hxxps://www[.]mediafire[.]com/file/cp3s7ol6qzsrrgm/ARC_-_Free_FN_External[.]exe/file

Analysis

user interaction
yes
max time kernel
232s
max time network
233s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/cp3s7ol6qzsrrgm/ARC_-_Free_FN_External.exe/file
Sample260808-d6cxtsswew

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
46	264	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5424	ARC - Free FN External.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5424	ARC - Free FN External.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe
4812	cmd.exe
3180	cmd.exe
2896	cmd.exe
5060	cmd.exe
1360	cmd.exe
2536	cmd.exe
4072	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
264	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306338322880038"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1012	1148	chrome.exe	88
PID 1148 wrote to memory of 5448	1148	chrome.exe	90
PID 1148 wrote to memory of 5448	1148	chrome.exe	90
PID 1148 wrote to memory of 264	1148	chrome.exe	91
PID 1148 wrote to memory of 204	1148	chrome.exe	92
PID 1148 wrote to memory of 204	1148	chrome.exe	92
PID 1148 wrote to memory of 3632	1148	chrome.exe	94
PID 1148 wrote to memory of 3632	1148	chrome.exe	94
PID 1148 wrote to memory of 4108	1148	chrome.exe	95
PID 1148 wrote to memory of 4108	1148	chrome.exe	95
PID 1148 wrote to memory of 6072	1148	chrome.exe	96
PID 1148 wrote to memory of 6072	1148	chrome.exe	96
PID 1148 wrote to memory of 1484	1148	chrome.exe	97
PID 1148 wrote to memory of 3408	1148	chrome.exe	99
PID 1148 wrote to memory of 3408	1148	chrome.exe	99
PID 1148 wrote to memory of 4496	1148	chrome.exe	100
PID 1148 wrote to memory of 4496	1148	chrome.exe	100
PID 1148 wrote to memory of 5616	1148	chrome.exe	103
PID 1148 wrote to memory of 4184	1148	chrome.exe	104
PID 1148 wrote to memory of 5616	1148	chrome.exe	103
PID 1148 wrote to memory of 4184	1148	chrome.exe	104
PID 1148 wrote to memory of 4452	1148	chrome.exe	106
PID 1148 wrote to memory of 3700	1148	chrome.exe	105
PID 1148 wrote to memory of 4452	1148	chrome.exe	106
PID 1148 wrote to memory of 3700	1148	chrome.exe	105
PID 1148 wrote to memory of 2740	1148	chrome.exe	107
PID 1148 wrote to memory of 2740	1148	chrome.exe	107
PID 1148 wrote to memory of 3952	1148	chrome.exe	108
PID 1148 wrote to memory of 3952	1148	chrome.exe	108
PID 1148 wrote to memory of 5464	1148	chrome.exe	110
PID 1148 wrote to memory of 6000	1148	chrome.exe	113
PID 1148 wrote to memory of 1584	1148	chrome.exe	114
PID 1148 wrote to memory of 4760	1148	chrome.exe	115
PID 5424 wrote to memory of 3180	5424	ARC - Free FN External.exe	118
PID 5424 wrote to memory of 2896	5424	ARC - Free FN External.exe	119
PID 5424 wrote to memory of 5060	5424	ARC - Free FN External.exe	120
PID 5424 wrote to memory of 1360	5424	ARC - Free FN External.exe	121
PID 5424 wrote to memory of 2536	5424	ARC - Free FN External.exe	122
PID 1148 wrote to memory of 1928	1148	chrome.exe	123
PID 5424 wrote to memory of 4072	5424	ARC - Free FN External.exe	124
PID 5424 wrote to memory of 5932	5424	ARC - Free FN External.exe	125
PID 5424 wrote to memory of 4812	5424	ARC - Free FN External.exe	126
PID 1148 wrote to memory of 816	1148	chrome.exe	127
PID 1148 wrote to memory of 816	1148	chrome.exe	127
PID 1148 wrote to memory of 4436	1148	chrome.exe	128
PID 1148 wrote to memory of 4436	1148	chrome.exe	128
PID 1148 wrote to memory of 2076	1148	chrome.exe	129
