hxxps://dosya[.]co/w7wpq087nka0/garantilog[.]rar[.]html

Analysis

user interaction
yes
max time kernel
900s
max time network
905s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/w7wpq087nka0/garantilog.rar.html
Sample260722-wzsntaxvex

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
342	4416	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	winrar-x64-701.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
3816	winrar-x64-701.exe
2836	uninstall.exe
412	WinRAR.exe
4432	WinRAR.exe
2056	WinRAR.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinRAR.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_241196515	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292181906756973"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	WinRAR.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
924	msedgewebview2.exe
3544	chrome.exe
3544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	2192	wmplayer.exe
Token: SeCreatePagefilePrivilege	2192	wmplayer.exe
Token: SeShutdownPrivilege	3120	unregmp2.exe
Token: SeCreatePagefilePrivilege	3120	unregmp2.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
2192	wmplayer.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
412	WinRAR.exe
4432	WinRAR.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3816	winrar-x64-701.exe
3816	winrar-x64-701.exe
3816	winrar-x64-701.exe
2836	uninstall.exe
1976	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1660	3544	chrome.exe	85
PID 3544 wrote to memory of 4416	3544	chrome.exe	86
PID 3544 wrote to memory of 4496	3544	chrome.exe	87
PID 3544 wrote to memory of 4496	3544	chrome.exe	87
PID 3544 wrote to memory of 1576	3544	chrome.exe	88
PID 3544 wrote to memory of 1576	3544	chrome.exe	88
PID 3544 wrote to memory of 732	3544	chrome.exe	89
PID 3544 wrote to memory of 732	3544	chrome.exe	89
PID 3544 wrote to memory of 448	3544	chrome.exe	90
PID 3544 wrote to memory of 448	3544	chrome.exe	90
PID 3544 wrote to memory of 1004	3544	chrome.exe	92
PID 3544 wrote to memory of 1004	3544	chrome.exe	92
PID 2192 wrote to memory of 2156	2192	wmplayer.exe	96
PID 2156 wrote to memory of 3120	2156	unregmp2.exe	97
PID 3544 wrote to memory of 4432	3544	chrome.exe	102
PID 3544 wrote to memory of 4196	3544	chrome.exe	103
PID 3544 wrote to memory of 1284	3544	chrome.exe	104
PID 3544 wrote to memory of 4632	3544	chrome.exe	105
PID 3544 wrote to memory of 1116	3544	chrome.exe	106
PID 3544 wrote to memory of 1116	3544	chrome.exe	106
PID 3544 wrote to memory of 1940	3544	chrome.exe	107
PID 3544 wrote to memory of 1940	3544	chrome.exe	107
PID 3544 wrote to memory of 2704	3544	chrome.exe	108
PID 3544 wrote to memory of 2704	3544	chrome.exe	108
PID 3544 wrote to memory of 3528	3544	chrome.exe	109
PID 3544 wrote to memory of 3528	3544	chrome.exe	109
PID 3544 wrote to memory of 2752	3544	chrome.exe	110
PID 3544 wrote to memory of 2752	3544	chrome.exe	110
PID 3544 wrote to memory of 3596	3544	chrome.exe	111
PID 3544 wrote to memory of 3596	3544	chrome.exe	111
PID 3544 wrote to memory of 3452	3544	chrome.exe	112
PID 3544 wrote to memory of 3452	3544	chrome.exe	112
PID 3544 wrote to memory of 3116	3544	chrome.exe	113
PID 3544 wrote to memory of 3116	3544	chrome.exe	113
PID 3544 wrote to memory of 4120	3544	chrome.exe	114
PID 3544 wrote to memory of 3808	3544	chrome.exe	122
PID 3544 wrote to memory of 3808	3544	chrome.exe	122
PID 3544 wrote to memory of 4836	3544	chrome.exe	123
PID 3544 wrote to memory of 4836	3544	chrome.exe	123
PID 3544 wrote to memory of 1976	3544	chrome.exe	124
PID 3544 wrote to memory of 1976	3544	chrome.exe	124
PID 3544 wrote to memory of 2372	3544	chrome.exe	125
PID 3544 wrote to memory of 2372	3544	chrome.exe	125
PID 3544 wrote to memory of 4992	3544	chrome.exe	126
PID 3544 wrote to memory of 4992	3544	chrome.exe	126
PID 3544 wrote to memory of 3568	3544	chrome.exe	127
PID 3544 wrote to memory of 3568	3544	chrome.exe	127
PID 3544 wrote to memory of 2248	3544	chrome.exe	128
PID 3544 wrote to memory of 972	3544	chrome.exe	129
PID 3544 wrote to memory of 972	3544	chrome.exe	129
PID 3544 wrote to memory of 2208	3544	chrome.exe	130
PID 3544 wrote to memory of 2208	3544	chrome.exe	130
PID 3544 wrote to memory of 4268	3544	chrome.exe	133
PID 3544 wrote to memory of 4268	3544	chrome.exe	133
PID 3544 wrote to memory of 368	3544	chrome.exe	134
PID 3544 wrote to memory of 368	3544	chrome.exe	134
PID 3544 wrote to memory of 3016	3544	chrome.exe	135
PID 3544 wrote to memory of 3016	3544	chrome.exe	135
PID 3544 wrote to memory of 5064	3544	chrome.exe	136
PID 3544 wrote to memory of 5064	3544	chrome.exe	136
PID 3544 wrote to memory of 744	3544	chrome.exe	137
PID 3544 wrote to memory of 3816	3544	chrome.exe	138
PID 3816 wrote to memory of 2836	3816	winrar-x64-701.exe	140
PID 3544 wrote to memory of 2308	3544	chrome.exe	148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/w7wpq087nka0/garantilog.rar.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffabf3cc728,0x7ffabf3cc734,0x7ffabf3cc740
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,8026571183272066892,9581865348863179008,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,13607835039214695009,13177991297683964496,262144 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,14518938286658495211,6161478256310334219,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,5077052981976331636,1952671757205661524,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,61607502206067436,2726144922191837487,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,8879304323946226248,14099674706447061716,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,13329591671666657827,15132813006199993068,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,14765443548974373389,1718733442983779156,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,15138051056599495335,11969232069156190514,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,10792288671639790039,9138987376093335716,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4412,i,9910294809326885560,6107325438243899077,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4444,i,7321118005052882231,14001535900406935073,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5652,i,9613315811967469059,16903139129851745477,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4448,i,1900101671175978106,6412618119726145409,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,121565125343781646,88263204350677220,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3336,i,14338138544343391466,6054387798142617526,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5964,i,56360182095987838,16296080257103306129,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5648,i,10724871587852583682,45083781085346886,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7052,i,16789094906564601090,15565599721107737226,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5968,i,2843268588461089370,4152706782907651394,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6260,i,11997856522445308047,15019409889595170206,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5668,i,15800303665436487894,4842063908091680990,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6312,i,6590621226200121500,15139802158443562879,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6828,i,16701282283437735885,14055389975566808615,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3248,i,4092455665610573338,17022632355386945764,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=996,i,7519404989698085662,9360431341649654483,262144 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3112,i,11095956129945853926,3968352528989049475,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6864,i,18144447822797033815,4379437459653423653,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5764,i,2596877169748084958,16930624746175964433,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5680,i,15099013243613795184,2425549464674722014,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5496,i,10003931766301823325,9113239747941340784,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5768,i,15255495696347843137,2140083425435097827,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,4387991373812229466,9415828337838264509,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:744
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5080,i,14394139896425970888,2710435228414351534,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6084,i,13818300577194696437,11986991347976035275,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,2615113982482733824,11420565639398579975,524288 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\garantilog (1).rar"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2056.1988.1412291082250119668
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:924
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0xe0,0x7ffaaca5b078,0x7ffaaca5b084,0x7ffaaca5b090
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,12851821545925578783,3310254620681381688,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2056,i,12851821545925578783,3310254620681381688,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2312,i,12851821545925578783,3310254620681381688,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,12851821545925578783,3310254620681381688,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7324,i,15378984759139881499,10979004813499124738,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=732 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7480,i,13797909419565697549,15228135211520041504,2097152 --field-trial-handle=2056,i,13238355344571271565,2159167587321653057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4056

