5ab4c79325c3e6208171e0fbf926ed833de37c2ea2d981eca6a5b
TLSH
T1BDE0D895298DC25D620480AB8B29770CDBE03409F6DD2D820B0CD44471D5008D2FC296
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 164f4fc29812950694f7945b9e428e3375a78412cac1882d156d0cd9218fcc48
MD5 acf077a404a3113116e10a3f76ebd635
SHA1 ef67bccbbd09f1142baef861cc2dc6b99ddde488
SHA512 b11a67f2827177992eb6cbedd4220e4dce0f78d47e42dc446927279b34522ed9aae95475dd0ed447c8dd8aa7568c6b44883c23e77b920c2689cb46d27fb0e36f
SSDEEP 384:DOZ0LLo9JyQ2ofXJt8cHMxeHl+6Be3TWwlLTMBpK5cIuoMV7tHM4kCGbbsuWuiSV:o3q+DumDX3zQsm
TLSH
T147A299F7C3F8C66E8C1192F9AA24AE2FCD5A0A15436C3C1685D9AF4BD3E1831D25194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 d8555592a70de453ffbdfae16c034b86c239af3c2371f6f3fbf22a8b57fbb026
MD5 7af4c2c6a2feec328dc86d71ec9548db
SHA1 b390a2dfdf96480ca3d07f008329e840acd726ef
SHA512 2e518879f298758369df73dfe9d4a7e33987bbdb09fec8498250e427990fc908f36780bfe3ff141f100e798933391c773a8bac9b9e1c7cb045cd7e5366b90726
SSDEEP 384:DThXKsG/eR3cq2Y8nkMnBeRJwJnjzZc0nCBcIu2pMQOMCrikhMVVlBaLsQHyRRhh:osuBq1oJzzaSA
TLSH
T146926AF7C3F8866D8C1192F9AA25AE1FCD1E0A15432C3C1685D9AF4FD3E2871D25194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 df6e236f9212adfd727bd6b2deaf92a2c993271bef8bb8ed029e51509c346efc
MD5 20eac2602fa5470e9f8e611d3e95e00d
SHA1 3578b36360ee9fed5e86245fe381bde272123f37
SHA512 63e793ca14e752643db0024b2015baf065ba81e7e9b96ab641315370a791f1b61bb991cbfb46e7cef6986fd3044c3a85095ec909fb15e4891845fe13a8c68767
SSDEEP 384:DThXKsG/eR3cq2Y8nkMnBeRJw5cIHlCpVqHpMQOMCrikhMVVlBaLsQHyRRh4kCGk:osuCq1oJzzaa
TLSH
T11D529AF7C3F8866E8C1192F5AA246E1FDD1E0A15436C3C1785D4AF4F93E2871D2A194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 d60dbb806e642ca7ab678f1bfe8a2c4a41e3a100855fd045afd5df0a4e4b7df8
MD5 0f2da527f703ef2f5703a3f4700c5818
SHA1 e6fa40f759ad59bc48694dd3a583c6b2b9867fe8
SHA512 dca6483f06f5f4798549440b9fe06474c1110fd0536176c0a0087267a0c75215aa4aab2d04143361a2be71ca53fc9715b878b484d3a0cf2d142fdc06ca9ac78a
SSDEEP 192:eIEumQv8m1ccnvS6sfXw0a965eJBbLrATonZshNsKB:XpXma9TJBbwEnasW
TLSH
T127F20DFB2634D251D4A082F4E0245E8EFF63110753FEBBE592511AF3D1D90E298B8E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 7bc8c0c5b798d87fe4535c14481b2da7cd7b07462332bfbf5a8c6ffbb4951d7b
MD5 70fae74899e0386f93393eda6fc52162
SHA1 c9d0b89ef87b56fa9e84f4d5107c2e48357fb3be
SHA512 130f03901e47a343a12b38621607175174ee72d5d2b45bfda84e5bee64ff0e8f283dd6e5b848c5e7d965371924483a25b19d76c188969ba9ce699d1c8e391ca7
TLSH
T16E418EA792BFF46B407C98BB1D48780A69BFB435428168F5CEA6C17DB0C19F31B12416
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 7a3227df76c7672b273c6df061186036d67cf1625a486c92d98c358f7d1f872c
MD5 9948bcce0a9d246cf655d3a64b5e70d0
SHA1 a69029100392a3aac4b36167deaf5871f233cd48
SHA512 ee9fa69d73cecad7b25b450e0a03a3f73239d48bbeff0541f7e9a820e2d6d4389e5408de8805bf7f10d91fb820032f62a64f9684eb19638f2581293683b83eb6
TLSH
T1DB416BA385BEB56B103C58AB1D48780E69BFB435428268F5CEA7C17DE0C19F31B12417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 944cb3e8750cf75180f2198250d3db91e6c74c37b697383d6e05bc39e170968a
MD5 4e27097b1f38efbf62b4fcaa4e73ce2b
SHA1 a20f67e62295178e98ed663e2369e4358c8a648f
SHA512 26acc732949053ffe31aa79ccff3e6ae24f86c27dc5c2597f078b9c9931ce27860ed6c30ec50a9fd73894494f293a78b4c7942e675e3b62cca79acd59375bae2
TLSH
T187519EA385BEB46B113C98BB0D48780E6EBFB435469168F5DEA6C17DF0C19F31B16422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 47386ad54501df859900eb59b2461b72d8fd10492d4f0be25b230adbc5401cc5
MD5 3283f50409510fb500ec1b8e300542d2
SHA1 864fa26dc6d872794034190e2d1a21631dd7f47d
SHA512 fa5fd1be27c754bcc18439b5bc45dcdfe32a57d5e510f431197b37a8006a5b026b73102092a1abb6fe1c0596a6d8419db296270c30db54e466fbaf86bb610cbc
SSDEEP 192:YRbtjG+o3e8v7+hAPRp279uHsb+WNn4Y05X6wGkwLNVyIsnAUgraJ:YRbtLo68XkUwj0VGfe
TLSH
T10942C62EAA15753B9CDBD319F9227B53E7F6112232842E84E6FCCA2C14DB5CC2217527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 088ae3ac6929fd58fc20f9e78404d2cc4a038812a7ce6a1e979f915540394287
MD5 e0280bf96f46f59223520d25b221fa1a
SHA1 bdfc97bfd95dbf8b4f3fd78acbf6140f999a2950
SHA512 218355623574cdc0be2ab16b6cc5dee87d616b6a262a5074a939577dc3249d041b0745d3e7c67eca283f0b9ef94fe66470d5702fda5d585d00be07d6b7b8fcef
SSDEEP 192:YRXZjG+o318v7+hrPRpfLlc9uHsb+WNn4Ybq+2aX6wGkwFNVyIsnAUgraJ:YRXZ0o6lXCUwjD22GZe
TLSH
T17552D72EA915753B9CDBD729F9267B63E7F5112222902E88E6FCCA3C14D75CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4cbe4cdc7d1c218f6e26116e99fcf520d45ae2cd88b92d83b91146c9e586634d
MD5 0a3ef7a44c54f8e0167c55960b881494
SHA1 242d0208809bde206f0755884d89f1da19be2b26
SHA512 30044716c7166513e6a8f01b48d30c57a667919ba96bb8b92d769e94786b239c6b2751c1ebca8cd5589ab9a24db424cd22bc758b6bbb1098ab6a8dba5184f63a
SSDEEP 192:YRbtjG+o3K8v7+hAPRp279uHsb+WNn4Y0jX6wGkwpNVyIsnAUgtaJ:YRbtDo68XkUwj07G98
TLSH
T15D42C72EAE15753B9CCBC31AF9267B53D7F6112232942E84E6FC8A2C14D75CC2217527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 27874f50e64a5a395a69b8946f742b1c020ea6acb37f8969c22abec26d193bcf
MD5 31ae2f71e7b0a89de53adaea2bdaf7e3
SHA1 2cf4a14ee68242a0cc6c312ff6cfa5b7b32b5b51
SHA512 ea15e2d60e63dce7ae166afece8adf8aacd90fb67b7ed701ba2d9f4ece644084f1a0cb9353324d11045ac0b1f2a4e536a8bd310a604c897cf87bcbee67dda74d
SSDEEP 192:8RVcBzQjG+o3Amv7oZcrPRpf4VlBoX9uHsb+WNIs+0BXb2keKweWX6wGkwFhM+VK:8RVmzQFSEZMXRUwlVkeiGzM2e
TLSH
T12662E72FA914653B9DDBC629F9217767E3F9212226D41E84A6FCCE3C04D76CD2207427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c1842185a1c20798655308a84d35bcc06498f83769ce2542a3c675e28676d033
MD5 5df1f3a23e6cd87f31215175ba474d49
SHA1 3fc82be96756f9673c9dac0567b72e7c5fb7abc1
SHA512 993ef096a4fca70b27e555d0d9c30a01988047551b5ff9ff501535d394b5cfec2c7333119c6f2e85ebb25a59ae5b4df2883e28a1d742b0ab821a4486a44392ff
SSDEEP 192:8RVcBzTjG+o3Amv7oZcrPRpf4VlBoX9uHsb+WNDg+0BXb2keKweZX6wGkwFhMqPK:8RVmzTFSEZMXRUweVke1GzMke
TLSH
T18862E72FA914653B9DDBC629F9217767E3F9212226D42E84A6FCCE3C04D76CD2207427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6157de177955bea129d4ec23d4f5551df7e2ffd476c386f2e59d1fce07404da9
MD5 2a574a96ce3f2b0fe6b67daf794686bf
SHA1 bcfc01b0fb4ffbfb9c673df880bbb8dd3866e642
SHA512 c4afa8f63e53b3597cb4a6a8ef9547c06f8dcb1e3975ce11f467e81f5daaf8a32d8065a942e90178f1be72f3dc9882bce353ebbb6e20bf23e82be6a4b29c3c56
SSDEEP 192:YRbtjG+o318v7+hAPRp2Llc9uHsb+WNn4Ybq+23X6wGkwLNVyIsnAUgraJ:YRbt0o68X/UwjD2fGfe
TLSH
