donutloader | hxxps://rblxexec[.]com

Resubmissions

02/07/2026, 16:58

260702-vgxdlsas8z4

02/07/2026, 16:48

260702-vbld6afs5j10

Analysis

user interaction
yes
max time kernel
479s
max time network
481s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rblxexec.com
Sample260702-vbld6afs5j

Score

10^/10

defense_evasion discovery execution donutloader loader persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4116-754-0x000002117A500000-0x000002117A611000-memory.dmp	family_donutloader

Suspicious use of NtCreateProcessExOtherParentProcess 38 IoCs

description	pid	Process	procid_target
PID 4116 created 5136	4116	Service_1.exe	78
PID 4116 created 1664	4116	Service_1.exe	79
PID 4116 created 4548	4116	Service_1.exe	80
PID 4116 created 4468	4116	Service_1.exe	81
PID 4116 created 5536	4116	Service_1.exe	82
PID 4116 created 2260	4116	Service_1.exe	84
PID 4116 created 1428	4116	Service_1.exe	85
PID 4116 created 5908	4116	Service_1.exe	103
PID 4116 created 2552	4116	Service_1.exe	104
PID 4116 created 5360	4116	Service_1.exe	105
PID 4116 created 5716	4116	Service_1.exe	107
PID 4116 created 5676	4116	Service_1.exe	108
PID 4116 created 5136	4116	Service_1.exe	78
PID 4116 created 5136	4116	Service_1.exe	78
PID 4116 created 4468	4116	Service_1.exe	81
PID 4116 created 4468	4116	Service_1.exe	81
PID 4116 created 2720	4116	Service_1.exe	148
PID 4116 created 5352	4116	Service_1.exe	149
PID 4116 created 868	4116	Service_1.exe	150
PID 4116 created 4280	4116	Service_1.exe	151
PID 4116 created 5024	4116	Service_1.exe	152
PID 4116 created 1848	4116	Service_1.exe	153
PID 4116 created 1492	4116	Service_1.exe	154
PID 4116 created 2720	4116	Service_1.exe	148
PID 4116 created 2720	4116	Service_1.exe	148
PID 4116 created 4280	4116	Service_1.exe	151
PID 4116 created 4280	4116	Service_1.exe	151
PID 4116 created 5284	4116	Service_1.exe	159
PID 4116 created 5596	4116	Service_1.exe	160
PID 4116 created 4560	4116	Service_1.exe	161
PID 4116 created 5860	4116	Service_1.exe	162
PID 4116 created 5536	4116	Service_1.exe	163
PID 4116 created 3036	4116	Service_1.exe	165
PID 4116 created 2256	4116	Service_1.exe	166
PID 4116 created 5284	4116	Service_1.exe	159
PID 4116 created 5284	4116	Service_1.exe	159
PID 4116 created 4560	4116	Service_1.exe	161
PID 4116 created 4560	4116	Service_1.exe	161

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5952	powershell.exe
4660	powershell.exe
3436	powershell.exe
5952	powershell.exe
4660	powershell.exe
3436	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
66	4468	chrome.exe
81	4576	bootstrapper.exe
82	4576	bootstrapper.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
5964	winrar-x64-723d.exe
5544	uninstall.exe
3868	RarExtInstaller.exe
3028	RarExtInstaller.exe
1564	WinRAR.exe
3152	RarExtInstaller.exe
5452	WinRAR.exe
4576	bootstrapper.exe
4116	Service_1.exe
744	Service_2.exe

Loads dropped DLL 4 IoCs

pid	Process
4052	Process not Found
3280	Process not Found
3912	Process not Found
5188	Process not Found

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4116	Service_1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\rarext.lng	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\rar.lng	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\winrar.lng	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\rar.lng	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\uninstall.lng	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\uninstall.lng	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\rarext.lng	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\winrar.lng	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240976828	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723d.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723d.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723d.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-723d.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Downloads\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\Downloads\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	chrome.exe
4280	chrome.exe
4560	msedge.exe
4536	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Service_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Service_1.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274846784341109"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR-Wiederherstellungs-Volumen"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Service_2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Service_2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Service_2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	Service_2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Service_2.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\bootstrapper.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-723d.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Downloads\bootstrapper\bootstrapper.exe:Zone.Identifier	WinRAR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
2244	chrome.exe
2244	chrome.exe
5136	chrome.exe
5136	chrome.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
3436	powershell.exe
3436	powershell.exe
3436	powershell.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
2720	chrome.exe
2720	chrome.exe
2720	chrome.exe
744	Service_2.exe
744	Service_2.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe
4116	Service_1.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1564	WinRAR.exe
5452	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
2720	chrome.exe
2720	chrome.exe
5284	msedge.exe
5284	msedge.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5964	winrar-x64-723d.exe
5964	winrar-x64-723d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 1664	5136	chrome.exe	79
PID 5136 wrote to memory of 4548	5136	chrome.exe	80
PID 5136 wrote to memory of 4548	5136	chrome.exe	80
PID 5136 wrote to memory of 4468	5136	chrome.exe	81
PID 5136 wrote to memory of 5536	5136	chrome.exe	82
PID 5136 wrote to memory of 5536	5136	chrome.exe	82
PID 5136 wrote to memory of 2260	5136	chrome.exe	84
PID 5136 wrote to memory of 1428	5136	chrome.exe	85
PID 5136 wrote to memory of 2260	5136	chrome.exe	84
PID 5136 wrote to memory of 1428	5136	chrome.exe	85
PID 5136 wrote to memory of 3608	5136	chrome.exe	86
PID 5136 wrote to memory of 3608	5136	chrome.exe	86
PID 5136 wrote to memory of 1324	5136	chrome.exe	88
PID 5136 wrote to memory of 3308	5136	chrome.exe	89
PID 5136 wrote to memory of 900	5136	chrome.exe	90
PID 5136 wrote to memory of 2720	5136	chrome.exe	91
PID 5136 wrote to memory of 2720	5136	chrome.exe	91
PID 5136 wrote to memory of 240	5136	chrome.exe	92
PID 5136 wrote to memory of 8	5136	chrome.exe	96
PID 5136 wrote to memory of 2244	5136	chrome.exe	98
PID 5136 wrote to memory of 1100	5136	chrome.exe	100
PID 5136 wrote to memory of 1100	5136	chrome.exe	100
PID 5136 wrote to memory of 2520	5136	chrome.exe	101
PID 5136 wrote to memory of 2520	5136	chrome.exe	101
PID 5136 wrote to memory of 5908	5136	chrome.exe	103
PID 5136 wrote to memory of 5908	5136	chrome.exe	103
PID 5136 wrote to memory of 2552	5136	chrome.exe	104
PID 5136 wrote to memory of 2552	5136	chrome.exe	104
PID 5136 wrote to memory of 5360	5136	chrome.exe	105
PID 5136 wrote to memory of 5360	5136	chrome.exe	105
PID 5136 wrote to memory of 4588	5136	chrome.exe	106
PID 5136 wrote to memory of 4588	5136	chrome.exe	106
PID 5136 wrote to memory of 5716	5136	chrome.exe	107
PID 5136 wrote to memory of 5716	5136	chrome.exe	107
PID 5136 wrote to memory of 5676	5136	chrome.exe	108
PID 5136 wrote to memory of 5676	5136	chrome.exe	108
PID 5136 wrote to memory of 5096	5136	chrome.exe	109
PID 5136 wrote to memory of 5964	5136	chrome.exe	110
PID 5964 wrote to memory of 5544	5964	winrar-x64-723d.exe	111
PID 5544 wrote to memory of 3868	5544	uninstall.exe	112
PID 1564 wrote to memory of 3152	1564	WinRAR.exe	120
PID 5452 wrote to memory of 4576	5452	WinRAR.exe	130
PID 4576 wrote to memory of 5952	4576	bootstrapper.exe	132
PID 4576 wrote to memory of 4660	4576	bootstrapper.exe	134
PID 4576 wrote to memory of 3436	4576	bootstrapper.exe	136
PID 4576 wrote to memory of 5408	4576	bootstrapper.exe	138
PID 4576 wrote to memory of 788	4576	bootstrapper.exe	140
PID 4576 wrote to memory of 3616	4576	bootstrapper.exe	142
PID 4576 wrote to memory of 4116	4576	bootstrapper.exe	144
PID 4116 wrote to memory of 4344	4116	Service_1.exe	145
PID 4576 wrote to memory of 744	4576	bootstrapper.exe	147
PID 4116 wrote to memory of 2720	4116	Service_1.exe	148
PID 2720 wrote to memory of 5352	2720	chrome.exe	149
PID 2720 wrote to memory of 868	2720	chrome.exe	150
PID 2720 wrote to memory of 4280	2720	chrome.exe	151
PID 2720 wrote to memory of 868	2720	chrome.exe	150
PID 2720 wrote to memory of 5024	2720	chrome.exe	152
PID 2720 wrote to memory of 5024	2720	chrome.exe	152
PID 2720 wrote to memory of 1848	2720	chrome.exe	153
PID 2720 wrote to memory of 1848	2720	chrome.exe	153
PID 2720 wrote to memory of 1492	2720	chrome.exe	154
PID 2720 wrote to memory of 1492	2720	chrome.exe	154
PID 2720 wrote to memory of 5048	2720	chrome.exe	157
PID 4116 wrote to memory of 5284	4116	Service_1.exe	159