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\garantilog.rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:412

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\garantilog.rar"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 105KB
SHA256 59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd
MD5 b954981a253f5e1ee25585037a0c5fee
SHA1 96566e5c591df1c740519371ee6953ac1dc6a13f
SHA512 6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531
SSDEEP 768:FoxKukh1SIfjcjKVbRZHqT9E1qYiHSzoOKyGi018e5xCwVxD+wb+WkOPMYC7:FoxKuOKKV9Z699S7Kyi1ZbF7iWBXK
TLSH
T147B3D8277E8E1371257201965F19A199E31090EF371F129538ED838C7F3A8A792F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 477KB
SHA256 f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c
MD5 4783f1a5f0bba7a6a40cb74bc8c41217
SHA1 a22b9dc8074296841a5a78ea41f0e2270f7b7ad7
SHA512 463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e
SSDEEP 12288:9Z5zraThq5dDnHEJt1kXm+wBhvBJ/+5IISY1A9h:9Z5n2hsdDnkGXm9Bhvn/+r1+h
TLSH
T1EEA4AE59A79409F8E8B7D23DC8A24607D6B23C558B31C38F03A6165B1F33691DF3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 45KB
SHA256 33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d
MD5 1c44c85fdab8e9c663405cd8e4c3dbbd
SHA1 74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88
SHA512 46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d
SSDEEP 384:cZIEmAyhs0z4NNVmF5OgUDBA2XCh9Iq1IAnUc9joBHLKp63xUA5B33vX6TBcxAfL:cZ41kVEbUDbwXic9p63Df3fXxuWJo4c
TLSH
T16C23B5237D9A127169B242952F166295F31861BF370B4284787C838C3F369A7D2F72F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 316KB
SHA256 997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344
MD5 6ca1bc8bfe8b929f448e1742dacb8e7f
SHA1 eca3e637db230fa179dcd6c6499bd7d616f211e8
SHA512 d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973
SSDEEP 6144:0HQbQuhUP/yv4J15/8Z0lIiFiDoQRkx79WftE+qby/919rRj+g8HR:JQuayv4V8ZMokx79WfGxI9LrPcR
TLSH
T1516412881D8E4132E0C8BD3AD4DD03DD67B5208A2A207F531E6F9676DAE2FCC9599731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.1MB
SHA256 3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3
MD5 53cf9bacc49c034e9e947d75ffab9224
SHA1 7db940c68d5d351e4948f26425cd9aee09b49b3f
SHA512 44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda
SSDEEP 49152:olh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlGBzNwui0hBdH3XK:oMgZeD+hBBquTBpnK
TLSH
T1D6E59F06A3FA06ADE0FBD278C956D903E77A7C090270A75F069055A72FBB360DE79311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 06b3efaff9e0c2c29f16a1a9b7b4fc8aae056756cf440a073115cc99050e635d
MD5 1419e5607c367a28688ccc2415207fd7
SHA1 1c7eb45f7da021cdc9f96c2f7a9935fc5dedafff
SHA512 9200b5ac567e20e820bc4b4c8620e226f32988d7ab30f094c1ebb63516d122dc517913a1c64d77e271a5d6cf2db58ef1486e4e5395fa56c1ff540c35f719c5d1
TLSH
T1ABE02B9FC9619C371EFD071950928706EA5513572E80995F3A3CC30C8FB062A4686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 76KB
SHA256 56f4dd5f9ff192bdb71a821992b532dd598ec68d4c84e7573c4b21f1d8fd09a3
MD5 1d66a1f18bfc018606f1c6b0a7752c73
SHA1 7894577b3c41581f763487cc1dc3ac4e70f6a733
SHA512 0c35ac08822a41cffb1af46e7418dee5df48305d4a59a328c634f1fc9e61705e3fb3bd56fec8c8b41f7a6bafbd22a05cd5836847b807558aae6a30dc887dd88e
SSDEEP 1536:NP2s5929RxRq2Q/nbmS1qSF1ZPCvARcBOCtIgSG8s0FU+:N95929/WbmS1qGZPSBOit9v0FU+
TLSH
T11E730260C994482C4CD1AA0AEDA1A333AC68734558FFBE01900E8DE593D3AF74E67E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 41KB
SHA256 91bce6add8ce20a7d4565c03a1080417a5a784b56a5ccce930ac8cb2fda360cb
MD5 b94522dd62dfb67f5f92c71a2658d385
SHA1 4b89001265e949ee0f6f92fb50ce89ef8a1f4a95
SHA512 f05a366f24c991bb329b202f05af1162e3ac734ba14f1b378dd1ea9dc1cf899adc3e24d41aa7006d29c8c5f49653919bfdf4f2b8f11741b63d907386f48e3d66
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+w7W8z77ZL493nvEEGMdY5VKoufS/rYp+S:aq9/EIwVTT3PHGAm48FL493XGB5TlcpV
TLSH
T17E13F1EDBA5D00185B2BBEA78EEC52B264F46E510C94937827FA059E1F0492370389FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 07f317fcd4c25c5b11c37f35411362c8e0237e5d145c23e15e86c10fc3793e33
MD5 020347fcddf434aeadd04d0be5e5a624
SHA1 c49062e4cd8e5a6d9d232cb8c7aa1c953ce401f7
SHA512 be5863cd8b933af17f2ef94744622d0919ca2adb28b5e3437694099d2e469d3fc12cd3595d1eec94fdfc0c6d743f9b8a11df317ad57e5f2f9495325c4223b6ad
TLSH
T11821992165434136FFE08D71F9D9DCDD3B254D350A021F3DA1F0C66961AB3A10CA5594
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 abea1eb2059a2972977d3da7b5ce779980244f7291a767027bf93658d4a5d6d7
MD5 a32a89538a7c6fa10f0800ceab3707cf
SHA1 95267b687573e334bfaa516bcbd8b70064e4f1f0