T11242C62EA915757B9CCBD329F9267B63E7F5112222842E84E6FCCA3C14DB5CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 16a5f2c2536e538ffabbf42c89396560fafafa6127282978fbed9c4177ee1a55
MD5 b7b6bc2c7d84568e9677577f037c2a23
SHA1 225847a64597a077a8f75c8ed1a14fd1881eb8bd
SHA512 329213ef6086b54550f957e48e6a1d6bc85f66a56f458e32123f5f9896c15bf0d4748c450d31a9f7dbc74a5bd5555143ef0cde5e3b7fe51202485b179fbff018
SSDEEP 192:YRpZjG+o318v7+hrPRpfLlc9uHsb+WNIP4Ybq+2lX6wGkwF/PyIsnAUgraJ:YRpZ0o6lXCUwKD2hGJe
TLSH
T12552D82EA915653B9CDBD729F9267B63D3F5112222802E84E6FCCB3C14D76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 593794a3725734b17d3f146577bb8df4b0c2a79fd5086fc1b366d986dbec3109
MD5 e13600d5f4c953f412bc34d6c2c1cd14
SHA1 fc93292adb9c78156d9ffa637f27ee82b1e82d4c
SHA512 a22771573cbe6fae73ff0f8693c2573a0c058ca63c21ba45720bc82666c113e74aef9210628fe2b1534b6ef2558f71615e8121f6bcad506feec6867eb137af55
SSDEEP 192:RRVcBzZjG+o3JoSv7oVrPRpf4Vl6oO9uHsb+WNIPwu2q++Kwe7GX6wGkwFEVyIsB:RRVmzZeo+ExX/UwIyEe7yGae
TLSH
T17262D92FA914657B5DDBC629F922BB63E3F6112222801E84E6FCCE3C14D76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e386a8b1f3518efefc17c8374b8b112de673f7b8d40953d45b9a17d4112eaee8
MD5 daf6c82f46379a2cc75ed2621531c232
SHA1 ecfc6e22b4627ea61a0fd22e7077e25ba487629f
SHA512 059952d6da0dfb03d288aacc23455244bf9ed86d12b517b8b9dbc4a2c2ec89b8055e148b2e1f7693bbde3d9f76b8fc959545627616f2934e90227627a8a341c5
SSDEEP 192:RRVcBzQjG+o3JoSv7oVrPRpf4Vl6oX9uHsb+WNIPwu2q++Kwe7GX6wGkwFEVyIsB:RRVmzQeo+ExXeUwIyEe7yGae
TLSH
T10262D92FA914657B5DDBC629F922BB63E3F6112222801E84E6FCCE3C14D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 860650cb51a2bc62ce18c9d686d4c52456a745f8374cfe0acb81c215adc67a08
MD5 2a93c1abd7f2b98a8b8416c3b371d68e
SHA1 94e037de5768817a7aaaf429816ef1de25eef97e
SHA512 14b8a80db5e398ee9f4473c2aaf13a004d0eb9e6e308668a4ebf2694624b2066a4c122158a447f00be5b3c28971f38aa7edc2c715799fbbfa575fcfc3f71b768
SSDEEP 192:RRpZjG+o3JoSv7+VrPRpfLl6P9uHsb+WNIPwu2q++KY27GX6wGkwFEVyIsnAUgrK:RRpZeo+6xXCUwIyc27yGae
TLSH
T16652C82FA914657B5CDBD629F9267763E3F9112222802E84E6FCCB3C14D76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b636937a11cb61efca486bdf4f77ab9effaacfd53c5dac3898d2b7639afcdb1f
MD5 9f0acaa8d0d4564a29d381275f0d88ad
SHA1 32f96cedb9d85c1842a9307a4cd8dcf957895e5e
SHA512 c5112076ac571c79916a4734dbfce7bd280df54634164c4386b465d398fe44959c0a354b19c6723c775b8d68ea8547b61e515f4b77f08bc54dc4ded1eb886e80
SSDEEP 192:8RVcBzQjG+o3fTv7oZcrPRpf4Vl6oX9uHsb+WNIs+0BXbq++KweVX6wGkwFhM+VK:8RVmzQSrEZMXeUwlDEexGzM2e
TLSH
T1EF62E82FA914653B5DDBC629F921B767E3F9212262D01E88A6FCCE3C14D76CC2207517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5f3a2812501a22068e83408270dc2ca45eef236d3f71173ad5bf211930613d1f
MD5 da966fa7221ea6ff8cb04951a306aa1a
SHA1 43640886829c2eadda5eb95eb2d46a45bca7138d
SHA512 5ed79f680c68415a8d566b0a18660f43957187805d374981a4f8c63eccc56fad97140250d76192a258c0c34f2422184b5c9769d55df71a317dd67570b9d0fc99
SSDEEP 192:8RVcBzQjG+o38Cv7oZcrPRpf4Vl6oX9uHsb+WNIs+0BXbq++KweVX6wGkwFhM+VK:8RVmzQpOEZMXeUwlDEexGzM2e
TLSH
T10D62D82FA914693B9DDBC629F921B767E3F9212266D01E84A6FCCE3C14D76CC2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 480f4b7b4a5a3b9d9177ce41a65e1e3b094342648fcad0290f877de2d638748f
MD5 365e3bc09cdd468b7320362b8989b099
SHA1 fda03042876df1744de71827c6397807e9e33c3c
SHA512 c96ba129a665e678161698b6654ca3107c91d9288737fb983228d184e5aea9f3d69380543ec4bf3914b237aea112eaa6ba893daea34e184912a934ade3a3dc21
SSDEEP 192:8RVcBzQjG+o3XTv7oZcrPRpf4Vl6oX9uHsb+WNIs+0BXbq++KweVX6wGkwFhM+VK:8RVmzQyrEZMXeUwlDEexGzM2e
TLSH
T1EF62E82FA914653B9DDBC629F921B767E3F9212222D01E88A6FCCE3C14D76CC2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 0a11c8d94d03be5f7a99022bf28c4539933b91d1352042fa1083879ad50dee55
MD5 f0b0afb94a0fcac003cf5665d7f79d49
SHA1 867423c8282d6de7be6c8bad04c3bd0557ea910a
SHA512 f4555fe869f305999f4d5d93ae133036310d8c76ce1332d81e71cf04c876abd8d452f2a39f93614e7e7388d0b60471ef79d0ac636dcbcf098404469696f93e58
SSDEEP 96:F1mKgM6RwcnDh1JpNPLXbXFXKXTAFXSXTUXFXKXTNxhXsXf0XbXNXKXTVuZXIGXZ:F13dFmDhRJL1ajyCjU1aj988L9aju4Gp
TLSH
T10AA15D6EB50A184EE4AD4936CD78571B6FA9CF0C27FE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 09ce5f0b30bdfc7ff2625abe0ede6d4289861c5deb5c9e6a684034fdf7e26c62
MD5 30175c782359a8c34bf79896fcf14893
SHA1 7c03dba2a3ef5b2511bd9666a44f5111af56568f
SHA512 46539cbdcca9d44449759f6103ef2bb8f1045fbdf561769b00f8fc3c4e5f922d0a2802d6025d5941e76ce7cbd00eaccb0ed72dc4dc91007e6be78097983b10c6
TLSH
T148E026C125C8D2FD215681F7073DA30CDAE87416E2DC3C831F40D44032CA80871AE6A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f66b3f3825a639086cec067a35fa168375641d78010e6cd3f4065f2b2f30be76
MD5 e8239c5f751cd866d01ee66c53b5dbc7
SHA1 cc632afecc5b7fb7a6f332980e5ab8e0c866d761
SHA512 ff9f11b7a19d9bac2791239967dd585ddda50088f20ff6e0dbc123ba29a3bcec1861d2a4e50aac33fc58599ae68077e1f62ec18da720a6d389c9388a891edabd
TLSH
T149B0124184055503D49A07F42143149C71189F34BE0A170153E06966D8261908424150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5be20f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5be20f.TMP
Size 96B
SHA256 cafdde38ad3886f757c9f38566f43d9507e30887980519f71669b8121849638d
MD5 00153d4d246ea2ab43a88e6422aea1ee
SHA1 ae04a1934958dcf61899494fb73720d41ae8aeb1
SHA512 89615ef44763f258040197e8bab807ead4e84f279858aea5b4f7482d0e1a6a63fffbeb2c897c2bbb2455aa93de59133057d1f4674620b715042498dd25eca2d0
TLSH
T191B02280C202A203C08223B0388080CCF338EF20C3030203C3E00AB2CE302ACC020CA0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 cec0b39e4ce3e7cf15e78ee4fb2da34cddac4bd65f0dcaf64a42c7f0443f464c
MD5 02dfe2cb9f2f9e66f7f020087fa957ed
SHA1 9eb639c1285b6876a7b4dfc9a2ed335a3366ab41
SHA512 91207b13293431cf09c1f84a61a343bca8a35fd2a1f54f92a8a0bfaf964b33453a02538d385687c8409b4ba01a07a6cfd43acaf7d2f86092fb1fdb0e919590bd
TLSH
T1744129D7C5089856DD7CCEB83AA973ADFB12C06C5EA648CBE78412A5C0E1B62C85057F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 323de9d9c34650cbda3961e43d1cffe3813ca73f0f8fb6abe3dc0e0a5ec11c71
MD5 4af1951e85a14adb291814230bc5e575
SHA1 747ff1d851cc7498c540324121bcc1b4c7ea2382
SHA512 816cf4926d39dc1a0f7a4b575a0556e61b8c7f01a82630191ac56f73b1b1654c5f1fe11a61267dc4413e60dab4f182f3cb682c352b002985e1f92f4d6c34fe7a
TLSH
T17AE08695389DD26D215680BB07B9731CCAF43409F7EC2C531B06D8403386505B3FC2A5
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13424715052440149

