hxxps://dosya[.]co/nnuvd41w22k4/Arex_Premium[.]rar[.]html

Analysis

user interaction
yes
max time kernel
103s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/nnuvd41w22k4/Arex_Premium.rar.html
Sample260804-25acbasfmh

Score

8^/10

defense_evasion discovery execution spyware trojan vmprotect

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
138	1192	rundll32.exe
139	1240	rundll32.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	patcher.exe

Executes dropped EXE 8 IoCs

pid	Process
1804	loader.exe
1500	patcher.exe
3172	patcher.exe
5368	patcher.exe
1896	surras8.exe
5672	patcher.exe
4660	loader.exe
2968	patcher.exe

Loads dropped DLL 10 IoCs

pid	Process
1500	patcher.exe
1500	patcher.exe
3172	patcher.exe
3172	patcher.exe
5368	patcher.exe
5368	patcher.exe
5672	patcher.exe
5672	patcher.exe
2968	patcher.exe
2968	patcher.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x001b00000002b4c5-325.dat	vmprotect
behavioral1/memory/1804-336-0x00007FF6C89F0000-0x00007FF6C9B1A000-memory.dmp	vmprotect
behavioral1/memory/1896-664-0x00007FF70C730000-0x00007FF70D730000-memory.dmp	vmprotect
behavioral1/memory/4660-938-0x00007FF6C89F0000-0x00007FF6C9B1A000-memory.dmp	vmprotect

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4420_1683552346\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_264045720\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe
3796	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\213EDA44CA795D598F5BDC3254E63062EDAE1319\Blob = 0400000001000000100000000adad4352dbe2f66db8d127e206ad0320f00000001000000200000000e8db23ec17fcef119fbaf3163eb6de5416228c443e6a0c90c0f3b61c6b957661400000001000000140000002011a29b96263e720b3024900b42e1697cdb55d8190000000100000010000000d988da4e32d4f7f811f3d787b5436eb7030000000100000014000000213eda44ca795d598f5bdc3254e63062edae13195c0000000100000004000000000800002000000001000000530300003082034f30820237a003020102021433d4d09576bb811918b15f5f3c9014c6fc2f6520300d06092a864886f70d01010b050030373135303306035504030c2c686f6c792d6461726b6e6573732d633639612e6d656d6f7279726567696f6e6e2e776f726b6572732e646576301e170d3236303732343137343031325a170d3237303732343137343031325a30373135303306035504030c2c686f6c792d6461726b6e6573732d633639612e6d656d6f7279726567696f6e6e2e776f726b6572732e64657630820122300d06092a864886f70d01010105000382010f003082010a0282010100c500f9079586d950503d8cf825be23a0a2429e7feb8698e20e6652adb5378a90431034734a308b001f96b8680fb15a996de28ce526bcc54a686905d49300f489716476717dd316c6c19afd56762dcf03d77621cfb1affd06ea3ac64b0beb7381ba7604c35ce264f1c0d399fd868e65e56f93ad0989d02eba628e0442d2ca59ee856c8ce6cd3fdd14de0b501b349c913b8c4a2d525f28cdc7875e118f65acf58347dc57be84ff795226bb72e0107f251fab0dfc20cb58e9638977c7baaf087677363d2d3f951141d70c3c9d15cccd098c6edb8726784fe6681000b02f03154a92606b481b1fd0507cf598ca1af99f014434f94a60c040e44381fab794107d87d70203010001a3533051301d0603551d0e041604142011a29b96263e720b3024900b42e1697cdb55d8301f0603551d230418301680142011a29b96263e720b3024900b42e1697cdb55d8300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100b6f7cc7625c3e1f5bc80fc59955f12a915027c397a9609c234c30f3bfee4501e3f1016321aad18496b40429e91be809111f1ff3226162ad3c4828aa7bf4afb0420aa3bce114d369ef7d23792263d018db57cc1a81752441f59e91a2034122c1fb101e51189efdbaa9420f19552a00efb64c5c0394edeb194d08d27e3d4dec6e3c5f8c315466235bf463419f85702d045fb3761aaf09412cdfb26cb90741a769a72a1b1a1a52b954957bbc63bc94f4dfa65263b0a3ca64a817800a586ca4e4b52f78643b3aaad0d58865b801f7abd035068f63f0b927007228c95121686ec4ec846522e6134afb1b851f218924c6d3109874dec45f32bc6c079cc984d09c2497a	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3796	cmd.exe
4344	cmd.exe
4764	PING.EXE
800	PING.EXE