SHA512 68d63acc1b77f95c2b001ae2c8cabf804b1d03aeaee003e87454040d82caeb488b0e2dcc76c475cf88a29bad8180e5dcff1fcc1aa13e1d673ca6a69b17f064f8
TLSH
T1C911C921A6030139FFE08D70F9D9D8DC3B2A4D350A122F3DA5F0CA29A1AF3A11C61584
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 80639a87c89813d5383252c40b3ea3bf2714f6b1d8d262ca7e145427406c5da6
MD5 d1f008b3bff061b55d5e030f3cca3772
SHA1 5f77e2593d84a4ff4dec9016825fccb56f46d2f1
SHA512 029e9b5b6fcd72eb47043c54825a295a5932288358f4c58637b11c3e373867ed94780fd0165f3a673c4923174cbbfe339c7e3b5e2eba8e2e36976c7c519aea3e
TLSH
T10221EB21A5030139FFE08E71F8E9D8EC7B250D360A112F3DA5F0CA6961AF3A10CA5588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 67b1b9eca1ff4fb3076e7e08bf05756f9fd84c5191ca164aed5a6876924bab72
MD5 3fcfac2475988ff88685fe1b637613ac
SHA1 2408cc4fb32d9fa1fdcabc0ff57ad558025c47d3
SHA512 c516edf8e098eb468090c16499c58d9ea384996d9ea276a46d0bc249e875fffa11f73c40a1e0410abdd6d38920f95148f8ca9c3ddbb19a8c3b4c70c618aedf91
TLSH
T18F310B35A68355B6FFE18DB1F9D0DCEE772249B01E022F3DC1E0EA25219B3A00DA9580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d0ea894d516653ab53b0fdfe004ac7184a5892e73f5076702bedcf867c4ed8df
MD5 4a2350b153309597e58abacdedb85161
SHA1 3d0c8b7865da3699fa47b4310a8ae4095aab294e
SHA512 846da9322f6e53926670e4ec4ecaf3f84f441cdd09eaa79f34f3055033c7fd318295fbe54c4e153f649fe796125e4a73415312780e2cf17edf98460f420f6637
TLSH
T18521D925A243047AFFE08D71F9D9DCEC7B254D350A121F3DA6F0C76961AB3A11CA5684
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4c084b89cd481270a0ccf4c472913dbc114cfa3d01eb79640c56aab46d3d6285
MD5 f98d86d1885f5c6c22c0cf0308b7f8ba
SHA1 0f8568cdac45f5faca53b5f58b1b8428ab2708f9
SHA512 ed258486cbecebed8e8a1b83ae3c2472509f17dd5f32d66aa9a9dce0b39d8a3e96e59e6155f2e561414e39700acae868236a298805625d098c69ef028dcf00af
TLSH
T1CD51FD2169835462FFD00CB0F897ACD9F3633B701E252B2EC8B0A6156C873D94EE8154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 055fa8a49b041c41c3751ab46098e394c4f03400994a709bee8d4564c897398f
MD5 1b686671a08519033504dfc124001e9d
SHA1 77972b1a8233aff8b984aa6ae4033a9980245ecc
SHA512 8f5a21b05b3b7db1aedc92916a03cc96927f3d83e862c991a3cb9d722aaface7483a72b7075790f4564f58a7d2cf5dbe0cc46ff2b96d54baafa429fb99ca4f14
TLSH
T17C21002161430136FFE08D71F9D8DCEC3B254D350A021F3DA2F0C76860AF3A10C65584
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 97f868c85ef77dc807788d95e11e0d072b33c087ab78d04983e5e118d03c3ed2
MD5 37e7d1333e24713e99af8a7b1705e432
SHA1 d2156a300f53142413ec2f4731da0a1cbcf7f780
SHA512 ad274f5a6ef5b923ef7dd02e03305ac833b06a3e300a14155fb16f042bebab7c39f585fce60c01b036f293834fe646e960dc34c34a267ade7184c04d182ba8df
SSDEEP 384:D/mRWxP7sOuJtVNJHoaIBV1MlbsjCMVKqgcFqdk9dacFdfI0IUIKfnM47PWhNOA0:q/pViMDPvmMNC
TLSH
T1BA429EF7C3E8C66D881156F5AF256F1ECE1E0A18432C3C57C8E5AE4B93E24B1E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 7eb3f45c84bc198f5ac1063e822db2035bc33ce16adfd75b9c8401c1f16fa4ce
MD5 8c0807e77ceff18333a8e4a8d340de3d
SHA1 d951a47ed1d7b9659bbb0745b264d6c8050afa28
SHA512 33e20a72349d9628608284dcaf7f107c96b1a85b3ac401d63c84202a9267d5b46afb0938f6cd24cf5fc242cbf509d8f87c4d31fea0f26b983bb69c3f30f0b13a
SSDEEP 384:Dk0X0tIrJJ5JELBBaUk3l2W/JoqNorNRaIBvMVuEqdkSdaqFSfI0IUImfLBNOASc:7DBikF0PviHGZQ40yCV/
TLSH
T18272BBF7C3F8C66D881152F5AB246F1ECE1D0A18422C3D67C9E5AE4F93E1471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 9b4250e3e33232d10c45a1c614900bc7187dcffff9821de03061115369a5bdce
MD5 3347f5f26352998d73a70d0a12686276
SHA1 b27dabc961bc716f8043fe27a8566c0e2ee8c317
SHA512 a2717169f3cd231cb5134093d899e878bf55e1cf740e23e55ba85cfae7876b8ef306658960a26d5508668a541231878827ff2c891db5d5746780e2eb967084bb
SSDEEP 384:Dk0X0tIrJJ5JELBiaUk3l2W/JoqNorNJ16aIBvMVuEqdkSdaqFSfI0IUImfLBNOW:7DSi/F0PviHGUQ40yCVi
TLSH
T19B82BBF7C3F8C66D881162F5AB246E1ECE1D0A19422C3D67C8E5AE4FD3E1471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 38833d66ad1ebe0eaad5c5bf144a64d327f12c826ca3c615ceb07dac6f400909
MD5 5f3dddb211b8e3622879809d29f1e502
SHA1 5d718a2a755a0acb1f60c5006c5822ec0343a59f
SHA512 3de3e8d8109d35da4b8b6086bd0372f10c62241497bac1062098eab1995672a6661d9e17f7ed195c0bfd8cd80694ec6ff30c5f76f14b33fac56667d77c150733
SSDEEP 384:D/mRWxP7sOuJtVNJHs5aIBV1MlbsjCMVKqgcFqdk9dacFdfI0IUIKfnM47PWhNOb:q/tViMDPvmMN0
TLSH
T17B429EF7C3E8C66D881156F5AF256F1ECE1E0A18432C3C57C8E5AE4B93E24B1E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 a6efb1a263ef10c15f9d41e5bcd503d1cae60271716e4f1048601621e423a7e8
MD5 b99391965c6133a35ab1ae197272e8cf
SHA1 ffca0199fe6be92d9e42785306f6471d1c814dc5