PID 1148 wrote to memory of 2076	1148	chrome.exe	129
PID 1148 wrote to memory of 2028	1148	chrome.exe	130
PID 1148 wrote to memory of 2028	1148	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/cp3s7ol6qzsrrgm/ARC_-_Free_FN_External.exe/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa410cc728,0x7ffa410cc734,0x7ffa410cc740
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,3104796723150134618,3296614603034723031,262144 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,3327213208332289857,12711005697508407578,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,10869142065743384386,13906893996661405214,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,1873374935321753961,1265225832308090596,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,2051691472510975820,8223433281271748430,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,10794774021225368477,11890846228556524854,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,14730022172114908363,1656238398550835007,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5384,i,9391387166776826555,715768543914755580,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5420,i,16146977192849051380,18159687700544157643,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5376,i,17213648871080474689,14568927002826615012,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,16946623125098438698,8625000734930906771,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5884,i,15805922571022295468,9895066966550881251,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5404,i,15814879711737790269,9046388059163571839,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3320,i,7841447521309628566,14691689968352562328,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5908,i,10556800021144078276,12122027817499918237,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,10777644173945994610,12262522939199251335,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,12488986995414021369,6834753993534756164,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,13669696173829424889,5746450429917443345,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,6496649052579210596,10682167200389303717,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6112,i,17807490264199663121,10367308507589420980,262144 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,3592304897022967991,10900658112772335591,524288 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4888,i,1634899124222788064,5101854521056932128,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6184,i,11077936441503903667,3799329797213153682,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6492,i,2825863745299652801,9576121753524406169,2097152 --field-trial-handle=1900,i,8872294497608118252,15282404941724255661,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:2028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

C:\Users\Admin\Downloads\ARC - Free FN External.exe
"C:\Users\Admin\Downloads\ARC - Free FN External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9cd8141b-84fd-43bb-8dea-0b7bea8030cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9cd8141b-84fd-43bb-8dea-0b7bea8030cc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 1806620d4fc6a74f65e2acbe08c7f5e59e0bc618dc1a7e3acdbd14e599f8266f
MD5 44f4f9da3afccec14bea5835cd844b7e
SHA1 64b7361dc7275723c1289257043d86bcfb0bd04c
SHA512 8cf5bf0aeae1336023ceb9f81b30c5d2598c9f3b1d1f9e88015b4685d70a06028dce828f03f6ebaff5eb96243ff41299584f8e994c27a2eb4d799a590983b313