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6068	msedge.exe
6032	msedge.exe
4144	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303585974364714"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{13A5B112-5F58-417C-ABFF-7B124083BB7B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 45 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\AAD Token Issuer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\OemEsim	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedAppRoot	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\213EDA44CA795D598F5BDC3254E63062EDAE1319	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TestSignRoot	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Arex Premium.rar:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4764	PING.EXE
800	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
1804	loader.exe
1804	loader.exe
1804	loader.exe
1804	loader.exe
4660	loader.exe
4660	loader.exe
4660	loader.exe
4660	loader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1240	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeRestorePrivilege	1288	7zFM.exe
Token: 35	1288	7zFM.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeSecurityPrivilege	1288	7zFM.exe
Token: SeDebugPrivilege	1896	surras8.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
1288	7zFM.exe
2264	chrome.exe
1288	7zFM.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 5780	2264	chrome.exe	80
PID 2264 wrote to memory of 4972	2264	chrome.exe	81
PID 2264 wrote to memory of 4972	2264	chrome.exe	81
PID 2264 wrote to memory of 4144	2264	chrome.exe	82
PID 2264 wrote to memory of 812	2264	chrome.exe	84
PID 2264 wrote to memory of 812	2264	chrome.exe	84
PID 2264 wrote to memory of 4308	2264	chrome.exe	85
PID 2264 wrote to memory of 4308	2264	chrome.exe	85
PID 2264 wrote to memory of 4360	2264	chrome.exe	86
PID 2264 wrote to memory of 4360	2264	chrome.exe	86
PID 2264 wrote to memory of 1320	2264	chrome.exe	87
PID 2264 wrote to memory of 1320	2264	chrome.exe	87
PID 2264 wrote to memory of 5584	2264	chrome.exe	89
PID 2264 wrote to memory of 5584	2264	chrome.exe	89
PID 2264 wrote to memory of 488	2264	chrome.exe	90
PID 2264 wrote to memory of 488	2264	chrome.exe	90
PID 2264 wrote to memory of 2588	2264	chrome.exe	91
PID 2264 wrote to memory of 2588	2264	chrome.exe	91
PID 2264 wrote to memory of 1612	2264	chrome.exe	92
PID 2264 wrote to memory of 1612	2264	chrome.exe	92
PID 2264 wrote to memory of 1284	2264	chrome.exe	93
PID 2264 wrote to memory of 3424	2264	chrome.exe	96
PID 2264 wrote to memory of 5408	2264	chrome.exe	98
PID 2264 wrote to memory of 2620	2264	chrome.exe	99
PID 2264 wrote to memory of 5912	2264	chrome.exe	100
PID 3952 wrote to memory of 2184	3952	msedge.exe	116
PID 3952 wrote to memory of 4636	3952	msedge.exe	117
PID 3952 wrote to memory of 6068	3952	msedge.exe	118
PID 3952 wrote to memory of 4636	3952	msedge.exe	117
PID 3952 wrote to memory of 4636	3952	msedge.exe	117
PID 3952 wrote to memory of 3188	3952	msedge.exe	119
PID 3952 wrote to memory of 3188	3952	msedge.exe	119
PID 3952 wrote to memory of 3056	3952	msedge.exe	121
PID 3952 wrote to memory of 3056	3952	msedge.exe	121
PID 3952 wrote to memory of 3056	3952	msedge.exe	121
PID 3952 wrote to memory of 4368	3952	msedge.exe	122
PID 3952 wrote to memory of 4368	3952	msedge.exe	122
PID 3952 wrote to memory of 4368	3952	msedge.exe	122
PID 3952 wrote to memory of 1696	3952	msedge.exe	123
PID 3952 wrote to memory of 1696	3952	msedge.exe	123
PID 3952 wrote to memory of 1696	3952	msedge.exe	123
PID 3952 wrote to memory of 4420	3952	msedge.exe	124
PID 4420 wrote to memory of 2448	4420	msedge.exe	125
PID 4420 wrote to memory of 6032	4420	msedge.exe	126
PID 4420 wrote to memory of 3768	4420	msedge.exe	127
PID 4420 wrote to memory of 3768	4420	msedge.exe	127
PID 4420 wrote to memory of 3768	4420	msedge.exe	127
PID 4420 wrote to memory of 1612	4420	msedge.exe	128
PID 4420 wrote to memory of 1612	4420	msedge.exe	128
PID 4420 wrote to memory of 5292	4420	msedge.exe	131
PID 4528 wrote to memory of 5368	4528	cmd.exe	137
PID 1192 wrote to memory of 1240	1192	rundll32.exe	141
PID 4420 wrote to memory of 3064	4420	msedge.exe	143
PID 4420 wrote to memory of 1400	4420	msedge.exe	144
PID 4420 wrote to memory of 4988	4420	msedge.exe	145
PID 4420 wrote to memory of 5676	4420	msedge.exe	146
PID 4420 wrote to memory of 5676	4420	msedge.exe	146
PID 4420 wrote to memory of 4676	4420	msedge.exe	147
PID 4420 wrote to memory of 4676	4420	msedge.exe	147
PID 1896 wrote to memory of 4344	1896	surras8.exe	148
PID 1896 wrote to memory of 3796	1896	surras8.exe	149
PID 3796 wrote to memory of 800	3796	cmd.exe	152
PID 4344 wrote to memory of 4764	4344	cmd.exe	153

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/nnuvd41w22k4/Arex_Premium.rar.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe71c728,0x7ffcfe71c734,0x7ffcfe71c740
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,16732270121501055311,2731231729512503040,262144 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1264,i,15693608271599485252,7740368765194719852,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,2006049428524622415,7901654311449823206,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14917273101974731475,5627445985872630736,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,3592619075284589942,3286822789553517938,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,6975864369964631775,211175053728679787,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4844,i,15215587719577244271,1789111179670680688,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,18104756777684454773,18056249425918106420,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5048,i,6131037053287079249,18007979054294530162,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4848,i,13035619014431047499,14398160563819868619,2097152 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,12885131214118267340,10454753361874893561,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6652,i,6000414446946419252,889174919013752446,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,11558828714863323051,14885190561224561282,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6768,i,534260850654874667,1853975280781706787,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,4932124286476495123,11862312678356971125,524288 --field-trial-handle=1988,i,6158654568305338366,3930290105965245134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:5912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3568

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Arex Premium.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1288

C:\Users\Admin\Desktop\Arex Premium\loader.exe
"C:\Users\Admin\Desktop\Arex Premium\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Users\Admin\Desktop\Arex Premium\patcher.exe
"C:\Users\Admin\Desktop\Arex Premium\patcher.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:1500

C:\Users\Admin\Desktop\Arex Premium\patcher.exe
"C:\Users\Admin\Desktop\Arex Premium\patcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=c+md&FORM=IE8SRC
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffcede1c188,0x7ffcede1c194,0x7ffcede1c1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9642159095179368720,15421105255141969231,262144 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,2840533048367895903,5975442282772976807,524288 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,7363448198098707961,2778516038295171418,524288 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12235664072011769238,345539244445513769,2097152 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,16025661212430397553,8434481131974896000,2097152 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3464,i,7069277439992602128,15091491779175707340,2097152 --field-trial-handle=2248,i,5431800232942721161,83019901395788609,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffcede1c188,0x7ffcede1c194,0x7ffcede1c1a0
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,13145420532288718702,17347223393432009424,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,14615533505559088241,8000992491230475472,262144 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,1984327603238483163,7699537523343509261,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,522090594742375872,8569212457842813452,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,522090594742375872,8569212457842813452,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,7001239050538569007,15093901431975312403,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,5546333613437516685,7006572812718368566,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10727606478222106628,14676483080506877914,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,13627750990142424147,427410282776735158,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4946410830876481104,9968882408585360183,524288 --field-trial-handle=2180,i,5034730318397414928,3692861243098298633,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
    3⤵
    PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\Desktop\Arex Premium\patcher.exe
  "C:\Users\Admin\Desktop\Arex Premium\patcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5368