SHA512 44d53ab4dd2a879f59cfa38a06b92cf2c4d7ec61b6647a43dff0166ca22f4aea7a32d634039f2ba38915b13578bcaff06dc52b3b73f1519228da9cd3e716fc71
SSDEEP 384:Dk0X0tIrJJ5JELBibUk3DbRuJ1bNXd+J1C2aIBvMVuEqdkSdaqFSfI0IUImfLBNQ:7DIGuF0PviHZUCrexVR
TLSH
T14972CCF7C3F8C66D881152F5AB246E1ECE2D0619432C3C67C9E5AE4BD3E1471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 422e5ebf3b5b157ee1a14534def0ee786f74ba24d31d5c3dad5778c42aa09cd5
MD5 137ce05e0bb4998b383750438d367237
SHA1 b7da22594f2062c77b272c3288bdb28d86ae2864
SHA512 27445b169ac15ae15c0e31978643bdfdcd90bcd51f9eed9eeac2e760f48149aaea6de5c69e7efe02cb9d56affef2709a79f07164b6c8e96ff0aeaa5b7ac9f8f5
SSDEEP 192:DkQJv0X0tIrJJGU5JhLZaIBV1Mlhhs9cXMVKqucEqdkSdaPiFvqfI0IUImfPiMIP:Dkcv0X0tIrJJGU5JhLZaIBV1Mlbs9CMj
TLSH
T19D32DEF7C3F8C66D891152F9AB256F1ECE290618432C3C67C9D4AE5BD3E2471E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 e1c1e5285de8648ef1799b74e4ee52ba643a13dde560f0caff933da0230d7f33
MD5 13e5b149f360ea0fd689a039cf4e04a0
SHA1 58bec947a92567a3b0b1333b3ea632914423a65b
SHA512 bce395715ffa57bc1bbf83ac3069cde8f3a94acb069bdc4d90bd6d7a1e84d68965d758c8a2028c2ab3a377fd547725fa31792147aee8fcfdd66c9f51f86e7fb4
SSDEEP 384:Dk0X0tIrJJ5JELBBaUk3l2W/JoqVaIBvMVuEqdkSdaqFSfI0IUImfLBNOASUNr/7:7DBUF0PviHGZQoSsqzd
TLSH
T11D72BAF7C3F8C66D881152F5AB246F1ECE1D0A18432C3D67C9E5AE4B93E2471E250A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 3d89287bde1306197f639705f34b5fb2dadb84128c3f47e576c92b5fb8e44066
MD5 2f923214d5b0315f6b9e9b70c30d01db
SHA1 350749a9540536d1d5ceb55dc650f8ff09e09321
SHA512 e7faf654a5e98da382c14ac31b9eb6a5fb39654e9db6047271f14feeb94dd2f33071d7f45e2c46936d826eff559aa7167fb0a862e4533541f94f2451f0dbab0d
SSDEEP 192:D/+JRWxP7sOuJtVNRaIBV1MlhhsjcXMVKqgcFqdk9daPkFvFfI0IUIKfPfM47Ps/:D/mRWxP7sOuJtVNRaIBV1MlbsjCMVKqA
TLSH
T1B6329EF7C3E8C56D880162F9AF256F1ECE1E0A18432C3C57C8D5AE5B93E18B1E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5cfb34a96c2c8ba1ae4dbe10838ffd0ff668bb0f8fce5adf813f6dc312b1a527
MD5 997b2dabc20ed8d1be91d2a59e37547f
SHA1 8397d6cdf58413c5f2286116c1a579135d886fd7
SHA512 7b4828e1ba42fd95d2298213e9129bc4e945601a4e64c22e561ef0c96cd909c77180eaf0e27a48448737baced5888d34b40c499a72b7c14cfb9dd0060283816f
TLSH
T149318BA7867FB527103C597B2E447D097ABBA43102A2A4F1DE6A817CB0D5CF71F0A427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fbb3dca2d05026ccdf7375c0e54b8534f36c845f58bfd0ffacacf86bfda1de51
MD5 e18be3b386aad1f4b8eef043339dad57
SHA1 77754b561b9939cc74c588cd1272e645dfbac49b
SHA512 6a5ee63f05f970377025997131492a0231f8d70809f2ba390357e9e642b0bdee9b06f40b352a3176ebddbf89abbc6852139799e9f8f686f73addc457e392cefb
SSDEEP 192:LRGmBLyEBjvRev7hpAPRp2UlG95Hsb+WNnAbelC2YZecAKajYVyIsnAUge:LRGG1a9UXWrwwN2Oaj8e
TLSH
T13142D72EB910697B5CCFC229FA667753D7F6142531902E84EAFC8A6C05EB5CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d38e8092d877ed77834fa36907649e403c7f04f24b794be3653634e8385ee2af
MD5 d6bfab6a0a298a2ad82d7dfe56e27289
SHA1 1df4fd301c5080d02fbfba657d201bf1afabb9a3
SHA512 67048986db7a22698dfb39676cf903ccb0ca1500e09668176d6bdd5df46979b735ea807d974a2e69638a10da504da8c53be15ed75d7bf25a3dfdeeeac48208d1
SSDEEP 192:LRlmBLyEBjvRev7hpAPRp2UlG95Hsb+WNnAbelC2YZecAKajYVyIsnAUge:LRlG1a9UXWrwwN2Oaj8e
TLSH
T1C842D72EB910697B5CCFC229FA667753D7F6142531902E84EAFC8A6C05EB5CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b787cd9a84f28b54e2c2037b56d00eac3551207649b325ed0a3736ac21938e84
MD5 93da0ec95034a380e6fdf0f1c3ad88d0
SHA1 6997540beb4cb99e88becaeb1f62e45c42e8468a
SHA512 4e9ee42970cc6d8c438e27ba81134ecb3c6b7e37aabdda0ccfc1d2a94334789bed9c71e8707a89683f34d5c831d0b6e9c2920f5f81533976af81330fab286f2f
SSDEEP 192:2RecBzmjL0EBjvKvv7hpXPRp/VkYplcpPE95Hsb+WNxgaJblCq6v+kzTZH26Zecs:2RemzWwn91XHrwFsPhx2ka18E
TLSH
T10A62D71FB820697B4DDAC269F9627717D3F6102566E01EC4EAFC8A2C05E79CC2317467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4ff9da3131a6817720a5d76ed51bf02427b05a941f449acdf4acb51a7bd5bdad
MD5 6dc43c1eaf40cbc9b476061dfd7347e9
SHA1 5260df4609300d622871386d7eb02931ed34044e
SHA512 e762d2de1fec22b11af3862100fd8e6950b88915fff2aa5071b0bb79c0b8a567dfe2873169ea30a98ccd8edbdde76d3799741e8fa1e100f5789bd73df6fec891
SSDEEP 192:2RecBzmgL0EBjvLvv7hpXPRp/VkYplVpsE95Hsb+WNxgaJblCq6v+kzTZH26Zecs:2Remzvdn91XFrwFsPhx2ka18E
TLSH
T18462D71FB820697B4DDAC269F962771BD3F6102566E01EC4EAFC8A2C05E79CC2317467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0f91824c6da6bf19d0edb4529410e64a3ab55ff0a5d85e704553633884b8aa61
MD5 5225ce841e3f7c66517f4846002f7986
SHA1 9af18c46636b88d047756f93f67b9c6e100c18c6
SHA512 bd57b496abc789165daebac36cec2c5a606c3278998449420d7affe4a5b897b01eb6b8738b56adb7feab657f95cd9e3043c1b32d88a98f55c5c42b26edbb4fd7