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rblxexec.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca0bc728,0x7ffeca0bc734,0x7ffeca0bc740
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,6171983042594291963,7609478241754556021,262144 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,11456621236337195940,5899520769900939395,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,6103324968770205824,2309637890859664213,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,1626341759555894343,15917487892013106674,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,983392071350825902,127796026209642558,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,10762085945885270042,6521205000492686084,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4516 /prefetch:9
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,11752286149098452487,4195171043233854028,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,15492924822904806931,7676578909376413812,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,1580157781234767630,15573202919584167376,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4536,i,10879438881757267633,1744739014572230435,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,7223608926623696828,10962799509616974700,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1152 /prefetch:14
  2⤵
  - NTFS ADS
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,9494388939618056672,14955876041798293729,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6280,i,14435067772740336186,8938706186073230009,262144 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6272 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5168,i,6265652316150561019,364881786726865366,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4988,i,11317547898491762179,16864622905853187145,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4800,i,18398003871251343563,9527820350276620976,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,5018594037185773126,7645720201457399,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4608 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6564,i,1399610111877619592,3015080872963960274,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6672,i,12914937826432468974,12060185580789007784,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6964,i,3689956086935058022,6052020941146001147,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7000,i,11121096451894993494,10524608849486890031,2097152 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,16819542958697946911,15906131231889010952,524288 --field-trial-handle=1952,i,4218472561287272598,11780099689547093082,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5096
- C:\Users\Admin\Downloads\winrar-x64-723d.exe
  "C:\Users\Admin\Downloads\winrar-x64-723d.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Program Files\WinRAR\RarExtInstaller.exe
      "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
      4⤵
      Executes dropped EXE
      PID:3868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2624

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:3028

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\bootstrapper.zip"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:3152

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\bootstrapper.zip"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\pbxznpu'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c dir 2>nul >nul
    3⤵
    PID:5408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c echo Åšmieci 2>nul >nul
    3⤵
    PID:788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ver 2>nul >nul
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\pbxznpu\Service_1.exe
    "C:\Users\Admin\AppData\Local\pbxznpu\Service_1.exe"
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Prefetch\*.* > nul 2>&1
      4⤵
      PID:4344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca0bc728,0x7ffeca0bc734,0x7ffeca0bc740
        5⤵
        
        PID:5352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,17028492504394415894,7630218615810098235,262144 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1920 /prefetch:2
        5⤵
        
        PID:868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,12737372000046269128,11738503648962930291,524288 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2036 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,3106188199939578265,15819860886276325176,524288 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2588 /prefetch:13
        5⤵
        
        PID:5024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,15429870556829915309,10939094586368554510,2097152 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2880 /prefetch:1
        5⤵
        
        PID:1848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2884,i,8943671649755233280,3499781404472834946,2097152 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2908 /prefetch:1
        5⤵
        
        PID:1492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,13335864216523485148,15508966452821770652,524288 --field-trial-handle=1924,i,13493246009155345034,166924652928823565,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5116 /prefetch:14
        5⤵
        
        PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffe9bc7c188,0x7ffe9bc7c194,0x7ffe9bc7c1a0
        5⤵
        
        PID:5596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,40245802780329896,18150851619782348119,524288 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1628,i,10460165907266777545,10555840256970201094,262144 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,12185231847120582319,1150488543966986291,524288 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,7094389553836433268,3299335455935829567,2097152 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,4493763835895607715,10475973239505507669,2097152 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,15827373068197116447,6313261386543872943,524288 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,11751988376451356996,16082977906680756851,524288 --field-trial-handle=2196,i,5031575963234687093,2213473188402898922,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
        5⤵
        
        PID:2144
- - C:\Users\Admin\AppData\Local\pbxznpu\Service_2.exe
    "C:\Users\Admin\AppData\Local\pbxznpu\Service_2.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec9e6c728,0x7ffec9e6c734,0x7ffec9e6c740
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,15906587108709532324,10114838496561503163,524288 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,8462005473570324152,11566628930565320450,262144 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,16170308666139722689,13771112251715030762,524288 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,11660378382439881769,17295271483593248106,2097152 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3392,i,2113915477090566172,6949615593000556532,2097152 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,5002982487968561874,10059583122752168788,2097152 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,19858228758183022,14287346936155101330,524288 --field-trial-handle=2084,i,7939599118546821354,3250714957654699659,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 145KB
SHA256 c9de42b98befee321dda9ce060776805cfe61382040a4795dc4687345d391196
MD5 86d32db1426f365f184a94a3b3a4fcd0
SHA1 febc42012fd8f8ebd592a62c703e9cd077b080c3
SHA512 74a091e21f35d0b00ba20ad7dacb66b669025f01b4e5a98ac8259a0fa4d5ce4455aea8be42bf833c507e3a0137e45f61e3c9490f94a4e0716ec165226e8f0379
SSDEEP 1536:s2hn5y1BAuIGa+OZ8FjUJ8020A+cp3wawvpKkwwh4eHOZUhkS29mRIqN0nKdfPJB:tyfTfOZ8Fj0IYIwInY
TLSH
T187E39613AD87112911B2A7047E04AC5FF31CE29BA74421A9B8DCC27A5F3B4F585FC5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 dcb5761b0d33645b9565fd6b5e022b15db0082062c0fed22202a9e6bebc86ed5
MD5 4467fa6a971f8954cf726c1f186cec05
SHA1 b905566456a46b7f645501ac2ae54c39ab8d7cc3
SHA512 86cab3d393b4f4fbc8f4a23f13dfd700f6805b7a0dac9bf3c9a8195d5aeaeddbbbba5ebd571cdf74c03fb8bd7ae5b0b1c5f83ddb7b9c6af3fe5527abe8e5239b
SSDEEP 12288:OyrI1lJlLZHJndEB7UFJtdqri2+arBQKuk9ltyiq:OyrIHJxHdEB2JbqzrBQKdltyiq
TLSH
T149E48D09A69853BAD47FD07CCA83461FEAB278558372C7CB03A116AA1F177E1573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 218KB
SHA256 0e87a2551e1b6a50b20529d44d1a0e0cbdb25e464310ba301129f097d913eecc
MD5 c9d143bb7a09bbe945d8cd5cb2dcd909
SHA1 e03598954dbfdfc33fab17d4257443003d6bd322
SHA512 84b1630c78b82cfa2c481830c4a9f20e54b0f7a04d9233e9e4ecded168e2d3ade77523790d163a0874ed5f32e7d0e986c93f210fc4f628bce2d466b762097301
SSDEEP 3072:wRWlXxJQ2QJUz/d6EsAm8kRq/FSGXUaszUQvHXcbviDktdd:PXk21/ghAmONSmQvHpSd
TLSH
T1E6247C49F2B950F6EABBD435C9624501FF3278414760EBCB27500BB99E23BE19E3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtPackage.msix