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13424715052440149
Size 70KB
SHA256 53e5f74f6ecfa1b79a619980670fecc343c265fdd3b5bddfae86579f2effebc0
MD5 bec322608aae48b41b2efe6ad638cf1e
SHA1 97d6da468c7e3b023ebdba0bc610608d6ecad297
SHA512 c9955ae32287b79bdc5256c1a2243a88d51329b2900fcaf7101fa02bc80b7ccbe9ecfe3e62babb2a7916c8d48e470acd6277b3ebaaa2e49f846643eca0e170dd
SSDEEP 768:faNpsB/ahpMMaNp4jaNpgnaNpc/ahpMgkaC9pCakp/a4p9NfdplTYftdPovU:fx9M3t/9gk+PBNVplTYVtF
TLSH
T1B563DF3C2AE9113BF2BBC9B8D6E45697A877B55335419D0D88D143090C23F82BDA3E1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 81248a5b068faaeb75aff6916dc13d66273d033922b0d310776af849a913782e
MD5 4ab3d281fa4f395796ea478b12896576
SHA1 ff4938fcc185858053528fbd4fe75ee41be71fcd
SHA512 23c1c84b5430b61979c53eff01c61892ed21026a5b058c081a394d898846df7969ce4f89a1b4577a3c72814fd1124bd55a5dda7cedf40041d551a02d1221775d
TLSH
T143A0021527C02D11FC4456F6908285E92A606C70411F8303E2D48188DCE29885181497
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d3e8ff43e8d5a782b13522a15fcba44252c4e7766a7089d3e558449c1adeca0c
MD5 f7a55098dc0aa6b945871023e87abc58
SHA1 ba693007952487727c719df4a7c1af692dcf1405
SHA512 4ed09d85850f55095f05c4ef34ca4b08289b780147b7b5b91a48fb786e8b80d55189119475bec59ea61e045ba928e597e9f8cc43b2dbc90f1106d62a02004d5d
TLSH
T16FB01228BB10C337E6C51E3D01D68F71A218F512310019635C749F100D09664FE01E94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 bd61f81fd63cee807d5dbca626703c2e62f8024f5ce5ffc7b417ebbc41ec7d4c
MD5 621ea87c23cdecab0c64cddcb38e436c
SHA1 4b4926cd8f13feb897edbbc45b865169d983c91c
SHA512 448a4fd6b892db326772876afa654cd7b942abe68bafd716c1a36f5a9a2d41a60ba3fb4910febaad59d0a969952afb0881ff5321dd69ceb60ccc67b5354463a8
TLSH
T118E0D8A129C9876E728540B7933BF30CC9E17401E6ED19A31B05E040739A804719D251
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 318B
SHA256 1efbddb95dd3e718cb6e713289dc7faa7fa6e8159289c1b5db074a782097bc4c
MD5 4c959e1754b1d0164837950a57e2c0e8
SHA1 4b878e965a0061b3cd47ece5b2213482f957b6ab
SHA512 dc0f522c10d0f4be3e7f36c932fb84b3c794ebc4f17eaf755d9fff538de1d5df1f4e2c2ae2538000819839c5aff86d2de228ead45243813af074a40213bc80c3
TLSH
T12BE026F129C8D77D7440C0E78378B70CCAF07806E3D939834708D040728600461BC2A1
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 ae5a87f46ca0cb2afa297cffd620169147f7a2bee9f9d196cec34ea0d30eb3e5
MD5 1d90145e212a50272255ab82d81aaf98
SHA1 c49c4c4f13a10c01fd4195169e0438f62d3dea77
SHA512 79f52fd9666cfda5729e61cdb744fefff2f0c1d618c807a71863abad0f659028546ecffc66ba28280c6d2a3bd3da281c67bdb8dfb6c700db4793de52e24d9fa3
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OzjgaVumrLnPto:1nbZeMrv/hGtzkSLnW
TLSH
T17CD3874B3A743102DDE69A721CE051BB5E3CB16D8F51A5D428B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 234B
SHA256 bb4858650cac747670a575b873f0dd35d7ad18c8241488134bb1f378a928ac98
MD5 f186ae172361a0f11a6d50563d9008b3
SHA1 b49609d562f0e79280fc8dd37cfecec6377a2fb0
SHA512 c34b867143a26f6d63bb02c18c654083e46d4250364d844ab12babab7f00731a3ba805167d0fa536357461c6350f797da1d94ed9574cfbf5327643eaa3172cc7
TLSH
T174D0A7C71371D9475B74E5D5306CB07DC41EAD4D4C8DDCD89844745370BC722840293D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 e075586c5e1b2ca7a1febe24897a1d7afa987b3176e38453c970e4028efabe01
MD5 de5bd6ad457f51d96a94b4aad5db91ea
SHA1 6b96138185d5013ed753426cd7212b1c6516a0fa
SHA512 946177b0897b5a089b1df1416b177f27e9a92e3054021dee1c0aeba4d7262c2ff12f41fc679fa77775872399ddb137e29daf42b38cb429350cecbab6292aeb68
TLSH
T129C08CD72620C54B8AB0EAC8205CB13CD40B924C4CC8CCE8E40800032078A324402E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d94ff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5d94ff.TMP
Size 157B
SHA256 64d1d57fa79f90cd283072b5dc4904078cf331aad1c428d14cf6bd9179eae0ea
MD5 e7da0830641360d5f5779edc40727f6d
SHA1 dcbbade1379c80b3913ffb4d5c3d4dc619990e8c
SHA512 26382355ddca9611c4c57806bf9c0dcb167679bda96714f8e6a29acec387382261068e4ecdeabcd2062fd634c46d2139c267264e323ce963542e6c727fe30164
TLSH
T15FC08CD31620C54B8BB0A5CA206CB16CD41B8D4C8CC8CCE8E40830073078A338501E2D
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 b1f5c0a02df5ce0bb4adb094f4176654e1a8b0b64c7cabb7b3e3eadb1efc2060
MD5 b2d52ecc0efdb5758f9441cddf716afa
SHA1 f4c1d4d380b0f866096321be1f8879a680f52fd8
SHA512 cd8ea885fd553fca9da1a27c22bb491244742e84e10b951ae13eead9e8fd79baea2c36cb7ec1eac41a955406178b44149e1f39d65b9c545dfcc9ed7466984448
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX48+XvXf2b4:7ZT0nzXggAfec
TLSH
T18E034FCF662840F3D0B2C13EEA8245D6FC7C6608A32339E519EA07655DAC13790182AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 40f819c59429687bd2782b5e1a888cd6ce89bb25a092d3d7258653a2b526aecf
MD5 868ebae541837e391606d07515f60e8f
SHA1 3cce89370f41c715b26a1ee3cb90ad486b68ca8c
SHA512 3bd6621dfc169d6f73d1648f0613ac0444a65ccc068bc0cf8d0cc7d9559ba3fd62b9d25da9b90ec96feab4f7324244167f7dd5d8010402c1ddfc0aa751c1b85e