SSDEEP 192:2RecBzmjL0EBjvKWv7hpXPRp/VLYplcp5E95Hsb+WNxgaJblC+kzTZH2dZecAKaN:2RemzWwi91X+rwFshx2Ta18E
TLSH
T10462C61FB820697B4DDAC269F9667717D3F6102566E01EC4EAFC8A2C05EB9CC2317067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 46a6a8911e3d0d2b6d4b7ac78c6228fc9e38f8345bc9aacb9148927a0fa2419c
MD5 200aa6cfc8500667b51044104e370374
SHA1 6794c395a106c28d8640637702ed04e9335683ee
SHA512 031f9782254d35c76e849cf569d33d2807242dfa4e16aad595b14f14faaa30e2866a5509612913e115d3445c338577af2659e78ec2c46569bd398b9e71477a4a
SSDEEP 192:2RecBzmjLyEBjvIev7hpAPRp2HYplc095Hsb+WNnaJblC+kz2QZecAKapYVyIsnR:2RemzWsa9UXNrwQsh2Gap8e
TLSH
T1EF52B32FB810697B4DCAC229F9627757D7F6142666901EC4EAFC8A6C05EB9CC2317027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 de62cc632e84e99992cd0ce4a50241085d0be0c9d91debdc0fc6b2bc79c76097
MD5 d53fde0748d54c4c185073683aef4dcc
SHA1 cbfc9467d89f18504e6d328d92fe90afe8f7b0b7
SHA512 d5e17ade7d8ea06f0d0f7ef6edc7192bbef499e2eeb43fa04192eda9d7090c1b7c50a3bdff2d7785d3d8a37b64820050f714e642cb48a0204bf74a5027dc7739
SSDEEP 192:2RecBzmjLyEBjvIiv7hpXPRp/HYplc9g95Hsb+WNnaJblC+kz2IZecAKa1YVyIsv:2RemzWsu91XmrwQsh2ea18E
TLSH
T1CA52C61FB810297B5DCEC269F9667B17D3F6142566901EC4EAFC8A6C05EB9CC2317027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ded70d6f8e9403e82f0c942f99d2cc06d4770a9ccead40a2d141460adc2a20d6
MD5 1218b5a4caedc44d8dc54a5a684eee38
SHA1 21e73104d84690c6239f7a228338f40c48100881
SHA512 77a6b3fb72678dcaa91bc498d69f7b35408d9e92d1609f301795f76a9dbf73002e4da67e8a0a2c24b984d589da587c47ee21eeea72e5f7656cbdee97dd82652b
SSDEEP 192:2RecBzmjLyEBjvKqv7hpXPRp/VpYplcp9E95Hsb+WNxgaJblC+kzTZH2dZecAKaN:2RemzW+m91XcrwFshx2Ta18E
TLSH
T18462C61FB810697B4DDAC259F9627717D3F6102566D02EC4EAFC8A2C05EB9CC2317067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd96639ccc2831fc7ae386f7a0841c822d2249b3ec616a4ff6d65fab2db9fc25
MD5 cc9b8f0bfda5afa672b1bf0a60852981
SHA1 a65b33dcecb3ed30ad6d4b8a6e01a85d80977a38
SHA512 2f3cc11c58cb3544d20add15c1ac11950481d59d9aa1f3644d659f45b9f6cdb78aba573f48163d695f9106a2da3335b638ebad34fb95bb28b75c0a31f1c5e815
SSDEEP 192:2RecBzmjLyEBjvIKv7hpAPRp2HYplc9g95Hsb+WNnaJblC+kz2QZecAKapYVyIsR:2RemzWsG9UXNrwQsh2Gap8e
TLSH
T19152B42FB810697B4DCEC229F9627717D7F6142666901EC4EAFC8A6C05EB9CC2317067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0ccf7f75cea43c894d2cc996db5e42d11b4940dee7b5d9c57cd4d57de0e922fd
MD5 87cdf9ad686899d9bc801aa6ee5102c2
SHA1 ecf41c52c27a1c4b8598995034a38fd62745bc83
SHA512 b258c30cc2a1f44b27ce116aee1e7fa5671d5aff59b36767bb3ca7921ba1da30c8e6ab160715b90349824a3710af1c6157531461ec4c25c3a2d29842e61e8bb5
SSDEEP 192:2RecBzmxL0EBjvLvv7hpXPRp/VkYplVpsE95Hsb+WNxgaJblCq6v+kzTZH26Zecs:2Remz0dn91XFrwFsPhx2ka18E
TLSH
T1A762D71FB820697B4DDAC269F962771BD3F6102566E01EC4EAFC8A2C05E79CC2317467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cb5c7ed180a4ccbe9940d539f8dfc5561b3be54b01f70fc838d922e07f2e7f04
MD5 3304705a43c056478eb6f7f125a5b983
SHA1 838589485dbf2dda3da6fb2f59079fdc2a261bfc
SHA512 28428f16c9f5e547570a18799a824a5c686d8031aba0690d3059581cfe470d3dd9ecfef3f89442a69da793c027a759f141556445cf04a628917731564c32ea4e
SSDEEP 192:2RecBzmgL0EBjvKvv7hpXPRp/VkYplcpPE95Hsb+WNxgaJblCq6v+kzTZH26Zecs:2Remzvwn91XHrwFsPhx2ka18E
TLSH
T11562D71FB820697B4DDAC269F9627717D3F6102566E01EC4EAFC8A2C05E75CC2317467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4a0b6bfa84d14c29778e1b1701aefdb3654077e7dee6bb8e85c75c7971a2ae34
MD5 4ef9f9d7d296f45161b752f5c62a5264
SHA1 d44d35cb780e7ec33fbe0d5d80a7e0236fca7cdd
SHA512 2c50af953e7bd8a1de131dcdea91547e75ff9460e582f81dbc3bb898b2e77a46d957be46c1a0e67131e359c0b7fb87fd50d52dfb5b9b14f3794538a6300492a4
SSDEEP 192:2RecBzmjLyEBjvKWv7hpXPRp/VdYplcpuE95Hsb+WNxgaJblC+kzTZH2dZecAKaN:2RemzW+i91X1rwFshx2Ta18E
TLSH
T13F62D61FB820697B4DDAC269F9627717D3F6102566D01EC4EAFC8A2C05EB9CC2317067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 13c926bc11a306a585bd69edc6977c6ed5f4042ac669ed841bfa0c62ffe73349
MD5 b9949251010e088c16f2df8b6a39f453
SHA1 ecf518f02d1d95b3ed93ed62d44c76d0d72802d1
SHA512 f3e1a31862144cf36993a3bb99d5abe3c2a6a0cb35d956663dd2b1ec2ad2bc860b14bad598c14ceeb914fcce1af1604f1b391fb6d0e1ebfea339dfa1ba1eba11
TLSH
T111B012C0804252D2D10706F8114754D8B114EF11AA0A374243E07D22C8261508014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8dd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a8dd.TMP
Size 96B
SHA256 8822e7a26607d4d1b0547ec8f9a19215e9bcf5b9f0e2f1b1fb03f4aee3761568
MD5 da1282c1e8c07cdce2b04a126175bed6
SHA1 d768b68e9cb04a12e940533feb23089e8fd16065