Path C:\Program Files\WinRAR\RarExtPackage.msix
Size 23KB
SHA256 9bd99b011fc9053589e97a4845ba2951d334fa6412190cd0d5f78d6a3e4d3d3d
MD5 6334da1a18462485d8898de26dc80d38
SHA1 fdf2f2464afca02a242588fc6522c370fde8804a
SHA512 4267e6ce051419916350abdccb2b7e337be007ae2976a9d967cfbfa17d4cd349488ab392a042e92671d9355ade72d55f5ffaba5745a24e9714ed704d84bf1cc5
SSDEEP 384:pQR015ziBz4oqvhFv+qkDJm0fxPZm7SxEDHV6sZd3NszRZ88mbIJRQoK7Tks+ehm:QYzMzHshFvbkDQoZ96MsZd3yCHEJRHK6
TLSH
T1DDB2CFF2B29928ABCB6DC4328B630D242464EE401D538E50FB99353421E97371B5AB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 403KB
SHA256 b2c9507de96f47f81a183985c2c1e350ee68fead1da3d91b90e5cfdb2dd46a56
MD5 0a62132d9d3bc70d0e7647985070fee4
SHA1 17900e092aad22a4e37c9b5d07a59a89ce53abce
SHA512 a2f6e5cae58280e8a05971d2b35e29a962096ce213df7a8896be1ce6b376dd0feac0de236aad5fb614095851b464da2235fad45771930fcb2722624e4dfd021b
SSDEEP 6144:K1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLRMIII+Sn5HBK7jc8b:OM1m5Pwtq9VSrJFgaIIvS5ejc8
TLSH
T1EC949C1EE3A455F9E5B7D13CC8924607E6727C558BB1C38F07910A5A2E237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 89KB
SHA256 aad36e5a715716443fe9d862517861068ded881f46edff1808cec1e7b142f559
MD5 76c59579f75c1932c5e0128f3d1cd1ee
SHA1 9b7b83d388c1614d6f48da8ef65f10421a83d5ba
SHA512 01f48704ed90680f21b399a546ef949248642120c42c05e948fa153184ba613fb8dcf75577f2c577662406e3100782c596971cd26a2f2c02d4289d76411db556
SSDEEP 1536:AagWECha3rnG99fw5p1bGpnfKj9NIS/NTfvC8bZAj+4wC:CbPpVTSL
TLSH
T10D93C7136887222526B263103E015C5FF75CE2AB774521ADB4DCC17A6F3B8F986EC1B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 397KB
SHA256 f7cb7b91d77a7fa6b08142c50ef2ba35f00fa6b5f7c7d419e28295e0dbd06c85
MD5 8cee054563a2c3998db50ce3598a66a1
SHA1 97707b0c5ea442c3e481bc7a58a4daca1b137fcd
SHA512 45498e6c46d4dfde1950c1c41bfdc56a21f6173e1e836f760f0d79193c20f6241366b11c6e15ffc94bb80d59829d8330b89093453ceab9b4ac80796ac53d4919
SSDEEP 6144:8bk/osXr4XDbI4nUybccqApsMcWO8Q+qrSG3cNqYHhdPTyWDsKjD37mSOxy:+k/hbB/yb5qApsyO8Irr2NrXDsiDJ
TLSH
T1228412A96C0D6B36D4DA7C73E6CD27DC676488D664C17A0A182F2BBD62C1FCC4205BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 130d6b728ba6f4b129c84cd3a6ee0b71a11219f813c4df181fb6823ffba7f484
MD5 f4078930cf6dd7db9bee2aef685eea0a
SHA1 dcc5d395a4af31ad30372321dd86cdc78e498bb7
SHA512 dfec77167f701b6880e3a20c11c991de044c424bbbc145aca563b043a94ece974813a6212d58719715a1840ebd6e5200905c57bf080cb1d648aaf6bbea1cf2b0
SSDEEP 49152:a7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgUUejuOXk0jdEKBH4S+:NsoEC9SKuO00j9BH4S+
TLSH
T107F59E1AA3E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.lng

Path C:\Program Files\WinRAR\uninstall.lng
Size 13KB
SHA256 d8b74af3f9a9b66ead912ad602e3af0728b6440021eedb3521a048ef5429ec68
MD5 d50838f272884a44c87b2893cc22d87d
SHA1 5219238d3b109fbe47afc51c02f1196d14e348ae
SHA512 5981d3237721de6b735829cf5dfa1c40e8e526d52468587e10f03689ca47d7f226783bfd4271056ab6917cad3f87ff5826e8b72bd8a314186354e5342e991802
SSDEEP 192:RMzvayg4LRN/YsHTZWWSU2Ldxn+wH0J6+g4Nkm2XnfY9XnGKTzKXEXMyTlP9zXFX:qjvnkzU2LdxnbnSCPpwDbvt1cZc
TLSH
T18852A0122ADD511CF1F27B902FF892289F62FEE4953ACC5E1558191F02F2D41BA70BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar.lng