TLSH
T172E08C24A2AE6464CB945635AC7758A0F430C2DE4AA307B6F5A04CE451EB1EB4C2ECF5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 c9efb2c9494355332e1468a94b3a4d0c62e98e1c774fa03f9a496b3c0d3347d7
MD5 cc969f1bdf10676d1523fe1ac0b20eda
SHA1 ee0e8d5a2068a705147ed56752df50e1a2121159
SHA512 5041a9443d8c4811d0033126eade199b0ae43fc080384ea921c3d091f92e10ab16bf039f03cadf5a6cc78a763b4fac7606816d3e78a9bd968565f29f7f3ec45c
TLSH
T19BF02250B19C7028C75485328C734851F870C28A4A9303E2E0914CE080A71EB4C2ECB4
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2f188ff89e1b93e2e81bade64236ec1f9a3c6dcea46afd271b717e0547435756
MD5 913c0b708a24fa13faf7c1802c45fe2b
SHA1 6ca005c69376873223f1e7b6030a806c2b692723
SHA512 e9bee6797dade150fe47b033015909de7461bf1cc79b6f9980e00316dde90e718a7c352fa70b12aca04cc80e3071ed566c18676df4192557cc384f7409135697
SSDEEP 192:DSykCrbSI5fCklkSJDyh4IY9vLi6i4VrvQ42xov36K:DSykCrbSI5fCklkSJDyh4IY9vLi6i4VD
TLSH
T13EF17BF7C3D9D92EC90156F8AB146E1BCE1D0A1943283C26C8D5EE8BE3E2472D25954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1df6e815bb3a3c9b06bb5d635f8dda9561b31d113bc9edc042524596d712f554
MD5 97d6ff2bfa88477b1b104843a4d53a62
SHA1 632f1d190700ea517d1054ff4bbfe67b4c80be2a
SHA512 5bf439eed00ab4444f656209de0057b2aabae3f62f9faa85bf7f98030a90d9bb5e2a66cd2eed2b9ad8d8e093459fa14e36341010b5c188b32a4ca0d20efd7607
SSDEEP 192:vRry+EGQv7MvAPRp2+c9gHsb+WNn/Zoqu2g133mkw+cVyIsnAUge:vRrykMQ6XcqwRk2gmne
TLSH
T1A042B52EBD25797B5DDAD229FE217793E7F5102621912E84E7FC892C24E75CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8674034df4498898dc20435b05870bcdaa12d2f5c736799c953a3ee805a4f5cd
MD5 ca5fdaa3750af536f812c6d05f238aa8
SHA1 1a99e14542b26f9f1c12003a869df52b6b10b69f
SHA512 3380f7d9bf6f31d280caa505fb16874cdfe673884032722b02781fdd3be7a362fe5934bf2fce8b2aa4eb4b5988ae93500c791ee938b841cd321016cfb3125cd3
SSDEEP 192:KwRr2+Ee9v7FzPRpH4rUpc9gHsb+WNnCZ4vc98rYjeD133mkw+PVyIsnAUgE:hRr209dXAqwQbNeBmcE
TLSH
T19652C62EBD25797B5DDAD219FE217B97E7F1102621901E88E7FC892C24E76CC2223017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c5e444e6a8d92d2637bb156f94d15ee64ee304b41409fb0a01abef321133f6e9
MD5 080737b7096adff107454b8a969f1ed0
SHA1 32aa2cc147bd60ff182011bc188a3ea215fd94be
SHA512 6752acf9b3e02e8219be0e33c1532a99522b98dc072958448eabd27f56938d1122ca9ad10896ff123981e98a958272398a58c1de700be293eefe163cbf10716c
SSDEEP 192:vRr2+EG9v7MvAPRp2+c9gHsb+WNn/Zo8rYje4/133mkw+cVyIsnAUge:vRr2k9Q6XcqwRseEmne
TLSH
T10742B32EBD25797B5CDAD219FE217793E7F5102621912E84E7FC892C24E76CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 90fc3f3a847131b108c7d9aaca47c8b4f215c54cf7beef7dad6c8934b008b715
MD5 28e28810240739d95a7cc877f8d8328c
SHA1 d92bf8e892e5c77f22eb8c088c5f724e8e8b5d23
SHA512 7b3f76f72fb72785438311c11797c1fe9ba3f0c6c7b61cce9c136ab040801af43e6605a924493d600611a02857feef6203fa529624a175a1e6f7bb684dbe54ea
SSDEEP 192:vRr2+EG9v7MvzPRpH+c9gHsb+WNn/Zo8rYje4b133mkw+PVyIsnAUgE:vRr2k9QzXzqwRseemcE
TLSH
T16542B62EBD15797B5DDAD219FE617B93E7F5102621902E84E7FC892C24E76CC222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bb863f6fa0962fdfb9a8a923d1756cab29991dbcd100f2c91a03585afd1f1aee
MD5 035ff55a90321fa2ecc5a736cce5aeac
SHA1 81a4648ac5a0a8d9395af28e3d86ff57bf75cbcb
SHA512 873fa70a4185dfe5db486624a1678893d5693fd1e08a88574b8f233d714f3b521c1ca756112f305b8f05cc9853d6c3d2b6c3659d81a4147b2af21ef972b19335