SHA512 f0c2a489781440692dc030a33279b63f9d6bad01175fac8dc2596c825f60efc3c03fbea2479dda9db6ea2861a29d5171ff0297531ba583dc0979b9f2b360a41f
TLSH
T15BB02228C00BB222E80F03B0A880B0E8B220CF30EA03030382E00FE2EC232300020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 8a5b48ad5fa38d8af8028699dc3b6f9894bce2e7909931fdb354adacc3c6468c
MD5 b8b50cc4bb698becf3d9ce07df5eb036
SHA1 4c3dadfab09bf778b82c5e3daa435fb83783a112
SHA512 3549a7e400dd1f49c309cba14054adbe146b6c3254e57757adee12abcd0a8610470a77a4357659a91196647784cff4dd50c41f8f56d97a911787d0e2e081d1ec
TLSH
T136B0223032000003C0203330F2C2CC0033220E0203832303C0C0803FECAE308C303803
MD5 SHA1 SHA512 TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72144c1f3efcdc17d2d331a91e1ff53016fef14c0420e66db766ac8474373948
MD5 796fa370319f7e1e6a694c310f8f8e7b
SHA1 6bb2e080ca966b5d5b5089abc3e2c57eb35e1fcb
SHA512 50cbc4bd9ed539afb31cac20bfeee245553f811f9985f049b66768a75187349cfbcbe2f4d7431d874155a8619ffa3fa657d5e5826b3427982e8a4fb93f3c1e47
SSDEEP 1536:4wMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:f2qfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F0C30237EBC21E335DC6DB60BA130FD793B644999034D301EABD2BBB689345165828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 77b909d66d71f61f7758316bae99b9d5fbc63320232afc099d6c4f47c9d78e58
MD5 73ed1a66cbac6b4eaf25c8d0aedd272c
SHA1 5ecdc7e64ee2d9abbfaafa91fdea0e11a7e621fc
SHA512 89accefb74e85c8efc5c786ddd865febf34138de28d611d462963b26d715ff6ace11bbc74efb8639186a13ee0c443ca6057fab950696505edebb9165826ea709
SSDEEP 1536:8wMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:L2qfd7NtZL8cHQRZEQ6Sps9
TLSH
T180C30237EBC21E335DC2DB64BA130FD793B64499D034D301EABD2BBB689345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d42f5cdb3dbdb908504b9b5b3c1fe0a4c4438894587fc981e01deb5a59b59739
MD5 256401f6a26d503f4355f097e76cde3f
SHA1 73d2835f327618cad8d9a48be6a1a157efbd8bf5
SHA512 b6c4e9ea4efd97c70c96e2b5b39b69ef19e84332485e705de06b24d49ecede26999a08424251058510ea644a9c3ac08253374030a21d94bf1d90a8e9761acc42
SSDEEP 1536:61yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:eqfd7NtZL8cHQRZEQ6Sps9
TLSH
T185C30237EBC25F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e088b30073d42d2d4e6de89928ea89bc61e50f0c7a05114b2060717345f832d4
MD5 915f4cdab8cb6eb7b8667bf2d93aea8a
SHA1 af22d6c3b7a60c18acfb5b2ea9dd7ce177cfe071
SHA512 3d36ffce5ce23af453679a64449f96a7482d060c59534a1f6c1e8af9eecfbf0fee12518f6c05fbf9ec9e6952b88e9b382d563a93674357f600135f2a015a4272
SSDEEP 1536:n9LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:91qfd7NtZL8cHQRZEQ6Sps9
TLSH
T19EC30237ABC25E335DC2DBB0B9130FD797B644A99034D301ABBD2BFB688345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9a6b65bc5330b25c717eab73aedc3cd6ef24252ea43e3dcbab76aa0955d084ee
MD5 11e299080fd371dd8b02a67ed2b4dd3f
SHA1 de3e0b72ed13ccd402a582c22c50155cd17d0202
SHA512 17d5d58a7c63b3fa4f2b90af30199fde1f55576abaed5709f134d179e34840743a4d0348097572b720fa0322a871de317590d316716b0067ae4d6cb6a433d275
SSDEEP 1536:4aLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:d1qfd7NtZL8cHQRZEQ6Sps9
TLSH
T15FC30237ABC25E335DC2DBB0B9130FD797B644A99034D301ABBD2BFB6883855658246C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4b5f141d36577b5987cec8d2c6024e359a494cebbdfcd9032c3e4cac45faae30
MD5 549d37e3ef6e90092ee03df1107e6375
SHA1 44429ac641a3e2f811332857a151dfae9a02fb7c
SHA512 ff3a5a01f6409bce21088f895f0eadda51526e138fbee0556a7c244646633d7d94c11df71f72d93990316b24aab7d69165968d86a3bc72f04437afca656356f3
SSDEEP 1536:8BMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:C2qfd7NtZL8cHQRZEQ6Sps9
TLSH
T18EC30237EBC21E335DC2DB64BA130FD793B64499D034D301EABD2BAB689345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 eb4e08f743eeac8a45edac1f892405733e9d49ebbb547ef58a34a36df66f7715
MD5 88aad396de3c6e014a128638b090a2c9
SHA1 01cb37e52fea281ebfadb057bcc994254c1f2327
SHA512 aa32e0f930f8bd92f22756d5de7d8644bb23786d119403cbccfd06e7c9597ddc3df97c627aed063956011c4e7aaffc0c9fdd24a3176b16e13e0a945f51c22837
SSDEEP 6:YKW+1E3+e9XplskVOdHzX5AO4YMI10cAe:nH1E3+e9XwkVgz530
TLSH
T1B9531205DB64A262F40847B665AD47437332B199450AB7261D1568346D1119838A0782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 603d2d2e60750f4588f513fdacd78a2ad5d6a89cd1f11ebb6e083a67a67f9cba
MD5 4db79150331d7d2b59670dd88dfc5b52
SHA1 2c3878f42b9fadcbb307a834bebef463af2f3137
SHA512 0a89ba7bd0a79aeeaec56a4ff003fe8b1bcda648740e5f964e8cdb2938ab3155985a2258bfe629bc7edea8c75a410998fc8fae608f268de31d70fcd7e643283f
SSDEEP 768:C0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba0:sZP2tFP3vqY8bqEMjTaBacg