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Desktop\Arex Premium\server.crt
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDTzCCAjegAwIBAgIUM9TQlXa7gRkYsV9fPJAUxvwvZSAwDQYJKoZIhvcNAQELBQAwNzE1MDMGA1UEAwwsaG9seS1kYXJrbmVzcy1jNjlhLm1lbW9yeXJlZ2lvbm4ud29ya2Vycy5kZXYwHhcNMjYwNzI0MTc0MDEyWhcNMjcwNzI0MTc0MDEyWjA3MTUwMwYDVQQDDCxob2x5LWRhcmtuZXNzLWM2OWEubWVtb3J5cmVnaW9ubi53b3JrZXJzLmRldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMUA+QeVhtlQUD2M+CW+I6CiQp5/64aY4g5mUq21N4qQQxA0c0owiwAflrhoD7FamW3ijOUmvMVKaGkF1JMA9IlxZHZxfdMWxsGa/VZ2Lc8D13Yhz7Gv/QbqOsZLC+tzgbp2BMNc4mTxwNOZ/YaOZeVvk60JidAuumKOBELSylnuhWyM5s0/3RTeC1AbNJyRO4xKLVJfKM3Hh14Rj2Ws9YNH3Fe+hP95Uia7cuAQfyUfqw38IMtY6WOJd8e6rwh2dzY9LT+VEUHXDDydFczNCYxu24cmeE/maBAAsC8DFUqSYGtIGx/QUHz1mMoa+Z8BRDT5SmDAQORDgfq3lBB9h9cCAwEAAaNTMFEwHQYDVR0OBBYEFCARopuWJj5yCzAkkAtC4Wl821XYMB8GA1UdIwQYMBaAFCARopuWJj5yCzAkkAtC4Wl821XYMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALb3zHYlw+H1vID8WZVfEqkVAnw5epYJwjTDDzv+5FAePxAWMhqtGElrQEKekb6AkRHx/zImFirTxIKKp79K+wQgqjvOEU02nvfSN5ImPQGNtXzBqBdSRB9Z6RogNBIsH7EB5RGJ79uqlCDxlVKgDvtkxcA5Tt6xlNCNJ+PU3sbjxfjDFUZiNb9GNBn4VwLQRfs3YarwlBLN+ybLkHQadppyobGhpSuVSVe7xjvJT036ZSY7CjymSoF4AKWGyk5LUveGQ7OqrQ1YhluAH3q9A1Bo9j8LknAHIoyVEhaG7E7IRlIuYTSvsbhR8hiSTG0xCYdN7EXzK8bAecyYTQnCSXo= 131726
  2⤵
  - Badlisted process makes network request
  - Modifies trusted root certificate store through registry
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1240

C:\Users\Admin\Desktop\Arex Premium\dat\surras8.exe
"C:\Users\Admin\Desktop\Arex Premium\dat\surras8.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 -n 2 > nul & del /f /q "C:\Users\Admin\Desktop\Arex Premium\dat\surras8.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4764
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "C:\Users\Admin\Desktop\Arex Premium\dat\r69-driver.sys" & del /f /q "C:\Users\Admin\Desktop\Arex Premium\dat\ArexDriver.dll"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:800

C:\Users\Admin\Desktop\Arex Premium\patcher.exe
"C:\Users\Admin\Desktop\Arex Premium\patcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5672