SSDEEP 6:9fqVkB+hKC+r+Bcc/XKuqHKu42nl8VICc/mLEJOgLEJLjc+GYn:9fqVkB+hKCY+BXXwX4EBmLULIj/GY
TLSH
T1D402DFCE6406485AE826007FC6AFA8836A2A5D983BC2352A28D5490928BE30780143C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 29KB
SHA256 da5c420ac6f783c62f310c5e8a4e201150c11b8d9f64b4be8466036c06d5ba4c
MD5 1142c974d414592b10a820c50343a101
SHA1 1e9c516827ca65b18d3f2607eeb53e0eb5363729
SHA512 fa6348b865da9c40fa8ad929dc8a4078abee02123dace4f53eb5796342b5d6b517c8cab3dcab6d7285f9742276f741fb313b1b5aeeb7b8932f07d35e55f7e5c6
SSDEEP 384:o52+sdGbf7QXIIImbGMIMNBAJoFsdGuz24f3sdGkKIsdGddGUNtJXTNjTrqEd+OA:+f7QgzGJNtJXTNjTrqE8l
TLSH
T11FD2E99693B407A9EC8FB7FBBC548D2E3B72DC8949650041B496567A3C33E8749C234B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 d4745038fed3a2d3747048aa30f5272b194dc3ac05589e4908d1c2c8eb71a8d3
MD5 af4105af0c9035c1b794b9afb5700a59
SHA1 2febe6d341eb1ef54d4a10373378fcaefdad76bb
SHA512 0ea294a535aad9e3af67b6ebf2dd03350c9d9e1a47aa375365da9f51b54e60e864e3bc6baadc7abee109ee3eabfb63093edfaa9ab2f2732d92df38e6727adcc9
TLSH
T186E086917DD9D2EEB55580EB1679734CDED43806FAE818976F02C8887286904B1BC2A5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 4ac2beb78759bfb618ccae9e664f9c4b55bfc6f2885951380abd64ac02c94ec9
MD5 ffcb15fe379661e388b80ad48d597656
SHA1 8222352f8fedd116fa1b2c782c3fba244c405bd3
SHA512 74018f7a1e631a9f242f6dd2ea767029c965bef93a614f0cce2c7d496653f9c7634fe659206e2725f8d2f4c04d3ec1192f59c9abb7f119c49a1bb689c825cf1a
TLSH
T194214CA6F331C249C649873AA43EEB251374D4669FF8ED0F51B520783E76E040D4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 2a1315a238b73653228815f86380a0e22edd3dcdf293d3b76babfbb8ca76eab9
MD5 1cc82289ad5e87310d2f6d8732b00226
SHA1 50363ca75361e9c24bfb0b832cd07cf15f6e8888
SHA512 4ab7555ff2a748bbccea006a5b1af4a4d3de60cfc57d51fe003b90be78d5734f8c79366dce690f92c3a83f291e4697eff798f028593f6f63e39e3119d723cceb
TLSH
T169E026817C88C2EFA01180E70279B34CDED43802FAE82E436F02CD887282804B1BD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 5513359bd961837ae00b786911fd4fb63f0845fc314d2ab81629fc26d2746949
MD5 197efbdd2c3c5094b538d8d0b2ab98bb
SHA1 a904e16b2c32d680c4cc98feb906e14faf901017
SHA512 94145b58c6da1bd4724aca477b51e41c9695e4348c6f192cf9ea8e9c2ae0d9e46ee783dd39b3fd43fbd28a3b78cf9e50ba9654b1fd8eb9ff2f771a1524480008
SSDEEP 3:MsEllllkEthXllkl2zE/lOSKl:/M/xT02zYK
TLSH
T102440414FFD47507DD4015304151C3557370D450071357C33D5114735DCF7440C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 b2a233e7ec6ab25b021019448a992b59f6674a041707eb61dcda62b551de2d56
MD5 0a028dc7e1a08eccd057bd59e514e3e2
SHA1 73f2965e6ec3d7a2dafae40e358cb400f0d6c7c7
SHA512 cfe3b04481594d1ce3c5995bf53c9d75112f8f915dba101090a2f099b5a7a768b6c13b18259665e914f085ebbd53cd6c6a113baaa8fc90d29071bd3ed4844e12
SSDEEP 6144:bVFm4vCuuwbzIUqSs1qK0wCcmXKegIh6jh9Jvexh9:b2zwbzIUfI0wCHHgVUxL
TLSH
T174341369B99F3DE584BC18F271573282968193C20E11BD4E84CB9F0B5EEE9A44E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 545cf56b82d4412aa504fee5eab6dbcdf594c6afaaaecd31928656787a3dafb2
MD5 94dfd2095c9fcacfbf1a842c6637d4ae
SHA1 669e2170ffb8e1fa81665a73371a99d10731bc66
SHA512 f3bdc83e44a15ddabf992f333b7d73a32e4668e707c05085e6c1b6aea2eaf6bbfe15d9bd63747a22884657121085c794a7c30a4bcde7bf2c867bd25265ca3596
SSDEEP 3072:V7gb8ISzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1o8:Q2VFm4vCuuwbzIUqSs1qKX
TLSH
T1ECD312BAFACF4DE9417414A062526482AD80E3C34B517D4D89CB5F4B6FBB198CF9EC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a08371dbb4a92069b474f362eebc7f90345f1f8e78d18f761ca277b32ee6d012
MD5 0c3f6c7b3bf301714c2c8a58ccf0cc41
SHA1 b04ef74d7e0d973e7e32340ae85032319eab1d09
SHA512 60b4bdcc50d0f15491b275d5b74d344de74348e686a15cada45e2dd46465ee6e6c6b452033088fef8d413151e8cf3e592bc668f7cef435e5e80eeba5e1a32540
SSDEEP 3072:k8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:ywCcmXKegIh6jh9JvexhQ
TLSH
T1D6B3125A28273DA688BC6EB37457338286A357A26C05F14E90CCDF0B49DDDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4d475fd4e7d55023317152491a15edd0ee47979602b2e2d213e10eac26169475
MD5 0c48d96eb569d25a9c05ecfa9fcca9b1
SHA1 95a4a0d0c2e53ff46e8a7932517d6f494dbb0ddf
SHA512 453c0a0e654ec69641d571e186afef5dc992a8f40d46310100ac629148bdd312509da2d064e4ebccccc611092bf8468cb36858b36831262bb9a0740e3e9f1463
SSDEEP 3072:4ywSzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1oF:RTVFm4vCuuwbzIUqSs1qK2
TLSH
T13ED312BAE6DF9EF592B404A461566082A640E3C347613D4988C74F0B7EE72888F8FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 3e57fa4bb2d3ee8a87f0e17e9cd1c983cd2e472c929d7e97ee74bdaf8bf2a90e
MD5 dd443add1e37f77748a2dbf3b0436da8
SHA1 ebadbd01bc89f210c11aeff0fbabe38495f54d01
SHA512 18df721e53a9b16b86cb103fa8260fcb4198020656c2d4ac13f9944f7f37d0bea04cbd175294797a9aec73073e5a10370080f3f841e501b6b2faef2479eba20d
SSDEEP 3072:tSzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1oF:kVFm4vCuuwbzIUqSs1qK2
TLSH
T18CC312B5F5DF9DE952B404E062526482AD80E3C34B517E4D89CB4F4B7AAB1C8CF8EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 dbb1d676f561b2f7717e8d9ece941dacbed95ce5409277ba2ec32514f1bd1dd5