Path C:\Program Files\WinRAR\winrar.lng
Size 169KB
SHA256 36d3bae710ace5b80008e8064693182e3f3ca8c42de20e0694238ced62c39afa
MD5 d41e57b39b673c20858faf0c3d1c25ee
SHA1 6bac428f888437421b2b1a76f6f66d80032d33d0
SHA512 e9e40106629d2f4d28e9b7aabb3db4a85e665c7d33fa1c1f3eff593cbbf5681f9b94fc402126e61d763ee3cc96e15f561a777cc3e8cca9dc0453513db806bbcc
SSDEEP 3072:woD8j+j4rI5os+8dLfLndtpaSHPfT/c4Et+vRQA4glyKkA6K2uezV8YdKGNDUfrx:TDhG6eDTyHcf/OB
TLSH
T13904800226ED2118B5B27B901FF4D1789B63FEE4953ACD2E1594184F07E3D41BA72BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 727B
SHA256 fa7ddbca62a6bc4cedf94626268741347ad21dc01fd254973f7f092559b827f5
MD5 d0929adef9a0d4eea4679df3284d2dc1
SHA1 0cc11b87e9c49a5c661d2fab962dfbedb242928e
SHA512 1fe7ebbeb3758db897543315c50305d14af3e173bebb5bbea34c6bf37fc54eb0624a01fbe13c0f114ea25b7dbdaf2784abd5f1ff324019f4957ed6cc89522073
TLSH
T1D90165D38F22E2D0860A88599B54F73636A492189DC45C37B66DD209F1806A14862D10
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 82ee0d22beb0ebeea5661d46957bb61c4f81fff7abe6550fd974f0f57953684b
MD5 8a111379bd1e359037a0552b05370c13
SHA1 e4fd02eb7d967686e3d7835f025cc6d2bea6ec69
SHA512 7eed726cef459e28bb45aa4afc48b37b5b9faddb943aad811f78e825ef42ee9a5f31c1faba7f08badbfe99d3446947867b927805929fa1537451a9e68d1505ab
TLSH
T1F801654218687981F5C4AC0ADAFEC7D8F2218CC828C103AAE7D496DA579DAE90503B89
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 404B
SHA256 8393c6ed1ec606c5e3e54cf1220fd4b9602ab140fcf612fde478b99587dece0a
MD5 0dc962937a4f70b6c50f047a42db1261
SHA1 822750da611040d3a974908f590fff12189a8ab4
SHA512 f776181c8179930fbead8bf5ca4b2aed02eb785d0e686b61dceed83bfc52d22df0e906b262519d8566257564064a12c1d9710c368aa1708824636e5c0fff9cfb
TLSH
T142E0263822FE4A6EF1F9D43883F6AC215B9AF2161552D3AD25406616EE36B404CD6A24
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 b2639c5f8b6ff3963bf1a345c34f660ee787500777d528c105f09d6c440313c4
MD5 94c49cab426e7ed31c41a6ad756a82b3
SHA1 6daaef0b9bf47cf04e402947241d7ba18be24886
SHA512 5e4ca4b78c183ae390191cf4e60eb7aa019ee704efbf7d12ba77dc67b3704eecbd82b047b4782584a18f7f9b680687779dbe7ce256c6ea4bcfee60538e8bbd9c
TLSH
T121E0683812EF760EF0908C3086F9A1720D48EA051844C2B90AC04308B76AE049C119B4
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d65599d6ada1368cfdd37752f9f4ffa701a4bb9094fb2761a55cc5148f0c2ad4
MD5 1a7b496cb37120bca33db2d03f3457ce
SHA1 732c46a5197ff6148c375e1f65cb278e50d8df97
SHA512 41371c2e5141492f47fd6d0a302598986e40fb26f768e9d989d60b9ea0c07c1e497e00d7256c2a8477e8bed1ddfb689f2ba063f9844a336bf610abbe08693733
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 18d22c4c63c30a594d13ae548aac76c395a9f3b2ff5fc3c2f318c89cb07fc3dd
MD5 6afeea52ac3222497ef0992e0a28a17a
SHA1 acd38080ba7b1867e5275500fcd1cebbef980744
SHA512 9fcbbaaacee0ab151a82848148d6b9779d5e82c88a5b5084f7ddb943dde097dadb1cfa303ef24e38ef50609beb96a5108f5fdc0cb6defcf657ef2e4c18c55cb9
TLSH
T1B3E02BA7CD229C2718FD4B1860604741E640131B37816A0F373C920C8FF8A7786A585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b5cf170849a2d7882484960a006f0fec8dbf10596beab7616649bc18189080a1
MD5 034e8d0baa074a6783ef15febd8d5520
SHA1 e9a11d3bc0645e0081e5d2cb38924d781cde720a
SHA512 afce294a8840b8548486b859855589b963b07f314d93b46fc7fe79e671b2523fd670d92092669d6ac1e42586d0a104d1be3b6d76d8f3c000705fe5cbd073379d
TLSH
T118B0125892804181D251433074D2116C302B1C7409033212A1C200A05C10B655142000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 845e4167880658f6f157ae275d35d13cb8662a51fb9963f7cf05fdd38a5e017a
MD5 f9cb1992cf51b4a76b15e5315f0935f0
SHA1 32f15ee750547ba2c94d5fb40afec55e4ca0808a
SHA512 50b43e08aca7c92c54ccf7ce5de6f0359252726ad362dfe3b31212aeed580127c7223591f171a124bd877f425f9af67b7abae0593705653029885c756888bfb1
TLSH
T186B012E423D01441FF314B3131D41FF8223A0F560103D3D786D1018C8C637DE4302088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 aad5ee2335a266ba483ffb8b54b28ab529fee443a58e579a85eb88dbc55d3774
MD5 0c2a26238d13c16cef260073ab424791
SHA1 7a46fb87162ea6c79fbb50b6b03c0239f5e1385a
SHA512 82f716ceed93734533fad675616a69c86881291f5cc0d8c0cc969c619e8a2b82865cf8fd80bc2ed3f4ca1513ac9a6f9a5a34ce13c8b1e51b931799fe46ae84ff
TLSH
T1DDC080C052B45441EB2159B0A895D1C1116D5F6E0543D6C785F9519D4C9776F410700C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 392b08357d4f8c53b25b791f56acbc0809ec972e101abd85f960651c8fae6880
MD5 2601cf3ddf4493fef44b0014787760a9
SHA1 2ccec06ddccb3a822114f791583a1e84b4ee55c6
SHA512 d65918ae77032ae78985ad299be7a3329f0c05f15acb64b39322bee89031a4e0f8f2f08a0ca97d9ae1d2378aff2e3e78026c642507bd7bd92528e0a8a6dfdf9f
TLSH
T163D097C093C47C80EB008ABC18C5CBC171385B64C103D68780D802AC8C9338EC88D00C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e8cd28b5a13e5eadc00abc3bddf393ba16cc5b17d05304fcaf4c53adb3031011
MD5 751bfd01da969a96496cafc12aed30b3
SHA1 2ca966ff73b8cc70f6336d925e7f19b3c438cfe7
SHA512 db57793d71b3050d07100acb96df9770de9bfbc0e6215dd844a8e83d82712fd46c7f88103f9680d52d8f7cb082550b9bca969e34fb6d68d8d7b24373b1137012
SSDEEP 96:D2j5uZJLrguraI0i9j5rjhGlgLbkzB7utuuQT:D2j5uZJLrguraI0i9j5rjhGlgLbkzB7l
TLSH
T196C1A2F7C3E9862DC51156F4AB256E1FCE290928432C3C66C8D8BE5B93F2572D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a2d43a9e5753b436385b0771a2d3cbcb1c76f27157f161be9ccf2ed70c20de2b
MD5 a02b2f65f1dab7b9d912af01094e5aa8
SHA1 996bdf5469c5278b68d97e7779d1aa184ad79bf9
SHA512 a031c64b71361e65db0c43b33de065d1406a5c9344e58639ab5694d52c08e44f7f98f4f1bf1266239ac64db862fa6970f3b1c44dce769b76b482ee5b66f4c4ca
TLSH
T1D18170F7C3E8863DC91155F5BA256E1ECE290928532C3C66C8E4BE6B63F24B1D24064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 824d7bbaafd25b39d9f43ca934f118af45fdf9746349d233dcf0f2de38bdcc32
MD5 8ebcb8755902fd700d90f8d384f45382
SHA1 bc9dab555ac0e7b0aea0a511dcc7ce5f9f889e55
SHA512 2000ffcd4c5c7b7ae907c56e448e20c13b30e5ad26556ce8e3e9cb3ca2fa0758f667a7a931a19dc2f07e2bbb0f3ccb378afe7dba5cb95953000191223384556f