C:\Users\Admin\Desktop\Arex Premium\loader.exe
"C:\Users\Admin\Desktop\Arex Premium\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Users\Admin\Desktop\Arex Premium\patcher.exe
"C:\Users\Admin\Desktop\Arex Premium\patcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 352ab8bf4a0d66b1bd3cf897c00dd88907850912397a48ec2a8b29e56bcea3ec
MD5 95de61b790413f1862403c0bbe488791
SHA1 c713a9b22a2e83c973c3e8ce048aa6150135f89b
SHA512 7c274c2930c5c2a6920a64a8aa5949b98318f0082a3f484851d2f621abf7e93223d4c0ea6318121ba335cddea2897ac17473571e85dcd422400b9b65fa66cd54
TLSH
T1B2E022AAC961EC271CFD1B2C61910345EB6613272B80AE5B3B3C912D8FB1A3E418581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 17KB
SHA256 43089bf2b90a1a7f169b436564e9072f1e1c18d1ff3c50eddc7cd3abb284db60
MD5 536ebe74055d890b6c3ae7d8daa8b812
SHA1 7ec10f64d8d6dd2bd22c256d9885c23e44864ec2
SHA512 b7e5ef5b125b15b958a54b7febebe64a92a4ab7a00a723f17f9993fe9979b6ea3e2f436d348d4685cf2aa07d23c568e6ccb33cbdf6d544fc66dd29bf237992a1
SSDEEP 384:/ZOicMJyUjgOs8uOHzJm1IicS/aBSaGLSC4h1UFwtM2w+qgvxUi2Yagq1WS4J:/ZOPpr7uJm1IiFCJCAWFwtMcJ/2YagQ4
TLSH
T1B982D0672A343879887E171F979CECAB259DF304112B30F06E94BEA56471011FA9AB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e9ff828d79d18da_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2e9ff828d79d18da_0
Size 322B
SHA256 d1edbe349744b678dd5f490748b7908bd6d49046c3ffb623bd4aa05741ec5d97
MD5 dba5b970e6d4ac07a594ad2122f0f778
SHA1 aae7b8957932ba0451597143d7b3fa8cb6c790dc
SHA512 9c6803e44145738c992161008e38bf678dc61db6dfc4323ef5904588e1293d85f250843dc5a651f327ebb895bd5665c58ad582b4157f409db5820ecc6d491230
TLSH
T1B6E07D87CF64FC15D92C8BBAB279614BD46108B20624C1DA9514C033C1042376994711
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 274d8b000ab4573561ec38d4d7753238f3d4a8eac3d3a520d93e157cff9cda60
MD5 2639b1ab07b54582c4facb6f2a7596f6
SHA1 80325edab0b4fa390a7d5186a352ff07587138f7
SHA512 0123e775735d9969ef021adc73e31d8130b457cb02fd6100c4a0101f1962d7974a4be793a54a99b642a7d8504fc9fbe827ec67b7814f8b83f9d7e0a090fd56ed
TLSH
T141117D2CA7D430F4EF90F47169C51D412318D73D18A51BA335755068AE0F6D127C34B6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6c17a828bd4a43492aa7e0b0598bcd34fc2ba8fd3507659ef92cd7938d61049b
MD5 cf220b0eb1cf8b081ef1bc49267e3e4a
SHA1 929881f1b96a7eed80e8da678bf4c79443f92d46
SHA512 148f9a3069b902669b7aa892963e09cb0cc39046fce5c9f8117fbd754f61cd3dcda6f7711d37839ec5547cdb339654f2a5a2df4a40a1978048c7ddb63bf2ee45
SSDEEP 192:DU0BqLeMJL64JDJl1uYaIaEdAQyVM7XPM3MVyi4sRtTgf+HG3WFcPbKJbyJZO:DU0BqLeoL6kVl1uYaIaEdAQyVM7XPM3c
TLSH
T1061298F3D3F8822E881152F5AA246E1FDD2D0A16832C3C5785E4AE5FD3E5471E261E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 0ec93888208ea72cd7dc3f11a23ea9c3a5ef845c230400424fe7facb79ed8ec4
MD5 bd0886a61c6b47d40bebe12e4f0e7647
SHA1 b14e6b4f87075ed2b45555bf7d6ab8382b537284
SHA512 c87d4c64caa486770bf0a09b740991f4a52696948960fbc166096abeb6d88ce5756c1ab838775d95fdcbc1301dca6e309e4db520d7663706edd577527fd9f229
TLSH
T133218BE79BBEB467107C09AF1D44781A2D7AA831164268FADB5BC02DB0859E31B26437
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0454880ad33319b67823146aa26a8b4d700cee6ecc2f60d693055cf7db8972ab
MD5 cd178c849f6c351451b420a7a4c679fa
SHA1 e7559def338e889ae14b376fa04558ab47c0287d
SHA512 b59eba864182111d501a5c9e5d36f94a8c311b017c8783ebfb736c1a3b5c1d91182057e6a0693415571f453d609d684d267cc1775fda4d7d67baa9ef051905bc
SSDEEP 192:sRZdvYOdxOGbXwv7HpAPRp24lU9DHsb+WNn2ee1d2W5PkwHIwVyIsnAUge:sRZ9bhsjUXg5wRs2WPbe
TLSH
T10042D72AAD10693B9CCBC729FA567B57E7FA103125D42E84E6FC8E2C14E75DC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dd8ca357a2ff5584895729738ba80db84e9a3b1ec4d0df528fc161b9071709b0
MD5 82eaad46128058db5dde9016d8a286d4
SHA1 a1d15c378c8fb9e5c52900ccecf043de152f93b3
SHA512 75be01db7f1093ba813a12895c070814ecba2dcfb64a4b1fce0b0dfaa24dc11e888168b1d6f0fd4fd71332110f0ff145187faba7d2888122324bd9901349f365
SSDEEP 192:sRZdvYOdxOGbXPv7HpAPRp24lU9DHsb+WNn2ee1d2W5PkwHIwVyIsnAUge:sRZ9bhHjUXg5wRs2WPbe
TLSH
T19F42D82AAD10693B9CCBC729FA567B57E7FA103125D42E84E6FC8E2C14E75DC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7b5f0d35e1a2cf93639112044269a091fed29e5543a518fc611e35e136192454
MD5 9f402cc8b5a62881b2d56062fd541949
SHA1 eb294a334fbed8d45a0634f5ee64cdf6850a2032
SHA512 506d69733417cb3b405d0f0258e7f13dcfb8f5ea1f52575f92e0cf3c0b4a3533a88c0321537c83f35d05902cca5027fae67b19f908e59f0c08c1a2ea6fc9d8d4
TLSH
T1F4B012C0858365A5C00202F4214218D8B114DF10960B1B0543E0A92298391528414650
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585270.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585270.TMP
Size 96B
SHA256 e852565dcfcb94b01d524a64e2ab4419e35e309f1a844a8b4a906fd1afde818e
MD5 22964559bceb64a51305ba2c52fd6e16
SHA1 2fc08845c29ef846ddcc9f3ebe148e4fb55ae462
SHA512 d0e1a72efcb45d787d755b7e3637466f9c880af6e2668c8aab07b0571760c98302159f46ff2e647c41bf0c99e000404d8da7386ef5c614de9d912223958ebe4d
TLSH
T142B022C0C002B222C00203B02CA080C83320CF20CB23020383E00A33FC233200828030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b9652aec14193700e9c4e5270137f8aba108a43dd9a52ee1c99dfdb1bdd5d33b
MD5 308f9ac319ea2685b9f9c0ae7dc1895b
SHA1 add8ff78e7a439278475d1be73796a6b513d8230
SHA512 bfb80feb3ff2569d3523ae42fb15fc343cd295c7a4a196349eb49f05085bdb5b4997ef03c89ee1096c60057fcdda2d5c5a5c818d37941a3d3de6ed6873959726
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:am7Rkm1tYpBeh2BAo+
TLSH
T179C3122B5D75A87658B9BB0EB04E0B1F1EF149A6C920DE92C8D46F0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 44ecbeb70117f39bc5af81126d5b2835e97ff6e508cfdefdcf570de62f4625c1
MD5 55af0401885ce5eda01168e0366dc4b1
SHA1 36357709681308418770e7891f55318c7988d0ee
SHA512 826e270c609d93574a7489908942073417dd2019e5effcfb5a0b8ef78afa7c61375ee25d156c37c84f73f6f9285c3262a36ef551578ebd1c821e5d782afd35ee
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:im7Rkm1tYpBeh2BAo+
TLSH
T196C3122B5D71A93758B9A70EB08D0B1F1EF14DA6D930DE82C8D86B0477FA6CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 07cbe911303d5eb12a38c321c15a71a2b52a5ec6151cd731c5842daf25b2dee1
MD5 8ef2b5dc2725b59b1f7dbb2e3419ded2
SHA1 7b6134719b6974ddd91944a33fbff27c11047ca3