MD5 6cf187bb74095d5befe0af258962b7de
SHA1 62bac0add46231faf57cda5af0861f46bd43606a
SHA512 f5906aaf9b2264568cb77be53328818d158b82cdaba4baed6003e7b3463047e26b9b94eee7e2343a3e5a4aa23ac77ee14a42757182a8440c3e6886ef568d7d3c
SSDEEP 6144:o+VFm4vCuuwbzIUqSs1qK0wCcmXKegIh6jh9Jvexh9:T2zwbzIUfI0wCHHgVUxL
TLSH
T1A8341379A59F2DE988BC1CB2314732824E9193D34E11FD4D84CADF079ADE9A44D9FC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ce716550ea4a9305b7020219c6e3eb2a57158f51b6583d0eb721747ed86a2b69
MD5 1a2789f8c9ccf76130f9668c35e55d0b
SHA1 2de41930946cb0bbea62010610e36f5c049de6d9
SHA512 ec8f5a49fe36b1921c520f775b9b34cfb108cc1ff296c5e07a8e0b4f7797b2cfe7ca4fae2f259e1b88722d309e8c0b4260bcb363b0fba7a936e9109b4f4e6abc
SSDEEP 6144:2VFm4vCuuwbzIUqSs1qK0wCcmXKegIh6jh9Jvexh9:22zwbzIUfI0wCHHgVUxL
TLSH
T1D2341369B99F3DE584BC18F271573282968193C20E11BD4E84CB9F0B5EEE9A44E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 85643154f461aca34c50d5aa165e1e9b8a048a1ddae0bece4366061e9cd218ea
MD5 888079db9bed50aa258c6e94065a26ef
SHA1 16624eb9f127f3d00ab96456e88b4928df9bf005
SHA512 7cbbc4da40d95e3a07e84aafa0f668525505715d9ee40a0cee58d7b4b101548378a0390c69dcfa831d239cdb93893980bca9ba611d4776926fd65f7230e95f90
SSDEEP 3072:9FJSzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1o8:9FAVFm4vCuuwbzIUqSs1qKX
TLSH
T1D0D312B6F5DF5DE946B800E061566482BA80F38747A13D8989C74F47BBAB1D8CF4EC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 32fb57fdb610a0900fc0d16ae0bcf4c520d43b47e235065e3ea4c79d55a70852
MD5 3be4d79973dea916dbc37ac2c9c2e40e
SHA1 2d55d8be2758f33874f6e93e1c2f0961acf4dfa3
SHA512 6863eb2fe5811142fc8fcf01d76869feb5be4fe8554299a0da2fbb8da689fdbc3a56305e503f4197cfd9b7ba978683c1a320cbebafd3b498eee350597c79398c
SSDEEP 6144:7VFm4vCuuwbzIUqSs1qK0wCcmXKegIh6jh9Jvexh9:72zwbzIUfI0wCHHgVUxL
TLSH
T1B2341379B99F3DD944BC18B2314332825D8193D30E15BD4E84CA9F079ADE9E88E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0538ca8ae4f9b65183d3b65fbec698ea6204b56562a41f698feaf9a7a7fadf7c
MD5 5ed31434cf95b6269d644a0d8eb6f35a
SHA1 61192c6e3f8e5965ec97cc474afd10a5c5be322d
SHA512 39c2eca34fef588f8987a1cbcfaaf1cc6ff3c0177edcabcc43619ba2177ec7076ceaef135b8690673172f1206c4dc4a36fb3ce0b89aa72e617e61343bf71cb80
SSDEEP 6144:HVFm4vCuuwbzIUqSs1qK0wCcmXKegIh6jh9Jvexh9:H2zwbzIUfI0wCHHgVUxL
TLSH
T1FC341379B99F3DD944BC18B2715332825D8193D30E15BD4E84CA8F079ADE9E88E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c8f20e5af750e5812c1e0173371741f06119593a0434bc326f6aef8028b7530d
MD5 5b7bdeed15c78a845f37bbc27f02bac5
SHA1 7914b1fdd621cd3cf2237f4c9d7944a412957b9b
SHA512 c89bbdbd9f89006a77617170d43fcfc293dc693558a7766ec9fb6d39122344fe7ac329496607b18a8a75aa8e40d73889379dfeb69a17d7733f7cf84226644443
SSDEEP 3072:zywSzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1oF:OTVFm4vCuuwbzIUqSs1qK2
TLSH
T178D312BAE6DF9EF592B404A461566082A640E3C347613D4989C75F0B6EE72888F8FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 e8411a496e7515c314bd7b1708f0cc7ce35cdc068c6da5475bf3a59033eb92f6
MD5 8d911e38aac334d649438ae65f80f15a
SHA1 be1a5ef9a9246fdb21b9dfa443f645c0aca7c2c7
SHA512 2fd10a89b99e525262f0a2d0ff7bf96ccebc40dd6b781f6b62760ee8643c1568b8c2be38ca8aaf582b3de0e57d8a4ec390e9d52e426a4cf13867d5a03edb8d95
SSDEEP 3:MsEllllkEthXllkl2zE/lFQL:/M/xT02z8Q
TLSH
T1194404447FD04407F55151314451C3541370D43007137743355304735DC77500C00301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 0989ff68d8054ad80db5888999e5308e2698209ef4a82c8bddfb310a4c6a6542
MD5 9584212114cf174076e162450e9deede
SHA1 e6f5fa4d8658a35fc2c8be9985f6609161711c68
SHA512 8e7e78be821be8d1402d44d2e6930829777f3d74691f872af9cbc0a4307cc579e8be4730dd515a0b278ffab6b20d68411f6e84ede9c7b0807ce25c8bef743698
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Jr:TkkhCU2QB2zbBxxAZEv
TLSH
T1A923DE8F6B6821D9D1E5193EFEC24C917CBD4F598B2B68D609E00CB64CE14AE502F0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 23KB
SHA256 d105529b7680fe7f36ed681772d0f19eee70f9cb8deb2a1442f2bb256584da45
MD5 f2bc0571f2c36aacbef477d0a76a2aeb
SHA1 fdd8561071ab2815df706467f3fbb4e80f3d2666
SHA512 36da9e25957909a6fae0da9a445a9ffa076ad7fee2c152a8b061dfe04c75323bcf8d81a4577d61f1a835f46b54e4a6e8edc504b6a6544f841134e36272be0a17
SSDEEP 384:bJWJ4Vca12krtuVm+A1dz2BOVjeQxaNRJodighIjUXy7Wg5Pjm5q+GDa50ZQOYAi:t+4VcWrVlcRJyig+jUXwJsq+GDa50ZQd
TLSH
T14BB24B743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jupuzoc3.gsa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jupuzoc3.gsa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\Banner.dll
Size 4KB
SHA256 42c9387cb1749bf8338d5a6e6e8f598a22997e4cb9472da8dccc75c44b48f59c
MD5 2dffef22d117e60be69ad89cdd01dc19
SHA1 d39efb73bdc7a5c8f89c1427f0d9d284c501bf13
SHA512 9705ce9b0c2cd1eeeebcb9a951b029ca7b990cf4c4bddac2dbe1c57a6f5dca3f8b47d96a29d3cfa070c317837f9c219646489ef6435ef5014f1b143041770ac2
TLSH
T1F281633BB2F04EF7E563023300830BD3259BA9546728471A4D6791ED7A4A9D7D53DB02
MD5 SHA1 SHA512 TLSH