TLSH
T1E451E1F783F8453ECA2192F4AA256E1FCE290535031C3C6688E4AE5753F2471D20074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f7e85193ae29716ca691b71529633a6a7f9b802885af910fe09b16e82b19c29a
MD5 5cf7a39a79c03a1a7179267ae139051a
SHA1 34d6fedd569c9f4c67d539bba010b5f7e1a26d4e
SHA512 202d5bf0a1809ffbd3d9ca8ab515615fbe8969d26a145fdfb2b5c5e0f6a80bd82e7f4d60a05730f92065a49d5e12594cd710e512c054ef6f5c5cf486256e6b86
SSDEEP 96:DcSj5uZJLrgGaI0JR9j5rjhGlgLCRPhPz:Dzj5uZJLrgGaI0JR9j5rjhGlgLCRPhPz
TLSH
T1FDB1AFF7C3E8862DC51156F5AB256E1FCE290A28532C3C66C8E8BE5B53F2471D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fea1c5fd66d2c3bb8b08bca21dc63d99f587420c98692ae68d5ffbfb264283de
MD5 8ab828cef15d1055c0f37623d6f3e0c4
SHA1 e0c926b8b34b8d5c294ee8b9170420a243979f65
SHA512 07a2f88f1099f60a083b6dbd65eb1888820937639ab10c1e120ed84c7a1aa840a79ebb93e4ab78ed9719c1ec4f1aa0047ea303ae4fc5a71d2d26edfb0079e5e0
SSDEEP 192:nRhK/2f4WCF+v7lpupAPRp2Y19fHsb+WNnDt0Zt2Hm2imUkwAVyIsnAUge:nRhKOf4n6ZgUX9Rw5o2G2iJke
TLSH
T16842C46EBA10393B5CCBD32AFD227B53D7F5102525942E84EAFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f18a023622d256b2420240eb18a8873fed198146061e5d321078e4a401e92ad7
MD5 f13a8051d27306e416122d6f08af3f18
SHA1 1941404faabca86126d929032b95fc5c90f6381d
SHA512 ee8c512490fd69b917fe61e4b5921826965ae5b8132ca1c9b3f89aa1342dcd7297188c55739c0b45be025efc77ee96ca9884a0e620e6475d138250ee8482b4df
SSDEEP 192:nRhK/2f4WCFjv7lpupAPRp2Y19fHsb+WNnDt0qKeGm2imUkwAVyIsnAUgg7:nRhKOf4nbZgUX9Rw5Meh2iJkK
TLSH
T1C342C56EBA10393B5CCBD22AFD227B53D7F5102525942E84EAFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4a549691ff44f93cce823c25a79bc9dfab60ac7d6da01441920eef18a80332f3
MD5 125e8bec028ace210a55465196a829e8
SHA1 57fd29c2725a5c12e4fe18eefe14f5f0e70376bd
SHA512 1b14a3df5b0eef44635ff5698acd7a8a4342c4a507fdd9d34a969ccf6963910825fcd330270f72d39ba99531c7b18725a41fe372347492fee847df848628920c
SSDEEP 192:nRhK/2f4WCFWv7lpupAPRp2Y19fHsb+WNnDt0qKePm2imUkwN8VyIsnAUgg7:nRhKOf4niZgUX9Rw5Me+2iJeK
TLSH
T16F42C66EBE10393B5CCBD22AFD227B57D7F5102525942E80EAFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 10afb6e3cada5760cd38146f387816d10d8cecee520aed1dfee69b0ebd11ba0f
MD5 49c4e4032f4b120b3a436a701f6725b1
SHA1 58aee0592fe7e2199f425f880e2ca485d959c613
SHA512 a5a5e1c7730db71b53319f2722dbf4e1fdb2f45ebd26264f38fbbf8a3b2389594af1bc6323c3d2ac4930f47b63090b3c436012a1dfa69b973cf02c58682c4cc5
SSDEEP 192:nRhi/2f4WCFOv7lpupPPRpTYs19fHsb+WNxdDt0O+A7mD2km2imUkwR8VyIsnAUv:nRhiOf4nqZgxXfRw9wAo2z2iJ6K
TLSH
T1ED52D66FB910293B9CCBD22AFD117B57E7F1102526942E84EBFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 49b76fdf9113982ff832b8c7fa771ac50bf1bafc2138697ff8f189551c35d118
MD5 7f166a30926b12c3dec881b7597d972c
SHA1 719aac7e58fd413a27d72a0606744216eb674c51
SHA512 d5bb1b0884c618456604354a946cb5a108eab4354f67e451ae56c75ad503bd342c19ce0e4e3c08e82047f3501216a2f29aa74a4d67dd409ebd1946a16b1b1da4
SSDEEP 384:rRh73f4khZgxX0RwqnhAorebVea2iJSjO:37QkLgaRwqmma2HO
TLSH
T13562C56BB910293B4CDBD62EFD11BB5BE3F1102526942E84EBFC8A1C15E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cb071e0ae19d0c56defca355b00cd1c2ac60b1a550d9e2db5442aa473d1d492a
MD5 bffc20b3c060c386007d20a47cb140b7
SHA1 004d039e3f77c7221cae2df8b58f3e2192ac350c
SHA512 669ce83ed4177cb606682d4a513cfe05cb2b7b0e6502f3a3c6193bed7b7ea5a15e86a7c9da9b96fe2f329d1a259e7c1eca3dfea758aeb207552f58e281126d79
SSDEEP 192:nRhK/2f4WCFDv7lpupPPRpTYs19fHsb+WNxdDt0O+A7mD2km2imUkwR8VyIsnAUv:nRhKOf4n7ZgxXfRw9wAo2z2iJ6K
TLSH
T12952D66FB910293B9CCBD22AFD117B57E7F1102526942E84EBFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d8bbd449952b5ef07c983fc37e35836d947b76cfbb3f0e5ea0c907e9aaa53228
MD5 0a5e3db584c70afa8cf96bcd660c61b9
SHA1 19d246361144f2d5bc199a1ec2a81f33d5a09aa8
SHA512 c0e3e7038d8a8b193939899b24d8384953c3db769734528854d7ea042030ccb2ae48879ffba334c0090536f1cc29988763b322f74924f9505b6a1716d836d729
SSDEEP 384:lRh73f420Zg8X0RwqEhMVAorebVeAv2iJpjO:B7Q2ygbRwqomm2GO
TLSH
T1B562D56BB910293B4CDBD61EFD11BB5BE3F1102526942E84ABFC8B1C15E76CD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7673c3bce11e8a22aed67ab1e6616d55a8f26f8fe7dc136e1d49f18fd871b7ae
MD5 7d71954de206997965ba81cce0cacb35
SHA1 f83c90d7c9bc32a4b7d7751ee0e4697563c9f838
SHA512 0e3b6c826301c405b6341c074d2fd1026772c37a3f40c0b1084e7c72e76706b8c8f4888d85ed70d43c4ff91032d05acca9592be2ca9a4c6e5e9533de967510bf
SSDEEP 192:nRhK/2f4WCFqv7lpupAPRp2Ys19fHsb+WNxdDt0O+YTm2imUkwN8VyIsnAUgg7:nRhKOf4nmZgUXARw9wYi2iJeK
TLSH
T17D52C66EBA10393B9CCBD22AFD117B57D7F1102525942E84EAFC8A1C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d2cb7e79c23ddd2d6b8d15eaf309d4cfe6da2ed856fedbec441f827bed1e6abb
MD5 ec7bafd4863cc4e0121c58a8d3858aa2
SHA1 ae09b188ade5c1496e4690df9c93702a19a587bb
SHA512 a6da09bc69a452fe9b0eab967850d875e11ae8f729d779bde526ab88f6d1d6386dfa029a547c8ff5272c6bc832741636efc9f79fa14767d274e25ce28c290110
SSDEEP 192:ARhiY2f4WCyOv7lpupPPRpTWns19fHsb+WNxdHMxO+A7mD+9K2Lm2imUkwR8VyIk:ARhi3f4cqZgxXBRwIhAox2K2iJ6w
TLSH
T13F62C5ABB910293B5CCBD61AFD117B57E3F1102626942E84EAFC8B1C15E7ACD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 839bbe4ad883bd242b1f05747b99e9f94c8e2bd8a29242f081eb99824d1235f1
MD5 6852cc0ca96f499fe5eb3f4fcdab3226
SHA1 cd05652735df575ab09991752b7fdf6044782881
SHA512 f99a3f66648106628cc490f4f8358b1538b8f4a9cd15fdcebde1bcce83da49373fc9f260c5341ee375a2355afa3fa04a64f3de4c69b44120169366d306415e90
SSDEEP 192:ZRhiY2f4WCuOv7lpupPPRpTWns19fHsb+WNxwLLrnMO+A7mD++Tybg1m2imUkwR9:ZRhi3f44qZgxXBRwqfoAorebgg2iJ6w
TLSH
T13A62D56BB910293B5CDBD62EFD11BB5BE3F1102526942E84EAFC8B1C15E76CD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b70762b7ac86803e640fd8716d4d445379dbb142c2898bdac669af11fafb7429
MD5 043c4001b98ce56c1dad6fdeae78e706
SHA1 83bcbd0f3329e94e699ddc16d16e522bc9defaf5
SHA512 d75b377256228fe4e17e54169e395ce60cce4a9b23be05cfdd6f7cb9fb3234c609fbd57799003d8a5d0e9dfeb0e4f46148b9941a415b596a29bb71d19cefdeec