SHA512 a8921215559a8f2070def67227bea319b0895512287ebe80287a161ceaecb94df124b4e0d5b5b8ad6476fb0d374d67856eff814f73ba53ea9d8d9a44ffbb9641
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Am7Rkm1tYpBeh2BAo+
TLSH
T1BDC3122B5D75A87658B9BB0EB04E0B1F1EF149B6D920DE92C8D46F0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 0169ef69f46f523cc4a733bd25a5b8b09fdf3e67f6c2ff15783825d3a750d208
MD5 9b22d6c64fc7556e4a4b5f9ebfe3df47
SHA1 7ab27cc8659db1bdb86697e27b8711a9e23648c1
SHA512 33134265d918a13391414aa70a052d597f2d6cb86a9c70ad2748c97d81b5ab7a0ddf44bda72b6fdcd774e727dcb12bf99f79d8191d126797732c9596cdfd0f83
SSDEEP 3:MsEllllkEthXllkl2zEklHd:/M/xT02zn
TLSH
T10C4404047FD01445C54010304013C3D103F1D4111D115F4334710413FCCD5400C40410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5b20b9db029826adc99221f0799ea299ee6de84c19924848aa4706f5b3b0554a
MD5 41906bb6dd314f4b3aafe8928a4bd3d1
SHA1 5bd2d5163f1354f2399a92bd6a66789fcf630fb0
SHA512 64b1af380744255c523b70f03b9f885d6a1e65d8257d7cb29cb803e14c35abf0adade0939247c582e5ae0e27e7d43e6c8399273d96e11685596b73d285bd06ae
TLSH
T154E02BBAC824AC3718FA0B1EA4550A49EA50235726808C6F3A3D551C8FF572E02C581C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 dbdd17554066399adbc42d4535e7defe4ed5e66b37d5b3368824e8ca9e408308
MD5 12035a8dbe89c7c65ecc93c09b0bae3d
SHA1 0f6517e174b01be28d89e6aa2da5fe885691d0cd
SHA512 f655c9d292e9ed7481dbe987c291f5434f28c6a18ac7dfdaca79c255bcc676c573701e1ac1058dc9968c199b76e2d4d8c21486f3e2a114d41104c5a67d6ad227
SSDEEP 192:BBGYUcTU+S+Y2O3gLMDPMkN5IAHXEnC+AlvZNApkkQdm5DQ9LLAcMjKiAFCMbcm:vv1SF2O3gYF5HHXZCp8myxLXMjKiCb
TLSH
T12413C37E36412D8BC2E7647D149F0A352B3AE429F5E4AB6373727499331CF4AB80E524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 6a5867602bcf52aa79204fbde93ac32ea2ba955d629786d6cd0204b2fa428b22
MD5 606c98cacdaaa434d27e64a06ebd5096
SHA1 9c1193f64445bbf32aae04e3f9f100d41e7a2a3d
SHA512 2dc75b293c0dad44c8cb40e2a2978699ea5ee3352284479825c997fa239efa505a24c1e66a81d41806f9491684d59ab0ea0333e15dbb15264364fb366fa42c7c
TLSH
T178E0205C64CCC11A565864D3577C974996D1340EA78CFF07270C8888B2027857379DD4
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 d2b1a2eb840ea782c3e961153a0abc8b999dd90f78f2085805dae8dd3c4b20b7
MD5 713901e0532662d93b3305cbab1deb44
SHA1 396a6cf97616a7c75cbace481f66e38e8fa62607
SHA512 c21ff9e7f97ceaa86b3bfd5892c3930b04e622c2641def0d4324145075323daada5d2af09008457480c9572b73e36d64868001a2d6271fa427b489046b6add64
SSDEEP 96:wILxIHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jq/EbjBHMsDETbL:l60+G83uxXBBK31GkSJn/EJH7DNspUm
TLSH
T12014235F5F343712CD7D917668E648A35D6DF03F8B1266DA6C6114B0CEE3642A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d9230473b8ea13bd96f280db004b219210a224fa2b8cc898e640ff299bd69eef
MD5 fa1fff639841bb40330b5ebc913081e1
SHA1 b31af27dc0f3edf0f7f92145774218af5327c785
SHA512 10a0600e57d75a944c9e91f2748499a6ea486a3cb602c66c87c14469a0ab2563f9b0c1b9ec9051a11411a676ece255497fa4851d0d85249e0cafaf11b24476da
TLSH
T184E0D8B154EEC16A5518A0CB5329FB4EE7E2750EDA8C6F011B08998CF102404AB92DD1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8831d69279f1181a91da8333115e7c8e460891c6ff6bfac323c21fcd287cf0cf
MD5 f489e2f1b5a8b8161c6d612f0d3cc60b
SHA1 0cee85d25e908009b86272dd6f03bb1820998ade
SHA512 89e01de308078a86d33a65e0ed685b95962016470cf424bb5f4586e7c01424aea649b46b7b69ef4119a36250d35a42eab9666b902c7f183efd4cd7d12d0c35c1
TLSH
T1A541B0F783F4856ECA1195F0AB187E2FCE1D0511432C7DAAC5E4AE1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 28accb43fe4a1f96fb8c3b903f75feebc5de3210f7d65ec75336fac21503f5ae
MD5 2efd3a433625e004e3a387a63c80a946
SHA1 13d14998eafa3b36ea772e6eacaf760131fcfebd
SHA512 ffc8a886370e5a30fba28f0ad1cbf489d5fcefaf3c946311848dde75eb3920922de6aaf1f36a91eb5adee792581783ec1ff9b4d98ae931e9e8a2f3f6966f8607
TLSH
T13BE0D85B89BBB47350355D7A1AC57C415D3DE431024159B5F695C27CD0D40E7670703A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ef31b68efb3bc3084f3f45f7a3dadd608c5fc0ed30bc6a6f71563b0a221729a7
MD5 767335fd5138eb649e40c0522118a000
SHA1 5e444f2e46679222816fd134e578a5097e1d9376
SHA512 38e7a68afd5c2878530b936cd20f2e05e1a7311a712bd35bb2bfe4f0dbae90b51db6f2d6849416d5f1b8841b0e3cd6fd2d97f697b4e181402a70431f66605213
SSDEEP 384:sxZ5aym1F/f9s8OWv8q60Ly89L/bu/5WoZq:sRTm1F/fuY8F0D/bU5S
TLSH
T12272F806A634597BCDDAD309FA45BF63D7F9152391904E449AFC9A1C00E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7dfb657c2ea87b7f411bdbb0dbf8c41c814dd7c5a07e705035540ad3f435fd5f
MD5 6f3d5a420130d984300262fd40525d35
SHA1 c60b36beb0a248a0587baeb6b1cd14ad1e566b03
SHA512 a89386747fca4c2951d518a421f7bfa71c4a6fdada3b6d8b8b3033cc88dbf3ee67d4ab8ec010790875b300e37e0921f92f0af7e35e5224204e20b975cf89f91d
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3k3pQLl7:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKk3p8
TLSH
T191030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 c2f82a51ac281fa4f5e4b08bae6bd8af55a4cc76fe1d237d2028329692853696
MD5 0a59357163805620beb4a2c41e773c3b
SHA1 eb9c057903108c538566d018777c995cfe981625
SHA512 47e1af036662e858cf9530bee09cb174fef51bfe95eeba52a794da4785dff59564778936f28c3e036679a4d8e9766f216463f5c630f79e3cdf1d2daae10929eb
TLSH
T179E048A01DD5C3BE682560D30778D74E97D5B41BDACC7F053F44C949A143944B662D51
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 5e2fae9e613533bc9470b21fca95ef2e99a853043cfe28ac323e0e41646196a0
MD5 9415a5d46a743fd7c0677f0126d75bb7
SHA1 e599947c96bf594e06cd48eb166bb737871a50ec
SHA512 20d54ec31a1f3c449ee3182151b2e5f457e9d9758f26e41e7cd85252fbc9311a1a0bcc5fc4b00c2981d3487debe658bd27c035fcf17c83df5c0ef86ee986feae
TLSH
T10FE0D8702DCAC3AF655520D75378F74E92E3B406DADCAF153B0C9548B207580B753D50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 df148ed808ba444f672a987c530e4b380ebf753e567eb090171ce5380326a5bd
MD5 44a4e45d56d27ce97d34a531bafbf5e7
SHA1 c1ece4b9f7461cf5e9a48d5cdcdc53e6dc7d412d
SHA512 2d02325baaefd6299dd84bf85761413d409f1572fc774e2f2bfc0ee77bac269d691ab02e00fa89477459444d39b57530e7cfea59657068c30f6db997253f4de7
TLSH
T194E048F09AD5D23A5814A0D34378FB4AD6E1B80F97C87E45A74C4448B202544B776DD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cb549c944b8f11ed6167b44f3cff058cb09039fadc6ef3efd3497293f507bdbd