Submit Download

Header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\Header.bmp
Size 174KB
SHA256 30b2605b256df27baa509ee27209cec3f28ee1fcfe721484bc63dbe644b961bd
MD5 6107dcfb93cad5b9ea18a60c37e3c837
SHA1 a4d8207b7ecd28e4d04ba2ec3735e174ede9f307
SHA512 54154f5da1fd737c341579607a7a278e26abab5531ef93486d518a8bad24d1d4bbaee8b4fc431ade1af7d55964715d75bb7ff0a96c32be24a41a3f8655996d82
SSDEEP 1536:RTL1VM9PTqDF7ZB29FdtXqFZOHJa/Oz8pazH3:NLkTcn0R0Ia/OgqX
TLSH
T181041848F153C90729D2CF3536AEC97A49E278504B9A64F817EA007DB0FE9F046EE572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptionsEx.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\InstallOptionsEx.dll
Size 119KB
SHA256 b03cedb899c8737fabb3efb1d02bb8330ee73ce667aa406a5e52a10aff180db7
MD5 b8c7fda6ec3c8a8ead7d7eccae0b17f7
SHA1 bb1444aa3300e9ab4a7a10c7913ae5e4320b953d
SHA512 52d3ce369418c9fbc7645e8ab272199dd836ebf13fe5019694f01f1686e0708853188b5a2ba8241739620dce98765bdb4fee488189d40c37222a0230b79e6e91
SSDEEP 1536:yU+yEIWirTd+OY4M8D1fb8Li7c3bSC2RVNCSivZYrgr+9MmHZ+WIwvtu1/5bCl:b+y5TlhR8DL2d14MMmHZvtq/5bw
TLSH
T19BC38D403AD1D073D1EA647C9559F37187BF7971AC6688477FA02B7B5F202809E2A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\MultiLanguage.ini
Size 1KB
SHA256 87dabfd7b21bd74a2404b4f72471e2d13878bba0a12774302cc1a3627d903f4f
MD5 559dddb5a9bbc3921acdae2d1dd9061f
SHA1 2ac2347e221e82f9256b35ae2cfafd50aee76b57
SHA512 0fa21b98abdef2b2633a1367c0f875423010219ced9a90418fd523213d5c66c96df59bb784286c26af3680360bc391a6d80abeb0232f2f60a389c96c29b261f2
TLSH
T15A3181175AE88518F2F7BB08FFB040719B357D45AC3DD50D42D10A0F84E9A409576BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\MultiLanguage.ini
Size 1KB
SHA256 e35a03806a0b3ac9bef421afffed659aefff685a5ce3f70bec9d22f73830e95f
MD5 737beab934f785f0a2f4c577c5e6a33d
SHA1 a0770b87a69568ac5da321e292a5db320f2e628c
SHA512 1dbd5224361d347495a5e662960ce19c12e7366f74e893f210bc514b0aad55dceee53fc60c9ebda89eb4772529c36f63f9162ae090f5ebd23c8e1bf5881d0c9a
TLSH
T1BF3170175AE88518F2F7BB08FFB040719B357D45AC3DD50E82D10A0F84E9A409976BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\MultiLanguage.ini
Size 1KB
SHA256 eb2b2adf767d3958f9bc78516de93674cef618c19c22c93f74faaa5fff0703cd
MD5 60f01301058fe168db89adfaf9ac25ea
SHA1 3a39e730086b6b09af196959c7bdf4b08a6b8c84
SHA512 6ca2b8a8068bf61a2adbf4f8124cf7ec3c8a841996c8b23a30415068f02c275421db6476ea096a6d02b3ff4e83bfaf1fa8d01408b242eaa85296b003e9955591
TLSH
T1CD318F175AE88518F2F7BB08FFB040718B357D55A83DD50E82D10A0F84EAA409976BFB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\MultiLanguage.ini
Size 344B
SHA256 28bb063cbd9d8eec0dad21e815091c9a176f15035d5af2d41db4ea6a1f9ff3c7
MD5 55680fc0cd3ba2f74f5eebb05839203c
SHA1 302995226fce4f7025274c3817fdd2e2b5e0941c
SHA512 dc7c53a627ff278fa8961f71d955454253623a4fc176b1c0ae929db1b83d521550a27490e2e9cf1a3a27f98b0e83d8a8088b2292b9b1e96809ec215d8e2c0f5b
TLSH
T147E0E24B25E89415E09AE11CFBF98076D3387408480EC90EC2E34A4F88ECA40102BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\MultiLanguage.ini
Size 1KB
SHA256 d54f003230d58345b3b3d1a659f9867b7cbbdff110d3e2ef366950a2ec700aa3
MD5 b8b3485993911a9871b21713ab960497
SHA1 764e8cabd5738c239db08dd81d761c3b0c48b567
SHA512 7819ff0a542a458677e84a68987950621934d453121a019e68641fb1fcdd49723527d5b97f3ab7081090f253bc202c705d817b46bf0f5fe1ea8e7d9461dae3ee
TLSH
T1E0315E5366E88118F2FABB18FEB041319B35BC55AC3DD50D42D10A0F85E9A40D576BBB
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\SetupType.ini
Size 3KB
SHA256 bdcda2bccc5d92482f6be6385a16ca499be0c667b8e98eebe221e76859086508
MD5 f19edea07a51ac93d24e3ed96e391018
SHA1 22954ab7ad4b999b28bf3c082bce90d028f29678
SHA512 2678f967acee989c8cc59e855d00a7bbddb404f448f7716572bdb9c5845f541eb88f429b51d21ef23ae457839464434a43c6789943693a4d2d9d69e6a2e14ea2
TLSH
T1B9618C233EFC5024E1BAF248EBF58035A7397845681DC81ED1D11A0F49E6E808667BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\SetupType.ini
Size 3KB
SHA256 8f30ac7668b767795e5208b2c7a5e41e302102b87afe3e4efc39028c7bb92102
MD5 9ea918aaf3563e52d3334cde952e1709
SHA1 21296806f2ac7ddafb1a284fd5991fd3036054a5
SHA512 4ee97125b112713400b04f7bd3cacef7193fa04aef9b9cbe4f5e38b212bb75be3c8f6bc6262feff50a151933e6127b38e49f4e53a4fbf87dd522ed6b1fe1cce3
TLSH
T10A617C233EFC5024E1BAF648EBF58035A7397845581DC81ED1D11A0F49E6E808A67BEF
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\ioSpecial.ini
Size 1KB
SHA256 396b7557f97eea6bbfbe9bbe1fa6aa189ba8650ea89c7872461f38c3da1fe708
MD5 308dd356bd8d39d1e54be247d0b8d870
SHA1 e4fd3b66b6cd3845fb20be244590200d6e07a2db
SHA512 ca6c4f55cb13e5b569c4ccb9cfb942117b14d8b930900146821a5533c9e44f194b658f48bbed840d049797a058f26599eb081c27a97ec675d9a741011b3c4454
TLSH
T1FD113D032EF94015E2AAF648EBF54130DB393859582DC51E81D10E0F45F9B808437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\ioSpecial.ini
Size 1KB
SHA256 84d7edadb217569149ba9a101dd700d462b2f695ba56497ce850e5dc112ebb57
MD5 0cc83a6d3a6235c5e8ead7b05c36a10e
SHA1 273f3bee99a7c8378ed9d64225a8406d32d919a5
SHA512 413f17f2367320d5b634cf0591702f2ebc74787729f3b9bf34655176ed30dc8f3cb97095813ff826ffa389bf2d20228340a351e437f1005ceb4281ceb58f67d8
TLSH
T1DA214F432EF94014E2AAF648EBF581319B3A7859582DC51E81D10E0F45F9BC08437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\ioSpecial.ini
Size 1KB
SHA256 3da9aac049d5273e3a1a9673345794780e15f03982d3f49c7218be21c221342f
MD5 7f55ee8d7156ac374af42fa7cec7c5b7
SHA1 52d7f14e67970246dee1e27cf7525d1047d87365
SHA512 3d9a05f31dfd81933ba0aa0f3879258998ba74aee0f2937de22b047835c9b6ced99137823f9f1fcb19b889bd5c6ca2efa94f7d93aab4c7a06633d886c2549e60
TLSH
T1072160032EF94429E1ABF648EBF54135E7393819682CC51E90D10A0F45FAB818827BDF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\ioSpecial.ini
Size 1KB
SHA256 494116e0e7caab0afa89fc46514d097bbd81b4103480b25d72ca62c692d20028
MD5 521deecf3893e13ab66f16aa039eb01b
SHA1 3a53dc7a1b6b1434129f46c7ea4290481c3cf68c
SHA512 ba96cbff26279701eae7cea69347708726fb079f5efb99c32bfa13f5caa55400b2490311be384c14a16e55b1f309cb8c729756afa1a8ad3e1f697431bcc8ea8e
TLSH
T11B3151032EFD4419E1ABF648EBF58135A7393859682CC51E91D10A0F45FAA818927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\nsArray.dll
Size 12KB
SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
MD5 da4bc09439ed21faf7620a53433aac92
SHA1 94e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA512 920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
SSDEEP 192:LULA8tZt1pehCUVFpZ/XXz5F8qioPYtS/Z8i4NVhWp1h2ph30R:gLAe1peEUD/X1F8qiAFLhOh
TLSH
T14142F8429F9142F2F9F74276B9BD1930292DAD01AB2ABDDB032750582D20DE33E35753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcessW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\nsProcessW.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC5A5.tmp\nsisXML.dll
Size 12KB
SHA256 35e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
MD5 c5285d861243f3b41648af5c0ffd5678
SHA1 50012e20b898e2f1abad27a4bdca12033e618add
SHA512 92c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
SSDEEP 192:3/ufSdX+LHASTxwSODR2bzdA74gB0jpYEfb:3mfSEL9lwpRv50FXj
TLSH
T1D542B5033FB6D9F7C84A1275BF8AA796D6F4630524800C06D3560E1E6F318AAFD7DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloadedCertificate.txt

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt
Size 476B
SHA256 4c36de43aede9c106d04c24d8f2bcbe7e74cb92b42fd88177c6ed932812bf9d9
MD5 e360e7700227921533270fa0ba500cdd
SHA1 ca21c2d3940d5543d4403e8b03a9563c2f375933
SHA512 456c20e23b4fa7a72ee32044d86f581a46fcd5b55c562085fb94dd6a00d823338bda9e313e936f6e5d0898905e3e97b3581532bb601e667cd9054d9913da1d46
TLSH
T150F097787314D9AAEA3D3CE5CC040BA1C709155A83D4E8A0A23D88173997023EF2B3D5
MD5 SHA1 SHA512 TLSH