TLSH
T1DB257437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 451a2d5eb0414acfdd8a785260b54c7959273ab0943c42004e301c751efb12fe
MD5 3b0d22f5d8b7b1f8beb26000f8078e32
SHA1 462b4b3a5257888427ff1a4ce1c7210adbabc79b
SHA512 83950a86de1c4a174685002cb2027f1ddb1b65da8cb50196de14b7630b65e35a6ab9196d747894113f3b6a3d7acf452aeceb65a9eb5a9436992a91fbb3bbfde2
TLSH
T168D0126332010534C0103973155276480480C50FC00A41C1682C965E1A140504A078D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 542dd7d298e8794eca8fc6877cd7a940c11fbf867f561ae83a904dc0230c15c7
MD5 e36bd9cfe56c4d2636542e6b0db23c9e
SHA1 4e8bcc38c9aef99ef30c218b7adfbec0cf99bc8d
SHA512 5f5297fcc51a99f567b8f31753031849db94c7df3405bab314a7609e4ca0ef18f17428525f16642ad2af9a21948f99813823c6cdd9912f5dad25a2c539b24348
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 862a4c3dd7ed56f57d2d27beae148d506ef159e88b8b6b381c1b1dfb22163c7d
MD5 4000596fd23253d9fdf062048e1acc53
SHA1 ff658e19c1e546e8c2e279824f9de9f17d1f3802
SHA512 750dfb71687900d7d87d20214c9d495f8501339275e6d8a89b0a1a72e1f2c531748bae34f8794deaccab7835313b200d358687b7670f92247c9154788cc0624f
TLSH
T13731627AE5906B739CC29682B646796B2E61107BC2109E84A1ED4B1C02E769C673AD32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 be4759a5670fa415986c7c1f2a42af3259a3ad2f43293b52e98d2c8526c08aca
MD5 d81635c4d770cd468078bae8cfaa5025
SHA1 a510c7b9ae25cb44137f9e4f6d8140bc4163dcef
SHA512 83c08c920cb2366acfaab35e2b4f4b558faf28f97f4ae3b865f9203ff64f8c108fdcd6b8de6d13fc422f7babe6a90c1427584a0c638b3965d4e0e448c33d7040
TLSH
T12A51D837B854AB7388E38680B94A3F276A365176C7613F9099EC0B0C02DB69C2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 fb99305e1c41f5662a0781fc2e4fa35b78360d2563b591cbbea1d4b1e0ae3f5e
MD5 46501aece09783d7d3c57173bb823398
SHA1 017c22244eeaebfd55731e019ce6cb9c71603151
SHA512 4df6a63057d557d1c66b186668ec8df7146e1d38f54ee8abba315fdf298fab5029a431d540fef701a92a6fad380189dd26eb2bb0eb559674d35dc08a2825dd8f
TLSH
T1AC71A82BA564E6374DF2D941B9863B1A77A55137D6903F95C9EC0F0C02D77D81312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 8c36653dcfa327513121f9ffcc8d3d5ae5242fe0a502d0da8d6e05de311bbc85
MD5 e83d77804e7af91ff4aac25a370e562c
SHA1 54d5155081c3ba5522cafdd7021be01a5404e98d
SHA512 c01afdf18795b6cc7092ef284f286289673c6200a4488f18dbe0db04a25342b18dec430b054859984c19ffec455c8a71c940e0e4999f1009b90cec4540c5328b
TLSH
T19881B52AA564AA378CF2D985B98A3B1776A55137D6903FD9C9EC0F0C02DB3D81312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe611174.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe611174.TMP
Size 1KB
SHA256 0bb65c76f996e069bbd7e3cce61dd43563d5cf94fd164ba7b9dfca1af3783282
MD5 dd692339d36509adabc93df3cf96c50f
SHA1 4f42532a1b6e0a99a94381d8fd3bcee797b36231
SHA512 cc0747bc4a79596a73e34e6b1e92948cd82cdee1ff47b1d383f42d4aa7aa7a80df7a2b04e43acea75e794c6942d1027a716ecfc97f90ac307a42c6dc82653b2c
TLSH
T17B21427BD5D4AB729CC14581B647B94A2E61557B8310AE09E0DD471802DBA985337C32
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 e9c41f3027a3b7a03405d7dbaf74b4c9884da1235bb681508ce360e5ee451605
MD5 6ccbc7d16503073afb7e8b2fefade79c
SHA1 7d9fdea22985ead20bd3e1284d4d2e97b7566493
SHA512 5daf58e15264b0579669f0cb3f7e02e88ed7367211b3bd582de6c05b28e300191b3540133854fef821c07ac7e72690eb2da183d1148c4a8612628a41954d8bb1
TLSH
T16621495B1B89E47089E01BE72DEC8E2573B787CE8794E0A5B34DA039480252D5B3D55D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 14daad6603aed15203c7f88e713c95b637956f4e27415dda193aa11a77655215
MD5 5640b2205b80336aa05449d734479cd9
SHA1 872ded1e40441361e4c03be4bb06ac7c2ab0a2b1
SHA512 c743aca6d0611b9b73fe41471888fe07cb146d09da4f7b99a381c366f4d81d7e763860048696c80be34e8eacb3b9080d728c1a5192178fe62b32ffbc8e511cf5
TLSH
T12031C50067E52656F0A24937FC7B5B01EB71FC019B19554E018C51591C95604B57BBBB
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 501f38c83f3644f819a292e3d8392c809576e395256054284f01e3089528a48f
MD5 bbfc886b2499dead8687cff7f0e0d899
SHA1 76f64e2f52dd01c5d7111c22267bbd78edbc4236
SHA512 fb3fa0db50c1c6c859d53ecb492c65e1665e382cc0a9c1f96cc5f1dab3f8650e86483a9e9e555182f3cb66570bf735b73d97d90f56117211687550026049cda8
TLSH
T1D8712300A7F53656F0A2593BFC7BAB01EB32FC029B159A4E0188505A1CA5600B57FB7B
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 2dea9605f698a1a6cd15d849af85a3b8c3b173063ca0ee718b4e41f304ebec48
MD5 c2a037f993e896bd45286e0183bc227c
SHA1 8d1ba10a36a599670114d707b3ded4eb58c1149a
SHA512 dd477d15318db06d4dd86500513f06772fa531f4c3b535be88e3f6e60fbe0a13493f9060092c9bb60379ea21cb23a3aab6330a716de80c04b10dd323f9bf365f
MD5 SHA1 SHA512