MD5 3cef539aaae496ec9521711bc7221b25
SHA1 bb0192357819e7638e2031844dad958584fa460f
SHA512 4596f045f2185691e924452df706cda0fb1fbba90f4b9b6d5bdfcddffcb597df664b7a48941fb3d56d6d4252267d544462cb6a0112a11fdb47b27c124fd95a70
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ELu:AFBHhTofhno2mB21q3Llbfe3sLDdeEpT
TLSH
T149B29F57717B12423C3E290CA7919B770E8272A33458A56F7BB800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 fafd4bc0a4f7cb6e0b0cb50164816c4fcf6fa67177e493f5f0c1dd4d59a48d9f
MD5 f03b4f47bd4850aea9425f0e7d9b60a2
SHA1 24dc5ffbd497b2d6b5b32909747d31148e8c6ed2
SHA512 256b6376156670f21e008f6f186ed0a1c0407cd1ea9c71958f4599f90f9ed531a3a8b2b350eecd677d9afe6bcc3add575c32e8310bcde87a835f249ff1c3d883
SSDEEP 96:889+XzgxZWAQgOXQZeDWXWY1lDmTseCeAWVSl9HNvWWV20XLbBB5N:E+OWeAsSl9HNus20XL1B
TLSH
T1062220646E129F3BC42D6EF712F98F9003C2E442827666AD75A1089D0DD2727D7C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 95af2b44c94679fc0305dcad4924b1653dabccd683297ccfb3d90e625ffab718
MD5 abeecbb2bb54ccc4a8068ae0fca36979
SHA1 0f29277d3522defa2d214132f2915cc4e527e491
SHA512 40c9b96684f09890c7c8e2d339834fe2d5f506e8fd82c8a1c018bf0d6fc752104546acb4a704fe11aec7d880eb8ec045e7fe913dff88593a50acc4d9b0d94ad0
TLSH
T135E0D86C75C4C15F699820C712289749D2C23407EF88EF455F04848CB002500776AD51
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 df204d0303ff375baf1c3d758cfc19e5ad3f77d0f23f99b393f64af927b14420
MD5 5426587ce7cc563930500beac2b446a0
SHA1 495ab1c0abfa377eb075a5f58b1e6cad9566339c
SHA512 59e7c38ac8db403d14efce0707f294e333d98c16e588fb27654d0bcaa8c9a8bf2d7399c0d6c845f4463468530094a11158d4796e0faaf9b64b1e668f4dbd2695
TLSH
T1EA211C15F320C158E14A963DA02A9B291778E8168FBCEC1F55B920252D62F450E9B7F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e62e15234ed72cf7d91ad6ce2baa86c0004e354e9ea3fa706191d00e293a7c15
MD5 a3bf3414138912936f195c00df6f87e6
SHA1 c01b1f954d259f9a005e3fb62df667e732b5a758
SHA512 becfca7d8ad9e415b044bc0bb6ef928a8d349429d4ad9f148f70d840b4540f2b2d7fad8f8e4671afc4721d2bc204dace65d6f49a16c860ad3f53446cd4a0a0d2
TLSH
T18AE0D8A47CC4C1AF625820C3127ED78992E63806EE886F022F04C98CA1025417766D51
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 32318edc8be5e6a3d337a23d47fa28fd5145dd1acb39f1651642feca4fd3f729
MD5 3951557608f7528a79d62532e48828ae
SHA1 c5ca8477d1b8fc58a7a566cccd2cafe4a5d72bd2
SHA512 31c76222fac5c84fbd45c0f455cfa8875c7eaa6511469731d289ed58a30501db24fbfb4c66224079465598776f0c235600809418e1a910bfe1cd5aa0957ccfdb
SSDEEP 3:MsEllllkEthXllkl2zEflcll:/M/xT02zN/
TLSH
T17444040C7FC11407CF0410304455D3547374DC10051357433CD104335CCF544CD50001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 3ff4015d1db028f2ac42eccff31b465456b509a24d0479779de7e9a7c4eb732d
MD5 bae2f6ed626bb34bfae61f98807bf23c
SHA1 cd9782f5f51b3a862a958239b87e0e1e8a1356e9
SHA512 2255e71d64666e5d6e48fbe5ea4b851f932b4643f1d04f323e2519e6b8632f205f49df1f4a11ab83233b42e06684685f650386d26d44b37d502b2e84b12bb65e
SSDEEP 768:rlFUcpA5wgt7MoV5fBwePuYG1KGck3/uHhkoFYS/v:dAFLNBd2YG1KTk3/uHhkoa6
TLSH
T1A1E24B3EDC548A7F98EE7B88AB0D39129CE40137C5B88998D7D91F4D81BB09DF706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 41463493bddf8e31afed484e56f6bfb6d01751e1c4536ec803e6f2d517640889
MD5 0fa7e1f318b37dc7e735252cdfc25d8d
SHA1 19d8f86b1ffc13a2aa3cb2dd285e15c509d4bb98
SHA512 867e980e8a4ae4b8bf12ccbded9ddff39caac0b18903cf2f8df07e31fd6de35409c97540c196a15319911432b9ae423411784820d07d6c160bae13be429f1c34
SSDEEP 768:rlFUcpA5wgtuMoV5fBwePuYG1KGck3/uHhkoFYS/v:dAFQNBd2YG1KTk3/uHhkoa6
TLSH
T1EFE24B3EDC548A7F98EE7B88AB0D39129CE40137C5B88998D7D91F4D81BB09DF706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 317e113e71b6d50302953288b7f6510c7ecc49b95dc518ee45ab2ddfbce02975
MD5 8ab45d70fa353ff52b4eb5060e4e3b19
SHA1 70ce6947da16e04073378188513d8c27c1f6bacd
SHA512 25543115c14ced0f9fd258930300ea442024a159369a8b424c5d13db3c2ab688f89ff6fdcdb93525c75af68ce87266feb8d1a956753c2e9e0cb39b3fdc242551
SSDEEP 384:n5kiF9CcmyWCs38NR8TUNTUlIxBydvxozajGfb8o/8mkafBQCHuhkP+lFYS/1PHA:xFccps3Kwg8eOoV5fBjuhkoFYS/6
TLSH
T1D3B25C36EC68CAB7EDE68F89EB4A7603DEE01163C59899D4CAD81D5D00CB1DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7e9d1e86b270277094cc43cc4079b878b9623be6ad4ecdb9e0195c81f0c42737
MD5 de7945cdfbd41fc044ccb1ea69055b96
SHA1 9f877bbfce33ce4b26a6859ad4ed1c3ddc1db81c
SHA512 2368d864f552fd49ea07437634f94482acc163d2e4b2f2fafa95e516dce7b7e42d8ca00d97d57f45470b88eaafba2b48519fcf09648d8f79afb8266c25a57409
SSDEEP 384:n5TiF9CcmyWCs38NC8TUNTUlIxBydvF1jGfb8o/8mkafBQCdv6xhkP+lFYS/1PHA:4Fccps3JwgcxoV5fBtkhkoFYS/6
TLSH
T14CC26B36E868CEB7ECDA9B99F74A7643DEE01163C5888AD4C6D81E1C008B1DD1B0BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d8c0214dd50e90f02db97eb5f5097a392dcf4238dfc7f04eb8cc298f96224e19
MD5 3ceae17da3b45d696fcd02272efb85d0
SHA1 6be208a67b21fb4bdf814a8bf1d1a34148e2bc6c
SHA512 77180d26caa20e22bd2642fdfabc65258acdcf0f452d96d6fe45e81a73ef1cb85a3f50c7f54d6bed831996a0850b931ad898dde4fedfe3d2be429c914f2a1380
SSDEEP 384:n8OiFqZcI28Nc8TUNTUlIRJyl+YYjGfb8o/8mkafBQCd6MP6BeRs9JKgqijUbPHv:8lFI2nwgI3MoV5fBgJTjKgqmUbH
TLSH
T17CD26B32E864CAB7E8E79EC9B74A7603DEF84123D68C9AD8D5D85D1D008B5ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 95a9a453cccd1f5f7bde03cb93adbe1ebe7d55ca8d5052c22dc5bd2da7abe1e3
MD5 4db0eacd5267c01a6e978d06049dae75
SHA1 72e92399338b44aa3b3a0ec338a4192c992eb227
SHA512 698df9c05de6ea371d35e344be5646013879f08d4d3508539007833319f1235bd1887c5554fbb23218e7f95cb38ce5e4abbc9a158a7a35026bfd46295c357b92
SSDEEP 384:n5ROiFqZcI28Nc8TUNTUlIRJyl+YYjGfb8o/8mkafBQCd6MP6BeRs9JKgqijUbPP:rlFI2nwgI3MoV5fBgJTjKgqmUbH
TLSH
T16ED26A32E864CAB7E8E79EC9B74A7A03DEF44123D68C9AD8D5D85D1D008B5ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8ca2d7bb1a5de873eda0a09efeda7ed220974a6c1a9bca2477171e38e2cb6238
MD5 9838f834d25f25cca2cdac15d684ad75
SHA1 95ca30339bf8b4bdced688908615502f0c77ac44
SHA512 30c469db03aed7433df2c08b6c8b34689d0dfde97ee65dc95bdf4923866cdb9d82836aa4d688ca44b8f9cbe33e39a474ffcededa01fd0700317e745568265b62
SSDEEP 3:MsEllllkEthXllkl2zEfl4Qlll:/M/xT02z9w/
TLSH
T1F24404047FC04C07CD1050304051C3547370D4140D15D7C33CD104335DC7D404D400C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