Submit Download

asdasdasd.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\asdasdasd.ini
Size 52KB
SHA256 73a89c1a29975f2eeed6aa7f5f7d21117e498776aeeeb5ca94b2c4fc7cfeb519
MD5 da1840d8aa2654f1b6e4a892054eab2b
SHA1 f89159dbc5e15748c6e6448bf8a49230b7b2d075
SHA512 39c124d7b7e78412b131ecf7804abff69cbc62ee945a0420f811daee49a649b004312d330c5bf7adc6cee738273151a4474212752c2efef69e1f8c5dc77fc996
SSDEEP 384:tDi+Revjjjq7sBu9pwbwiy7Lrbriy2Qr2NG4le1KtjEf4AA3KErhknVas0m/5tLB:k+8v5pUr2NG4Y1KtjEfr76HoT
TLSH
T159330DAE1D0E5A888D472351E3FB34082FDF394B10D918E90728EFDE5F5914944F6ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GhostDbg.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\GhostDbg.ini
Size 147B
SHA256 01baf56be6086ce73e0256350f5fd2ab0937ca4a4d8d25153d7d7dd326af199f
MD5 d90085283dc712552b8d7fe9f5fe5c5c
SHA1 0ab980dead76eecbdf155f47fe1f186a13b57435
SHA512 54cc2051f87693cdcdb844a01d24d40e737ee02ffaa86fd89cddd04f75b35c6779921d6862258d3dce11833aa39958a24892282e7a608f0e6558e3c2665901be
TLSH
T187C08CC00908B3A202E1806668FA60737AE10E03308B8014B2E084250E1D68A220862B
MD5 SHA1 SHA512 TLSH

Submit Download

GhostDbg.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\GhostDbg.ini
Size 147B
SHA256 fb9491a1a57e3348281f0505041a73bf60f5b6e3e2d0e91d9b9ac094905f76eb
MD5 acc4f3d464a2d0f2c31bb395be88adbd
SHA1 845f37c2af15dabffb8d441c02f55086b937649f
SHA512 7ed19e681bf3206b73c610a957b7a54939057611d9088755aa4c606f1a5f3c894558dc79a06e013aafd02110268099859b2febfc8de6f9be8bc33c43773f1a74
TLSH
T173C08CC00548B7A202E2806A68FA60737AE10E03208B8014B2E084260E1D68B2208627
MD5 SHA1 SHA512 TLSH

Submit Download

GhostDbg.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\GhostDbg.ini
Size 147B
SHA256 0aab7ee8fc608906103446656aa1939711d6440e6dab6472abf10f62a86cb2cf
MD5 519c8cd4fe6476df90fe206902368162
SHA1 5849944d1ae113f55de0b5611d594d29f6996a4a
SHA512 5f7e353287f51759f747daea0866c47fb514fc18a128293f58ba75e616562e7fb51046a3523c7f56404a78902091119c01dce177bc52c6af7acfb86ff22849a6
TLSH
T1C0C08CC00548BBA202D2806A68FA60737AE10A03208BC014B2E084260E1D68A2208627
MD5 SHA1 SHA512 TLSH

Submit Download

GhostDbg.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\GhostDbg.ini
Size 147B
SHA256 d0eeebe06763c34e2ba8cc524f6ea78a825034e43f3b3dd3b64547b29521f265
MD5 871eb04f90b91c7458a71f64fc83f028
SHA1 bb86d12234b426a0e0c089393657000494b691b5
SHA512 b3bbee17d5bb553d3f8b3ea9eb7e32d1f0427eb76525777e45f12339fcfc1c13bcf6c30b367465db96669f9bb82f1f5176352bbcf65e5ef21acad1c2edbb8b13
TLSH
T118C02BC00908B7E202D2C07668FA70737BF10F03308FC014F3E084350E1D68A230862B
MD5 SHA1 SHA512 TLSH

Submit Download

off.bat:Zone.Identifier

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\off.bat:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

scylla_hide.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\scylla_hide.ini
Size 7KB
SHA256 b0a7dd434500257f707e57593f63ba8988801dc13915e8f88ba4e5656433f62b
MD5 2f76027ec0808fe0ea323a680c8edbc2
SHA1 e84b22fc75d35639b05d5ab3e0356be0ec0590ab
SHA512 9b154156a2f513c1136cca256769d3633c7b6dfcba799fa6f1450699c3d03388f0f01ad63ba9c1f474fc413d26e1853e357d554b1c1d8c2e8346546da9341e6d
SSDEEP 96:5BBvexluKxJ1uuvkOfTavovKxJ1V6UhJgHUHlirKxJQng6UrPlirKxJu:5mxlfWOfJMzJtli1KPliR
TLSH
T14FF1CFA1E22F206D45F68174EEB2212291F243508066EED7C654CDA96FCD10ABB7F3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scylla_hide.ini

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\plugins\scylla_hide.ini
Size 7KB
SHA256 a93b7ddd99bee9ee4f4001485a05eeadd7d706ca422045fc028c9761c4868659
MD5 6d2d17e188b3e7fa9eed0986300a0f5f
SHA1 c7acf48a0c009974b58c6f33031999f5b33ef9b2
SHA512 2049959e8c90172596e6d786dc6723ec1f28379e851cf0aa19883bfe473fc20f2d733ed6ef7dc929baaf1daf2c0aa64cdf1484a9e1bb9de8858c66fffbc81841
SSDEEP 96:sGBBvexluKxJ1uuvkOfTavovKxJ1V6UhJgHUHlirKxJQng6UrPlirKxJu:sGmxlfWOfJMzJtli1KPliR
TLSH
T1E7F1CFA1E22F206D45F68174EEB2212291F243508066EED7C654CDA96FCD10ABB7F3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snowman.ini.mw1620

Path C:\Users\Admin\Desktop\x64mod\x64mod\release\x64\snowman.ini.mw1620
Size 1KB
SHA256 eaac2e7174ab0aec734874ec7a8804384c428a58ec12ef3146317f02ca94ce4c
MD5 dc5f4b6a8317809957db99de40d055d7
SHA1 04ccf9e842b57028aec4ec483e6c30c3af62e364
SHA512 ccf002c6067f5a4db5a6e41ddb1874cd8dca3e7adda1ee7b6fe4d58b43bf303b18ac8c547dfd28efe83fca352df71d16b03d02bd34d529e5ac5b23b00a0ce1b0
TLSH
T1C731AFD68921A4FFC55A3B164AFDE78CC133DD2EBA54B50AA00837BEB94EE710040D95
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 815624.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 815624.crdownload
Size 900KB
SHA256 67318067cb47d58ff2b143a09d879f05485dd9f0233ccd2ad21d9e9b8f8e7fab
MD5 422a9c9b9487833b2487397729bcaa2c
SHA1 98da48586f40305b616c9332c2e90a6e4b4cc3a9
SHA512 33d26eac323004e40c7327045f6fb62df53cf75009d98fd7f1022d8b25110402404069ae627f360af03e4a78f66c980d4d995fdc9169f9baf9130ab27200f70e
SSDEEP 12288:4hZ5H2ggb3067PrTcmD1WOuZW/o1klZzVfRFgXmkR+ETi4DvHOl2:W/DOzPsmD7CW/oWPZfRa1JTi4Gl2
TLSH
T161159D05E55853BBC59A41B78AD1336BC261FCA40379CAF723E03F681B469E45BB1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64mod.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\x64mod.rar:Zone.Identifier
Size 163B
SHA256 1fffbf378debeb75db439fc3de4a3d8ba6d5c103b5336fe202339b02ba8473eb
MD5 37d969e7d2005e48b8fb9c8705e76549
SHA1 395f1a5a73467784110a57d59c0e3cc78b740d08
SHA512 95971b0f22dcf7a264faca265e50efde407a7a4509b262e85ab7a85b4dc0565bde9206ec091b6f1138fcabb5f1ed18559a6906312ab51748307508d834c8fd04
TLSH
T17FC080E300604419451C1AD8548DF5DD534A78179D58D15DD904146559404D1D4D8916
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-3534-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp

Download

memory/1620-3508-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp

Download

memory/1620-3506-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/1620-3503-0x0000000180000000-0x000000018003B000-memory.dmp

Download

memory/1620-3504-0x0000019E40810000-0x0000019E40818000-memory.dmp

Download

memory/1620-3505-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp

Download

memory/1620-3484-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp

Download

memory/1620-3483-0x0000000050AA0000-0x0000000050FEA000-memory.dmp

Download

memory/1620-3599-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp

Download

memory/1620-3600-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp

Download

memory/1620-3598-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/1620-3597-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/1620-3507-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp

Download

memory/1620-3482-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp

Download

memory/1620-3601-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp

Download

memory/1620-3586-0x0000019E427A0000-0x0000019E42B49000-memory.dmp

Download

memory/1620-3587-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp

Download

memory/1620-3584-0x00007FF9F26A0000-0x00007FF9F2918000-memory.dmp

Download

memory/1620-3537-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp

Download

memory/1620-3481-0x00007FFA00DC0000-0x00007FFA00F50000-memory.dmp

Download

memory/1620-3538-0x00007FF9F11C0000-0x00007FF9F1324000-memory.dmp

Download

memory/1620-3536-0x0000019E427A0000-0x0000019E42B49000-memory.dmp

Download

memory/1620-3535-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/1620-3530-0x00007FF9F1770000-0x00007FF9F1D5C000-memory.dmp

Download

memory/1996-3033-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp

Download

memory/1996-3133-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/1996-3065-0x00000192FFB50000-0x00000192FFBF6000-memory.dmp

Download

memory/1996-3063-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/1996-3059-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp

Download

memory/1996-3058-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/1996-3057-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/1996-3056-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/1996-3052-0x0000000180000000-0x000000018003B000-memory.dmp

Download

memory/1996-3053-0x00000192FD350000-0x00000192FD358000-memory.dmp

Download

memory/1996-3054-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp

Download

memory/1996-3134-0x00007FF9F1B60000-0x00007FF9F214C000-memory.dmp

Download

memory/1996-3132-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/1996-3066-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp

Download

memory/1996-3131-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/1996-3128-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/1996-3055-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp

Download

memory/1996-3032-0x0000000050AA0000-0x0000000050FEA000-memory.dmp

Download

memory/1996-3031-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/1996-3030-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/1996-3029-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/1996-3120-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp

Download

memory/1996-3091-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/1996-3092-0x00000192FEF40000-0x00000192FF0A4000-memory.dmp

Download

memory/1996-3090-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/1996-3093-0x00000192FFB50000-0x00000192FFBF6000-memory.dmp

Download

memory/1996-3118-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/2068-3694-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2068-3695-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2068-3875-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2068-3831-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/2068-3830-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2068-3727-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/2068-3729-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp

Download

memory/2068-3723-0x0000023A11C50000-0x0000023A1223C000-memory.dmp

Download

memory/2068-3722-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2068-3721-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2068-3720-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/2068-3717-0x0000000180000000-0x000000018003B000-memory.dmp

Download

memory/2068-3718-0x0000023A11BF0000-0x0000023A11BF8000-memory.dmp

Download

memory/2068-3719-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp

Download

memory/2068-3698-0x0000023A11C50000-0x0000023A1223C000-memory.dmp

Download

memory/2068-3697-0x0000023A11C50000-0x0000023A1223C000-memory.dmp

Download

memory/2068-3696-0x0000000050AA0000-0x0000000050FEA000-memory.dmp

Download

memory/2460-3628-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/2460-3630-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2460-3690-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/2460-3693-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2460-3692-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2460-3687-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/2460-3637-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp

Download

memory/2460-3635-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/2460-3631-0x000001A4229C0000-0x000001A422FAC000-memory.dmp

Download

memory/2460-3691-0x000001A4229C0000-0x000001A422FAC000-memory.dmp

Download

memory/2460-3629-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2460-3602-0x00007FF9F2B80000-0x00007FF9F2D10000-memory.dmp

Download

memory/2460-3625-0x0000000180000000-0x000000018003B000-memory.dmp

Download

memory/2460-3627-0x00007FF9F1010000-0x00007FF9F1174000-memory.dmp

Download

memory/2460-3626-0x000001A4228D0000-0x000001A4228D8000-memory.dmp

Download

memory/2460-3605-0x000001A4229C0000-0x000001A422FAC000-memory.dmp

Download

memory/2460-3606-0x000001A4229C0000-0x000001A422FAC000-memory.dmp

Download

memory/2460-3604-0x0000000050AA0000-0x0000000050FEA000-memory.dmp

Download

memory/2460-3603-0x00007FF9F24F0000-0x00007FF9F2768000-memory.dmp

Download

memory/2644-658-0x0000000005D30000-0x0000000005D4E000-memory.dmp

Download

memory/2644-646-0x0000000002510000-0x0000000002546000-memory.dmp

Download

memory/2644-647-0x0000000005080000-0x00000000056AA000-memory.dmp

Download

memory/2644-648-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Download

memory/2644-649-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/2644-650-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/2644-657-0x0000000005890000-0x0000000005BE7000-memory.dmp

Download

memory/2644-659-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

Download

memory/2644-668-0x0000000007370000-0x00000000079EA000-memory.dmp

Download

memory/2644-669-0x0000000006250000-0x000000000626A000-memory.dmp

Download

memory/2648-1792-0x0000000008D50000-0x000000000927C000-memory.dmp

Download

memory/2648-1789-0x0000000007CF0000-0x0000000007EB2000-memory.dmp

Download

memory/2648-1776-0x0000000006500000-0x0000000006857000-memory.dmp

Download

memory/2804-1652-0x0000000005610000-0x0000000005967000-memory.dmp

Download

memory/2804-1654-0x0000000006DC0000-0x0000000006DF4000-memory.dmp

Download

memory/2804-1656-0x000000006F920000-0x000000006FC77000-memory.dmp

Download

memory/2804-1655-0x000000006F6F0000-0x000000006F73C000-memory.dmp

Download

memory/2804-1663-0x0000000006D80000-0x0000000006D9E000-memory.dmp

Download

memory/2804-1664-0x0000000006E50000-0x0000000006EF4000-memory.dmp

Download

memory/2804-1665-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

Download

memory/2804-1666-0x00000000071B0000-0x0000000007246000-memory.dmp

Download

memory/2804-1667-0x00000000059A0000-0x00000000059B1000-memory.dmp

Download

memory/2804-1669-0x0000000007140000-0x0000000007162000-memory.dmp

Download

memory/2804-1670-0x00000000081B0000-0x0000000008756000-memory.dmp

Download

memory/4000-753-0x0000000002900000-0x0000000002923000-memory.dmp

Download

memory/4000-688-0x0000000002810000-0x0000000002833000-memory.dmp

Download

memory/4464-3158-0x000001ADD81E0000-0x000001ADD81E8000-memory.dmp

Download

memory/4464-3191-0x000001ADD89E0000-0x000001ADD8C90000-memory.dmp

Download

memory/4464-3234-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp

Download

memory/4464-3233-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/4464-3232-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/4464-3228-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/4464-3219-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp

Download

memory/4464-3217-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/4464-3192-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp

Download

memory/4464-3187-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/4464-3189-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp

Download

memory/4464-3137-0x0000000050AA0000-0x0000000050FEA000-memory.dmp

Download

memory/4464-3190-0x000001ADD7E00000-0x000001ADD7E3B000-memory.dmp

Download

memory/4464-3188-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/4464-3163-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp

Download

memory/4464-3162-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/4464-3161-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/4464-3160-0x00007FF7F72A0000-0x00007FF7F72DD000-memory.dmp

Download

memory/4464-3157-0x0000000180000000-0x000000018003B000-memory.dmp

Download

memory/4464-3231-0x0000000051550000-0x0000000051565000-memory.dmp

Download

memory/4464-3159-0x00007FF9F1780000-0x00007FF9F18E4000-memory.dmp

Download

memory/4464-3138-0x00007FF9F1CA0000-0x00007FF9F228C000-memory.dmp

Download

memory/4464-3135-0x00007FFA03370000-0x00007FFA03500000-memory.dmp

Download

memory/4464-3136-0x00007FF9F2A90000-0x00007FF9F2D08000-memory.dmp

Download

memory/4488-1633-0x0000000006B70000-0x0000000006BBC000-memory.dmp

Download

memory/4488-1632-0x00000000063E0000-0x0000000006737000-memory.dmp

Download

memory/4580-3084-0x000001C974010000-0x000001C974011000-memory.dmp

Download

memory/4580-3079-0x000001C973FC0000-0x000001C973FC1000-memory.dmp

Download

memory/4580-3087-0x000001C974040000-0x000001C974041000-memory.dmp

Download

memory/4580-3086-0x000001C974030000-0x000001C974031000-memory.dmp

Download

memory/4580-3068-0x000001C972410000-0x000001C972411000-memory.dmp

Download

memory/4580-3082-0x000001C973FF0000-0x000001C973FF1000-memory.dmp

Download

memory/4580-3083-0x000001C974000000-0x000001C974001000-memory.dmp

Download

memory/4580-3081-0x000001C973FE0000-0x000001C973FE1000-memory.dmp

Download

memory/4580-3069-0x000001C972420000-0x000001C972421000-memory.dmp

Download

memory/4580-3067-0x000001C972400000-0x000001C972401000-memory.dmp

Download

memory/4580-3085-0x000001C974020000-0x000001C974021000-memory.dmp

Download

memory/4580-3078-0x000001C973FB0000-0x000001C973FB1000-memory.dmp

Download

memory/4580-3080-0x000001C973FD0000-0x000001C973FD1000-memory.dmp

Download

memory/4580-3077-0x000001C973F90000-0x000001C973F91000-memory.dmp

Download

memory/4580-3076-0x000001C973F80000-0x000001C973F81000-memory.dmp

Download

memory/4580-3075-0x000001C973F70000-0x000001C973F71000-memory.dmp

Download

memory/4580-3074-0x000001C973F60000-0x000001C973F61000-memory.dmp

Download

memory/4580-3073-0x000001C972460000-0x000001C972461000-memory.dmp

Download

memory/4580-3072-0x000001C972450000-0x000001C972451000-memory.dmp

Download

memory/4580-3071-0x000001C972440000-0x000001C972441000-memory.dmp

Download

memory/4580-3070-0x000001C972430000-0x000001C972431000-memory.dmp

Download