SSDEEP 192:rRhiY2f4WCuOv7lpupPPRpTWns19fHsb+WNxwLLg+xO+A7mD++Tybgqm2imUkwR9:rRhi3f44qZgxXBRwqnhAorebg12iJ6w
TLSH
T1D662C56BB910293B5CDBD62EFD11BB5BE3F1102526942E84EAFC8B1C15E76CD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 67181c79c1f05ed63a781ad23636d20156ededbc59b59bbaa2775b821bf570dc
MD5 1ed2323b17eec57b0e2053295d6bab54
SHA1 7e519f0005c4578122cbcd686e4b8290aa0167f7
SHA512 5bf6c912bcc0add00e38189ee44c78d91a4f736ff84170ebd024c9b6dc0d22343eaa5bb44d872fcb907fb83e0c36f3c16904993bdff4dbf11df42e9d874f6739
SSDEEP 384:rRh73f47pZgxX0RwqnhAorebVea2iJ6jU:37Q7zgaRwqmma2FU
TLSH
T12662D55BB910293B5CDBD62EFD11BB5BE3F1102526942E84EBFC8A1C15E7ACD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d2561f314489cd59ac6e7b5d188280363f3c7b3bfe8ee472a59dc3c879a3383d
MD5 cfb761742b6cfef01ae54323931c8627
SHA1 d7824f384894e70a5d76152cbd9df3de0d1ef23a
SHA512 149939fa5bde74167716e16f22aabf9d90b592be232b9423f6d49226f318c012c721c8e811b91a75f8d39425a3c8107dff28e46f2a140de5ba3086622cf75fa6
SSDEEP 192:rRhiY2f4WC30v7lpupPPRpTWns19fHsb+WNxwLLg+xO+A7mD++Tybgqm2imUkwR9:rRhi3f4ZwZgxXBRwqnhAorebg12iJ6w
TLSH
T1F662C55BB910293B5CDBD62EFD11BB5BE3F1102526942E84EBFC8A1C15E76CD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 61c0b39adb9a2b99520c3a3ddd53b2398f03fcda0edced09bb5a3815f3089877
MD5 819217fc77cc138744e46c5bac5811ae
SHA1 509a312c335ba711a85eeeb702255d8f9a1f100c
SHA512 43545c3de81fe0c3c53a4c281e2ad3df7c89fa2bb7399d3f06cf1c064a8a188caafc8ab04daa2514da9a41124d93852403e1e1c384247c20415ddfda0045b5b7
SSDEEP 192:rRhiY2f4WC5pv7lpupPPRpTWns19fHsb+WNxwLLg+xO+A7mD++Tybgqm2imUkwR9:rRhi3f47pZgxXBRwqnhAorebg12iJ6w
TLSH
T11662C56BB910293B5CDBD62EFD11BB5BE3F1102526942E84EAFC8A1C15E76CD2217423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 27aafe44620fea362243929c7e7b85d838daa10285666bf0bb0e3e81a13d9718
MD5 ae24374c1723534b9ae87d429355644e
SHA1 07551b994e63fc714bd48e97604ed86b0a814842
SHA512 0d0af792798a3798fe3538f9910296b09ffd14fcfce8b0a118418728ea0f07c33e572bb6c6f0260d6af689541d1032d7d85e8f80e44093e445cf3f4a9aa70095
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLkdLcSjQRXODaB+ErU39IHwQ39Kqaaq:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7ps
TLSH
T1AE72F9A7B84C9A370F84D6CDD8267B4FADB5024B65ED886483FA982903D4BCF11461F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b2fd120dfd3bf9230f1ea3f5ae70f56f53f03df8b045d7fe32a7ad4fe916bf8
MD5 a32e2c9e0cb022358c13c05e0fdfdd13
SHA1 be21c8207b36eab8730ef683e6e3ffdfa9bf540f
SHA512 5a268c1ef1266c6411aef0588ff0ebdcd894dca3d2cb667311202f03a82aacaf58ea83c87ea6895ba90d16e3045410598c46a4fb6fee8a8d0e6a0058847fd296
TLSH
T159B0124180016211C09202B4224E14CC72185F20960A270953E06922EC35173C024860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e078.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e078.TMP
Size 96B
SHA256 a2b0e531f941ac84fd1f4e846ddc7ed27413a6d207e670d4e05ac603b3e40c55
MD5 6c74d85c9b7bc330c5e52a0a80388ef3
SHA1 0e6d227c22a68635c4bfa98d7cf2f283d09c4a4c
SHA512 7391f82a4d54f0b848fa1c76427aa04ad3b0d8a65b9710b16232ef122378e40d0b40a59cfddfebed63777351c8e7b0dd0815fb1562e851918523fb259bf0e90d
TLSH
T1F0B00295C112A322C44203B069999AED75B4EF36D6433222A6E12E67EC25B7AD526160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7597b750831428b7757d041fa9e3393734f65fcfdfebc10ffd6f436b36baff61
MD5 41d93615211e3c632eb266a52a7070d8
SHA1 be9fe2ed1d63b4a702da0eead9000e04069f4108
SHA512 598da7af5a920101c8bbe24aba94b228624a1aeea3fdf1e8877b66ea897cfa280fb5312d24231ad6841ef3d8c1a2b1bd0ce8e7aaff431c5d50db7dcd8953455b
SSDEEP 1536:SqKueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:9FDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1F8C31212CEAACEABE4A49C79E4C413F3AEBD5F9523F5B94241B6A4023DCE7041395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 8dfd3e4348eed19a897eb81c27eb63271615927ca2c2be1d3f038f33d18d134a
MD5 07bcfe33740343c0bb68fcb184eb1436
SHA1 b70ad1a9a23f9d7ef55334cf1268b542c661f1ff
SHA512 0efa3094dbb1ee6d45d16fc5cc807e0689b18dfae41b368409eff5216c9513de77d226db79e996da3ca38ad1632515cd755d45c6d820c21e41531404bfe1b24e
SSDEEP 3072:fyw1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL59DFpmzNA9J+zfAsJDREge7oWg+X:/mg1kQfATCFbzQACjAf+zfAk3WbhJ
TLSH
T1CB3423068FF44EBFA2540C7590C107F2B7EA9F69EBF22D94426756A33DCEE442381520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 ff91b807360f2e53a9cd35165e65c1b0201b4c9c7276785a5a303cd220aa995d
MD5 2ff2350551f24727c29801b60f28642a
SHA1 2c258ecd9487cda763bdac3f73fb5435b4736b40
SHA512 04db3ce1440820b709d67fc0b5a35c6b946bb3832e847616ffc5e4a61a4cc3ba2949c3966e161cc74bcee255bdf24e326149e425b700c466f5dfa6afeeef9ecf
SSDEEP 3072:keJh1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5cDFpmzNA9J+zfAsJDREge7oWgl:LPmg1kQfATCFbzQACjjf+zfAk3Wbh+
TLSH
T1D23423068FE48EBFA2540C7590C117F2B7EA9F69EBF23D94426756A33DCEE441381521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 76c295cfdf26625d71306b0f0bbd8ecaebbf9ca4ada8a8f632a74fd47abc930f
MD5 de2f673ddfc5844f3125d79ed41a4a46
SHA1 0c19076baade71d9ad05a19b748cbe41540045b6
SHA512 2444327f45f60eea09e094f9455be3c78da4871a16d1f8adfd38ef1be7c79607f1618a73bea8d614d7ca61e0af14e040e0ecf580e6d762df8fed68413a673619
SSDEEP 1536:SXTueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:CiDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T10FC31212CAAACE9BE5E49C79E4C413F3AEBD5F9523F1B94281B6A4023DCE7441395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2bc22db4baf0324584cb7575c3641ef937a8c2a038482ee7f51eb3324b72035e
MD5 8e076ca9c5c39fc9505847611d383ce6
SHA1 3eb3f9932277081c1940581f3b0172b48d69b9af
SHA512 b640d13adc51fa0e421f10b4d4ca70a66e7066bb7d869b2cb41b470c0fd5b77c621757720e8ea4a95cc379497498d71130b6131b7ee40131682063e96e99cc44
SSDEEP 1536:nDueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:yDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T18DB30212CAAACE9BE4A49C79A4C413F3BEBE5F9523F1B9424166E4023DCE7042391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 362678996bb4bde1f413fa3a6409e5e5f1100ab9d2411e5d3ed02b6af8cfd559