986adc77-8583-4691-9a12-57fcd5dba0e2.tmp

Path C:\Users\Admin\AppData\Local\Temp\986adc77-8583-4691-9a12-57fcd5dba0e2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Desktop\Arex Premium\libcrypto-3-x64.dll
Size 5.1MB
SHA256 b9b8651571ccef896776b99610c4d1385e14a8f2a2ebe70c8286fb426579e7be
MD5 eb3340b72107ad708e415615805daef7
SHA1 b2d53411ef2fc5c205764eb02d35ff0beda258f0
SHA512 70d174f4d99606ec9855a54f5439b4870fc005f9bdf89ab5c38cca7a62120a92b3d60eb918184f0abbc872ed392c5c65c7956d03a149cbf0174022a9914b2ff9
SSDEEP 98304:d2fp+Zkc3kJQfk0A15o9Q+y1CPwDvt3uFlxCC:d2fp+ZNkJQfk0A1eWf1CPwDvt3uFlxC
TLSH
T11E368C69B6BC0055E87A81BCC2836227EB71B92563B057DF5E6846F50F23BD02B7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Desktop\Arex Premium\libssl-3-x64.dll
Size 850KB
SHA256 fc7dca9100f90e22cf98a5c7e90754318bae28289c3ac45bde0dcacd497de53f
MD5 c0a2337d42e9add847813bc3d314c23e
SHA1 c3369f86fc0b732f1f431ef8fa8f38c624fbde18
SHA512 2ebaed6940ac485df6118dc3233572cfc10db8247a8e5479f6816b60fdc26fb749ab450a6074ff17104338c9a139f7a8aa480e3ae7ef54fc7a5a28d856db2a25
SSDEEP 24576:Wxv2P0vxaJdOQEWTUwnPQgyC72NOUA4d:WxvP5aJdOegaUC2NOUA
TLSH
T193054C65FBB8009CE862D17C86934613D6B6F4163370EBEB1B648A392F637E1263D354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\Desktop\Arex Premium\loader.exe
Size 9.3MB
SHA256 b6232f3c9c783ace324098d7dc3746e5c499054e77ae1e9424d457d37ae2c563
MD5 2a1a02bcd553ad71670265ecd9f207e8
SHA1 7f56d71f2d883e650e25a377141bd92031b56adc
SHA512 d7c3123ce2806d41a79be30bd5aedc559b862343d3ac44a7da780876514052e2f0f85c97f506e249b48d85a2deceb99ccc2ab314a5f9a45f610daa749178b035
SSDEEP 196608:he+zV6P8F9PC9FX4RAtF3XIpjgnI6VJ0xHTnm1IQphVK/sgmq81P:vJ6uPWFXRF3YpkIGeHTm13phVK/pU
TLSH
T12EA623ADA258331CC05E84B49537BD09F2B6531E0EE9D47E32DB7B907BE7420DA06B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patcher.exe