SSDEEP 96:xbJ0d+OI4Q2k7i/jfTVZ9gRT2Sl8h4otop5xZjDbB6+GyvX1egU/hTpRNC39ISyj:xt0G4DkG/FZ9g8iU2zXlqc6/hTpuC2Ja
TLSH
T147C11AB1986D9DAB4DB2E489B1032D47CDA8506F7914BE28EEDD0E0C11E35DD5383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 aa84d212d312fb8615467173b22a4da17707eb3f03adc5ce8032dc14ffffca6e
MD5 17d7f10e753fe9052994e25c7c313e7d
SHA1 238de9d7bd4b94a68fb1263b2fa16b239b1c7b8b
SHA512 baa7f87098e84ece62b67e8f346366a18f2bccb5afe72020b458912075004cc5704282e9d3072a01b87ba4a46447350b28cb54872bd2d88ff5fc8b7afeade704
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5x6DbB6gGyvXNQTrbfyYv4a:RC0G4DkG/FZ9kGDUDGlMAQTrbfX
TLSH
T1E3A10971A87D9EB75972C448F5933A43CEA4A0ABA210EF54DEDC0E0C21F71DD1342563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0d90b9dac73c43de1ae78c4bf94bffb116cb18283bd985c0dc24efaf78fc7fb7
MD5 171b8038bb8067905db6129a13d29ce0
SHA1 10f6f26cb78665fb5534e6679093b97fdd6c91d6
SHA512 ed3fd7b6d05081f879122b49c31c61803afe15ba1da63082446c624a2be9d1fe82c3a06e73a18b9c89c465164f776fe594d0edce1c3ee0cd113187f3b58db10c
SSDEEP 96:xbJod+OI4Q2k7i/jfTVZ9gRT2Sl8h4otop5xZKDbB6MGGfvX1aUYhTpRNC39ISyo:xtoG4DkG/FZ9g8iU2zsl5vFHYhTpuC2V
TLSH
T173C11AB1986D9DAB9DB2E489B1032D47CDA8506F6904BE28EEED1E0C11E35DD1383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7f70cd8d21a1605b821610d2aa25ea5989757bbbc235e725986e449cbd3b04fd
MD5 d25b0f4b16856f12af6f8bf1a8fc06a5
SHA1 6da7ec0719c9f3e5e3715f7280d03b01eb42022c
SHA512 6324d80bcf3fb25052d437028372ee7d53976fe37891f763e19dafa5ed442ef0c26dc76d5d9fad31fe71e5aadf3d6c7198b926cb8920d6c93ee92c60714b5a77
SSDEEP 96:xC0d+OI4Q2k7i/jfTVZ9gRT2Sl8h4otop5xZjDbB6+GyvX1f1I0jKHDTUyhTu0jz:xC0G4DkG/FZ9g8iU2zXlqcfm1DAyhTui
TLSH
T147C12871A87CE9B36AB2D159F1432E87CDB8906F6640AE24DFD80F0811E75ED2343822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 54560ec4b6d497891f2d212d79c058672a1cb69113ab507fa3c85ac8c828bd6a
MD5 9583f525514b876425c39258c09c0618
SHA1 9f9ae5205dbcc7585c2b6aa605162184874d5516
SHA512 8b0df99f354f00eeb6ffa141aaa3ac20b75c81475db23849066ea61bc2f9f45d8e1bf389e3d859a9e8ecc57b7cc37364f21ca145faebbc5326ec526f648de41f
SSDEEP 96:xbJ0d+OI4Q2k7i/jfTVZ9gRT2Sl8h4otop5xZjDbB6+GyvX1f1I0jKHDTUyhTu0n:xt0G4DkG/FZ9g8iU2zXlqcfm1DAyhTui
TLSH
T1B4C12971A87CEDB3A9B2D159F1432E87CDB8906F6644AE24DFD80F0811E75ED2343822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 faab09bfd9febb69ccaa915364e1e1ecc7b4a7fe47ccfe48717357cc9e9a49af
MD5 c9fe1a9cf0d7f840be19a3f6d94edd6b
SHA1 063bbeff80715e937ee556a466ee32b4fdc49479
SHA512 3f8fb035c83d823667c33fcb55da829b70bcf4daa8ba069f836e6f61606799855b29ea47a93154930f6118d6f9082f514cc381c2c05f4b16845bd4858707f96a
SSDEEP 96:xbJ0d+OI4Q2k7i/jfTVZ9gRT2Sl8h4otop5xZjDbB6+GyvX1aUYhTpRNC39ISyVe:xt0G4DkG/FZ9g8iU2zXlqcHYhTpuC2Jb
TLSH
T1DBC12AB1986D9DAB4DB2E489B1033D47CCA8506F6914BE28EEED0E0C11E35DD5383573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARC - Free FN External.exe

Path C:\Users\Admin\Downloads\ARC - Free FN External.exe
Size 3.0MB
SHA256 85f280332449bdbf11437b19a541b98122860304b76182eec5b3324b117c255e
MD5 70f4d601f79a0e6bdcc19aafcb3b3683
SHA1 1f9e6af39a93e09e297dd2289c678ade8ec882ee
SHA512 3d08eb1e21db8fb24fb463649d2823dccb7317bfbc8e1390c63c627d9759ee289b861e1b636e98365ea14020af5418aa1dcb8d42b4147dbd2e17181838cbb1dd
SSDEEP 49152:SGtlqfaIIU6iufWTMFBu3pW36YUwywq9Z2gGn5PTJ8ViPDsTn5Zw5BQUk0:L3+1Y/1gGsVksw5WUk0
TLSH
T1E9E5BE16E2E600E8D5B6C178D5675633E7B2B42907708BDB27A4CAA50F137E46F3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download