MD5 88c01cd477dce64f198c1e470e1f61c3
SHA1 e592d57511a5b286024270f6c0091412f9396ced
SHA512 07c2e72ee567d5a4f86ec686007f15aa5c924a80fd2653a04d838c8a11cb263997e19dcc878ec687628a5a86b084a3e3ba10a0a6fc416aca2dd74696a6751f4c
SSDEEP 1536:vqKueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:SFDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1E0C31212CEAACEABE4A49C79E0C413F3AEBD5F9523F1B94241B6A4023DCE7041391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 78ff151442e054708a2c7e9d8e6e4f98e4cfd4572a411c02fe8c1c8236dc5f64
MD5 a1a88e2293f2726dfc857a2c9a79932b
SHA1 b2286d73f802cabffaef888733c5c98a2ee3c6d3
SHA512 83af40bbf158feebc5c007084295a90a2c5a71f7673f57ed8689a55f225849bfa1a2c3e029f89ef4e0fbf4f58491af09114347c15d082e5f4c48b5fbdbd52ec8
SSDEEP 1536:WFZueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:eQDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T17AC31212CAAACE9BE4E4AC7990C517F3AEBD4F9527F5B9028176A4423DCE7441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2b67876ef72dc59a412d5f37f3b8e70563c00443faa85a6f150cadfb3bf5dd8f
MD5 9f3bc730c20916c53568bac7739cc694
SHA1 2570ef79553091336258f475c6ed5985a7257b93
SHA512 a20c646b120530d1d884ce40a44a589d5579faebc9e76060585862bc453b31f68ca9bfbac88326bf51ebe59ee6d8de87ed849de32f98f6dea73106c9ea2e354e
SSDEEP 1536:WRZueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:uQDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T135C31212CEAACE9BE4E4AC7990C517F3AEBD4F9527F5B9028176A4423DCE7441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e3306cc3e83660c7de06292117924ac57f6d54d7afe01253834bb30a80b02fa2
MD5 8a82855d056819dfb85b0c55acf7059b
SHA1 d36d2599c79dfd10ba6aa2b8c0ba61d1758e820a
SHA512 30bb8931b1fa29093ab5e865131c6e5b467534e84da5fe18556916164a8ffeaaeb74f1ce35797eb5abf66db001b7872781155e3c8762a363c5fc4c348ca35176
SSDEEP 1536:SCGueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:VpDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T183C31212CEAACE9BD4E4AC7990C517F3AEAE4F9537F5B9028176A4423DCE7441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e878eb8430ba641ffdb8223a6ce02119a4df4c22e65d849e9258d907ad5d0af5
MD5 42ce68651056714dd2fb16052cda6533
SHA1 3f49ecdfe01bdb77d0f09fe1df45e917c5c3870c
SHA512 4ca623da5517832ba57eca0625dd2f6de544e509af6e20e3802e30a5b4cd91be296dfae8f9905ac562fc26678e3e1f8ac1054b9b822da098719a0614ee9e990c
SSDEEP 1536:SFZueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:SQDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T129C31212CAAACE9BD4E4AC7990C517F3AEAD4F9527F5B9028176A4423DCE7441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a40be9eed2773b5be9a676843682993b842804ea9fb641c7264bf7f0d7da0eee
MD5 a00e971705ab7bae5fb3869c8fba2f42
SHA1 e7d943c25d724ecf69b62229d004ad40d44d4ea5
SHA512 04436156b1a1736b7d654db6478201160bc028e931dc59082c94ebd942d2093f7f1c7029a715848aa8de08af004a4dce8b4ddd498c10498b36235c46ffebc148
SSDEEP 1536:WyZueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:9QDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T102C31212CEAACE9BE4E4AC7990C517F3AEBE4F9527F5B9028176A4423DCE7441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 32303cc60a61c54695a10e22e5d4927afa9f3b317f38a1948b3d06b9908ad31c
MD5 fa1d2c7d03afb864bc0f0aeb5e1cf53a
SHA1 4193d63e49c8c734df72c75bc3bc68ccfb747550
SHA512 18e675c077e47d9f348de8d1e8289d3e14124bc45c1080067ad25b834aba4faa30eb3894a3408fff992d86eea6faa72110686428608635b48f56f06f7836bca8
TLSH
T12FD012273B0DA054E7A9C2729613C7921BB6646174434B05E315C95CA9B44E412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4f21a778a834da1fcb026b54e47bd551bc0f2ba8d1523262d6c8b471f0c03035
MD5 2da72b548c26cb4d923d8cb038524f2a
SHA1 bbf1729cbe66974e8ee1529ce4ef20174b56abc3
SHA512 1da2cd2a2f9a25b317b8841d4c18918bd08b4ef473ab68fb555da6c23ff39788a66d59fdf66022aabf8d4c3cb12c13aac6aecb53412017c4a66f8fb153770ef2
SSDEEP 768:RFccps3AxwgPKekmNZBxGUw6zuDpVI8p0F:Vs3ABkWfzqzI8p0F
TLSH
T1E2C25B35EC68C9BBECEA4FD9B70E6617DEE01123959849E8DAD80D1D009B1DD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 706dd79fbc25097c2babbb0702b375efca7ad9f0df28bc2668f2638e4093b461
MD5 dfee9ebc90079a08b1983b5e023cc1ca
SHA1 4771093c1571250be08e05f853724e8aa0a019a7
SHA512 a201bf80bfaf9328cdfce13f011e8f41338fe1818b43fca2d4e11618026cb090f86de31590f08726cbf922e3786d9365c53b113d471585074e8824e0805dca32
SSDEEP 768:3Fccps3ArwgPKekmOExGUw6zuDjyBI8p0F:Ps3ADkSzqjcI8p0F
TLSH
T1F1C25A32E868C9BBEDE64FA9B70A7617DEE01163958C89E4DAD80D1D009B1DD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 379725b221f4f46fd50b6cc7dfbe9b5ba0733f46d6f3d8b842803267790962a7
MD5 373b33581702df03877dc52117d115ca
SHA1 efd4b08999518179daa5a1b7bbd3ea0341ee42a5
SHA512 7467db64d1a37876cf751eeb140fc13fd9a2835bfe976cbd26b66d69daacc73b3c2360f02d12328b4f89511cdacb09c2c003c584b5257fb2196c7350e38a413d
TLSH
T152218633B79CC134C8C911BA108DAD01B2B5C3C7449ECE9B7BC4C528A5BF89ADF681A4
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe
Size 388KB
SHA256 3260b15258831fc9f8dde6773035726c3f6d63a2082b7c6b109323f85802c1e8
MD5 72648e5a2d7f635cfbb8615e32808c9b
SHA1 e3da630dc9893db54b8ca88d26e1a217b8a23c34
SHA512 70472f269e9f5c4b0fab464361d94fb4bad57f5d71bf855077b9df67ac7264d4b6a1e4df516ceb87c7305cb5f7ce571f05200da32755d51139539bc06ebe3d9a
SSDEEP 6144:DxHq8HgsLvTY+M0BsJ1zMbIYT+545nNI/Neq3pKOKJYWDt:IsoFJ1ATld+/HXKeWR
TLSH
T1FD848E1AEA6404F9D163C178C9624907FA727C5E43606BCF23A05AA75F376E49E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrapper.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXb5452.46748.rartemp\bootstrapper\bootstrapper.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xn3blhmm.u45.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xn3blhmm.u45.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