Path C:\Users\Admin\Desktop\Arex Premium\patcher.exe
Size 470KB
SHA256 f897e323ba1febe99bd0dd42e975db4f5eb3b32f21f62e3b87e6b104bd5680c1
MD5 6427242ac3a156e7612b5e7f97c5e5ec
SHA1 7626489be19ebc1d2f0a2b62292563edf5965b5c
SHA512 7ac7c6d96ca4020d1a5ce2b3855d7d1433765a9e16e6ac187e02cc3e6035fc384875c63eb9a7fcee00a7b201e7411933fc69c8ecd297012edb35bf066feca559
SSDEEP 12288:JZC0edTlJTb1EnepP8Be+yP+h7aflR0fPJ4:e0+BJ/nP8JhWWPJ
TLSH
T197A43C27AA1401EDD1A7C2BCCAA78902F771B89A0362A7DB17D4E5711F174E85E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.crt

Path C:\Users\Admin\Desktop\Arex Premium\server.crt
Size 1KB
SHA256 d5938e3d4baa6059c89191613e5e446e62e7655603dc928c4161b7ff56729de8
MD5 42cb722b66b5d8cd78e0099e276e4dd9
SHA1 34837225a3249ecd61db96c7a15175a135795f29
SHA512 0e6bd5abb4c93368b884d3fef8374e78935d3840dc6d3d6447a20a3be20eb36918d678e0720bffac207b6cd43008de1170b47da420be2644b93badb121354744
TLSH
T1EB21B47F0D92A94950A6D088A8DFC12434F2B3E314D0F0840C2758BA07A387A36EDC8A
MD5 SHA1 SHA512 TLSH

Submit Download

server.key

Path C:\Users\Admin\Desktop\Arex Premium\server.key
Size 1KB
SHA256 4e2d6e27cc6b4cdd77876e1ce1a553df5021c9f10792350c283cc2912960b5a4
MD5 341b252a5fc4d56841585f746c95518c
SHA1 06509d6cfa4984bc81437c10fab64af127f37a93
SHA512 97b97c2298e1a60b2c611f3fb704e14db4aac619d8d43875034821211de2a16a12158c8133b12922d2838f1e8911ee681731b7fe51ebb160dd049a84b32411b1
TLSH
T1783108B0C8EF49798898AFEB2D13A14CD2471C3B5387364323E41489B627832B27C5F1
MD5 SHA1 SHA512 TLSH

Submit Download

Arex Premium.rar

Path C:\Users\Admin\Downloads\Arex Premium.rar
Size 28.9MB
SHA256 e926359b3a1351dc39d29f05bbe3eb44990c1be3ff8645407b3791fb53837972
MD5 8bfd433e3de1a13d9147b1790515c41b
SHA1 b42f7ddc1b8a23a6ddc3f9bc0eb7e5d39d0d8d14
SHA512 3a31aacf2448fed2e15a6a25acf9ea2afc7ebaf6b39085f43afade995114ea6cc878d4908497143e24fe24cbd0393243254afbdb7a871af1da3989323bffe9c2
SSDEEP 786432:EuYs4KPMEy6ZSUVsXo1uMOg4oTOES8kDYxgq67:j4K0E6UqRMOg4oqES8kD867
TLSH
T1E56733D440E6881202A2DEB3D4F3212877D49E36C546BE9E45BC5E7BCA5A8E47C70EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arex Premium.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Arex Premium.rar:Zone.Identifier
Size 171B
SHA256 b558dcfe2e99b15a20564588eb37ae9b78ae59a678c3307f3a6123b16fc0d604
MD5 7fa4b46fe74ee95c5fcaddd854eeab5d
SHA1 336b138181b80ca666b9db62e78a38a6117b7aa2
SHA512 123d5a7d2e33e74566eb13b676d0c089bee351315ce773a4293222339c64fb6c99b6e201f4745a66f0ee8b26fd7c78cdb12d15a157216660e45820bcb22a2d23
TLSH
T1A8C080E70C044417415617EC3D49ED4D754E6D2798856349DC4044D65D48055C5C8537
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 a80d0a246c6b90949f30bf26565a164faf4308a6642feeb68e2047ec185a26bb
MD5 c26904de5a73a58d8ba2ecd65690d0f8
SHA1 80bd5528a08faac1134b89c872a6f2a545409062
SHA512 87ac8d5429ffc146b684e898a9e4cbf011aad8da8fdacbe4471ee6f9d9ad08f171d3cad7040416ee2bad6008c8cfc191347d58649295f463e07b3ebddef4ddcb
TLSH
T17621EE2A0649915D36B341E9081CB42FA31FC0EB0E3B9D8D3F8E050F7BA2A0C5322746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1804-336-0x00007FF6C89F0000-0x00007FF6C9B1A000-memory.dmp

Download

memory/1804-331-0x00007FFD0B430000-0x00007FFD0B432000-memory.dmp

Download

memory/1804-333-0x00007FFD0DDF0000-0x00007FFD0DDF2000-memory.dmp

Download

memory/1804-332-0x00007FFD0B440000-0x00007FFD0B442000-memory.dmp

Download

memory/1804-328-0x00007FFD0DDE0000-0x00007FFD0DDE2000-memory.dmp

Download

memory/1804-329-0x00007FFD0DA20000-0x00007FFD0DA22000-memory.dmp

Download

memory/1804-330-0x00007FFD0DA70000-0x00007FFD0DA72000-memory.dmp

Download

memory/1804-327-0x00007FFD0DDD0000-0x00007FFD0DDD2000-memory.dmp

Download

memory/1896-664-0x00007FF70C730000-0x00007FF70D730000-memory.dmp

Download

memory/4660-938-0x00007FF6C89F0000-0x00007FF6C9B1A000-memory.dmp

Download