Submit Download

Unconfirmed 138935.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 138935.crdownload
Size 3.8MB
SHA256 c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
MD5 46c17c999744470b689331f41eab7df1
SHA1 b8a63127df6a87d333061c622220d6d70ed80f7c
SHA512 4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
SSDEEP 98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
TLSH
T18206231AF7A904F5D077E178C9A34607E6727C9D4771928F23E60A492F277909E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

garantilog (1).rar

Path C:\Users\Admin\Downloads\garantilog (1).rar
Size 5KB
SHA256 e44c4c6afbafec77d2f544ce85ed0d0f47199a4162cfab3d4b41c0e78ff69083
MD5 69d0d104b23b17edcc967494d6e7badb
SHA1 b22d4b13f392956434b3955f8b598d2b8e484ff7
SHA512 71a5d1234bd514f076b9cef6c20d0f793bbb6edfa2c503e50fcad9b18cd9ffd01d38ac162a116f957b94c65523c472c11b26eb5ee796ca27f19a67447bfc65c7
SSDEEP 96:ZSIZnfH8cnlxKmx6F+QWsef3pmhtXbw1nWUiIynouXt94uBTaytkD/x5Dip:VnfTrhHT/f38tlVrndj4uxaoKDip
TLSH
T1FAC1AFD7ADEE81DC4436C2250BFE2C1D9931D18279C7C752702CDA75D81EC59383BAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

garantilog.rar

Path C:\Users\Admin\Downloads\garantilog.rar
Size 38KB
SHA256 4bf2cc02179a49a7335d4f3b5e50552845ab6729a764b9e0af906ec99c256edb
MD5 19544bc8cbfa6c7405b75976827bae16
SHA1 56564ef1c826c8925e54382a58325c10bef3f401
SHA512 b5d9b6788310980a6b15b261b242ef8782431ef6809dcd9294e5cf4d2b2f2b39fd81504a8f32111c398780294373203132ac61cdc8b2e3684c34bcc0e40213ae
SSDEEP 768:S3+u3DZVtXYcw6EGJGDFsqpUR0gA6FSGLE/aQ:Y+u3DZVtvogA6FSGLrQ
TLSH
T14E032B8968F31026A95359DC37620B5D76458643CA12EC67BBDD02B0DFCEFA269B334C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-1247-0x0000021DE9400000-0x0000021DE9755000-memory.dmp

Download

memory/808-993-0x00007FFACCBB0000-0x00007FFACCBB1000-memory.dmp

Download

memory/4152-1114-0x00007FFACCBB0000-0x00007FFACCBB1000-memory.dmp

Download

memory/4152-1115-0x000002A8F76E0000-0x000002A8F7A35000-memory.dmp

Download

memory/4208-1015-0x00007FFACD1D0000-0x00007FFACD1D1000-memory.dmp

Download

memory/4208-1016-0x00007FFACDEA0000-0x00007FFACDEA1000-memory.dmp

Download