565bc324

Path C:\Users\Admin\AppData\Local\Temp\b057b5fa\565bc324
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Service_1.exe

Path C:\Users\Admin\AppData\Local\pbxznpu\Service_1.exe
Size 283KB
SHA256 f07d854d04a406a3506346f9e39c924865f8a9cd1b074629e1461f53bc247ea6
MD5 1e2550e348ce2b2662c30d06970bca1b
SHA1 387cdee0e3e0a9c5a5737d77eb19b2ad4c975ca7
SHA512 a42f45dd24c614e2ae59553a027af9e9eb7660a86711eca8ac45250a065525554f52448b8c5dcf51ee8e785fdf4550c0f5454520f9aa70a2530c9984240b7781
SSDEEP 3072:fsZHwWBXV+WISOMphc7/25Y4jcZSmh0WFS05e5HVmFYt1zDye0KGnX5/j25HEX9/:kZdmQY4oYmh5sJ/KGrK9z1zE8RLM0
TLSH
T13B548E5AF7A508FAEE77817CC9524601EA727C564760D6CF03A04AA72F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Service_2.exe

Path C:\Users\Admin\AppData\Local\pbxznpu\Service_2.exe
Size 8.3MB
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 34fb4bb45b99afd8cea815246e67428fe9515418c61e28738a74fd7f3c4542a2
MD5 f38d528021077655450270510370ceb1
SHA1 9ce7de4365ecbad08e298eadb08427284ac45c1b
SHA512 73d76f3fc57a36793a81d201c374ce2a6129b3a48bf3c01efd99ba120f1e7c7f9939e18bafc34a8d8e06e4c17c6d0ae7504f4be7878083d778dc0916d98f8c59
MD5 SHA1 SHA512

Submit Download

Nicht bestätigt 769531.crdownload

Path C:\Users\Admin\Downloads\Nicht bestätigt 769531.crdownload
Size 3.8MB
SHA256 ddefb140a86ec1446c7b3db6fa6aea861d45930cbbad9447388361d346035e96
MD5 828a8bd3dd9fe224c7194bae10cf476d
SHA1 44f8b5743414b15f58fab55ce21db452f2e7ff86
SHA512 eb8dd1a0f22f42e3b538fac43d6122dbd30d0df64d21f60fe82ef3443c99b544191f9e5bc0251503ce6ee835201cdf6aea4015e46300f59406aebae7630a9f46
SSDEEP 98304:/qBAGbhNy31uZGjrErXhYrtr7BBk6CBkyUiL:wb2JErXiF9BLPGL
TLSH
T19606232DDBE914B5F077E638C9F20606EAB23CAD4770969F2395164A2F332D05A3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrapper.zip

Path C:\Users\Admin\Downloads\bootstrapper.zip
Size 186KB
SHA256 797819d1bd0b1699c1d08a0a4464fa8f1f2a71123633fda1cd97be54690ce287
MD5 84e89908a5d49fbbdf9096beb63f2cdf
SHA1 8a351d6be86ea2195c2cf90fc1dc4c4d626122af
SHA512 0fc2148d53cf48471aeb1a9ac2a0f968b4f2ecaefd51dcd9dfc790fd927072b8e29199dcd663dcc6216326c0df6ca4010ee12c68cdf90f9d45a58579976e0076
SSDEEP 3072:lpe89KkcUON+jO/GH6hvEwHCZGKlRC94WLzp1KyY0dJfF:lARU9C/fhtBKlRC9xL/
TLSH
T16C141210A8D6B0D5BD08007E36AE97B3BB081F8A8A7814E351DD9DE14D8EE9F4771D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrapper.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\bootstrapper.zip:Zone.Identifier
Size 202B
SHA256 6a96dd3dbb942524f41f8cd0d52095c68622060ce981e83319431729976363ea
MD5 bfbfe9fce6d83a80025a0bdf7f81fc02
SHA1 1a47dbe57e6bfe9794c885e273e6f1f8b3af74a0
SHA512 7b61272726f71998270f1a239e4b21ceb1103b9c5d3fa9833995033a12309ead3a6aeb359c48c49e526e3f03e7fa2e5c39f32d984e504eb97ff790168acb32a8
TLSH
T140D0234F34684DB403551BC4345C885DB5EBD8149F425248DC801DB33C4C4FCCE71A39
MD5 SHA1 SHA512 TLSH

Submit Download

winrar-x64-723d.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\winrar-x64-723d.exe:Zone.Identifier
Size 163B
SHA256 4e16cc3973273a48886f07436e31c7f8e5a7c8ab46f6c8d6a9dd5162d4067e35
MD5 34a702b185c69832f7073b4ed8bf13dd
SHA1 f256c1006aeeaab2b59747e030daaf6894008483
SHA512 4f99f3944b839f304c8dd146dd0e2354d29296d08ba761e55a1aaa442c85b4ea1c7568b704138a5372bffcbcfe11a534ac0bf6826380ecfde37d2d9e35b90fca
TLSH
T1B8C08C5B8840CD544D5C29F820EC918CA00B702C6C66808DDC78854B991419B8D9001F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-771-0x000002816AF90000-0x000002816AFA0000-memory.dmp

Download

memory/744-774-0x000002816BB80000-0x000002816BBB8000-memory.dmp

Download

memory/744-844-0x000002812E7B0000-0x000002812E862000-memory.dmp

Download

memory/744-775-0x000002816BB50000-0x000002816BB5E000-memory.dmp

Download

memory/744-773-0x000002816FD50000-0x000002816FD70000-memory.dmp

Download

memory/744-772-0x000002816F7D0000-0x000002816F7D8000-memory.dmp

Download

memory/744-770-0x00000281689F0000-0x0000028169236000-memory.dmp

Download

memory/3436-719-0x000002533A0B0000-0x000002533A163000-memory.dmp

Download

memory/4116-754-0x000002117A500000-0x000002117A611000-memory.dmp

Download

memory/4116-755-0x000002117AA00000-0x000002117AC26000-memory.dmp

Download

memory/5952-683-0x00000162FEFA0000-0x00000162FEFBC000-memory.dmp

Download

memory/5952-681-0x00000162FEF50000-0x00000162FEF5A000-memory.dmp

Download

memory/5952-685-0x00000162FF6A0000-0x00000162FF6BA000-memory.dmp

Download

memory/5952-684-0x00000162FEF80000-0x00000162FEF8A000-memory.dmp

Download

memory/5952-688-0x00000162FF030000-0x00000162FF03A000-memory.dmp

Download

memory/5952-686-0x00000162FEF90000-0x00000162FEF98000-memory.dmp

Download

memory/5952-682-0x00000162FEFE0000-0x00000162FF02A000-memory.dmp

Download

memory/5952-687-0x00000162FEFC0000-0x00000162FEFC6000-memory.dmp

Download

memory/5952-680-0x00000162FF360000-0x00000162FF413000-memory.dmp

Download

memory/5952-679-0x00000162FEF60000-0x00000162FEF7C000-memory.dmp

Download

memory/5952-672-0x00000162FF050000-0x00000162FF154000-memory.dmp

Download

memory/5952-671-0x00000162FEDF0000-0x00000162FEE00000-memory.dmp

Download

memory/5952-663-0x00000162FEE70000-0x00000162FEEF6000-memory.dmp

Download

memory/5952-664-0x00000162FEE10000-0x00000162FEE32000-memory.dmp

Download