58015d04f6c63c58ad63130251f0c930dbeac45a93cb38ad35149ffc4cf861d1

Analysis

user interaction
yes
max time kernel
1048s
max time network
502s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Текстовый документ.txt
Size 120B
Sample260820-2xt2ragb77
SHA256 58015d04f6c63c58ad63130251f0c930dbeac45a93cb38ad35149ffc4cf861d1
MD5 c2cf25c390c1a87e26d574ac852f1eec
SHA1 f97779ccfa78a23c5338078a364d04f5e633a147
SHA512 835b0efdba186f17169b24c4894225ea86c73edd71440a0022d8befeeadae643e5f96698e5592104f02301d8c45b8fdc473a73858e1d69cd352865e80cd40034
TLSH
T107B092AF0635A09C1A9C84CA54EFB66C8923C16AFCE1C685E94906A062800759CA2EB9
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
400	764	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	winrar-x64-701.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
2832	winrar-x64-701.exe
4680	uninstall.exe
2616	WinRAR.exe
5784	PdrCryptor.exe
2020	WinSysHelper.exe
548	Program.exe
2360	WinSysHelper.exe
5716	Program.exe
5760	stub.exe
1048	PdrCryptor.exe
4584	WinSysHfelper.exe
5888	Program.exe

Loads dropped DLL 1 IoCs

pid	Process
3376	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinRAR.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240832187	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PdrCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PdrCryptor.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	chrome.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317403139838522"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	PdrCryptor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	PdrCryptor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	PdrCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	PdrCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	PdrCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	PdrCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	PdrCryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	PdrCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	PdrCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	PdrCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	PdrCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	PdrCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	PdrCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4512	chrome.exe
4512	chrome.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2616	WinRAR.exe
5784	PdrCryptor.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
3476	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
2616	WinRAR.exe
2616	WinRAR.exe
2616	WinRAR.exe
2616	WinRAR.exe
2616	WinRAR.exe
4488	chrome.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2832	winrar-x64-701.exe
2832	winrar-x64-701.exe
5784	PdrCryptor.exe
5784	PdrCryptor.exe
5784	PdrCryptor.exe
5784	PdrCryptor.exe
5784	PdrCryptor.exe
1048	PdrCryptor.exe
1048	PdrCryptor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1704	4488	chrome.exe	87
PID 4488 wrote to memory of 2216	4488	chrome.exe	88
PID 4488 wrote to memory of 2216	4488	chrome.exe	88
PID 4488 wrote to memory of 764	4488	chrome.exe	89
PID 4488 wrote to memory of 3956	4488	chrome.exe	90
PID 4488 wrote to memory of 3956	4488	chrome.exe	90
PID 4488 wrote to memory of 2340	4488	chrome.exe	92
PID 4488 wrote to memory of 3256	4488	chrome.exe	93
PID 4488 wrote to memory of 2340	4488	chrome.exe	92
PID 4488 wrote to memory of 3256	4488	chrome.exe	93
PID 4488 wrote to memory of 5064	4488	chrome.exe	94
PID 4488 wrote to memory of 5064	4488	chrome.exe	94
PID 4488 wrote to memory of 2748	4488	chrome.exe	95
PID 4488 wrote to memory of 2748	4488	chrome.exe	95
PID 4488 wrote to memory of 1348	4488	chrome.exe	96
PID 4488 wrote to memory of 1348	4488	chrome.exe	96
PID 4488 wrote to memory of 4328	4488	chrome.exe	97
PID 4488 wrote to memory of 4328	4488	chrome.exe	97
PID 4488 wrote to memory of 4844	4488	chrome.exe	98
PID 4488 wrote to memory of 4844	4488	chrome.exe	98
PID 4488 wrote to memory of 2872	4488	chrome.exe	99
PID 4488 wrote to memory of 2872	4488	chrome.exe	99
PID 4488 wrote to memory of 3896	4488	chrome.exe	100
PID 4488 wrote to memory of 3896	4488	chrome.exe	100
PID 4488 wrote to memory of 4532	4488	chrome.exe	101
PID 4488 wrote to memory of 3076	4488	chrome.exe	102
PID 4488 wrote to memory of 2800	4488	chrome.exe	105
PID 4488 wrote to memory of 2800	4488	chrome.exe	105
PID 4488 wrote to memory of 4080	4488	chrome.exe	106
PID 4488 wrote to memory of 4080	4488	chrome.exe	106
PID 4488 wrote to memory of 4636	4488	chrome.exe	110
PID 4488 wrote to memory of 4636	4488	chrome.exe	110
PID 4488 wrote to memory of 436	4488	chrome.exe	115
PID 4488 wrote to memory of 3364	4488	chrome.exe	116
PID 4488 wrote to memory of 3064	4488	chrome.exe	117
PID 4488 wrote to memory of 3744	4488	chrome.exe	119
PID 4488 wrote to memory of 3744	4488	chrome.exe	119
PID 4488 wrote to memory of 2360	4488	chrome.exe	120
PID 4488 wrote to memory of 2360	4488	chrome.exe	120
PID 4488 wrote to memory of 2644	4488	chrome.exe	122
PID 4488 wrote to memory of 2644	4488	chrome.exe	122
PID 4488 wrote to memory of 4020	4488	chrome.exe	123
PID 4488 wrote to memory of 4020	4488	chrome.exe	123
PID 4488 wrote to memory of 4596	4488	chrome.exe	124
PID 4488 wrote to memory of 4596	4488	chrome.exe	124
PID 4488 wrote to memory of 4512	4488	chrome.exe	126
PID 4488 wrote to memory of 3100	4488	chrome.exe	127
PID 4488 wrote to memory of 3100	4488	chrome.exe	127
PID 4488 wrote to memory of 4976	4488	chrome.exe	128
PID 4488 wrote to memory of 4976	4488	chrome.exe	128
PID 4488 wrote to memory of 4672	4488	chrome.exe	129
PID 4488 wrote to memory of 4672	4488	chrome.exe	129
PID 4488 wrote to memory of 4104	4488	chrome.exe	130
PID 4488 wrote to memory of 4104	4488	chrome.exe	130
PID 4488 wrote to memory of 4188	4488	chrome.exe	131
PID 4488 wrote to memory of 4188	4488	chrome.exe	131
PID 4488 wrote to memory of 2316	4488	chrome.exe	132
PID 4488 wrote to memory of 2316	4488	chrome.exe	132
PID 4488 wrote to memory of 4344	4488	chrome.exe	133
PID 4488 wrote to memory of 3232	4488	chrome.exe	134
PID 4488 wrote to memory of 3232	4488	chrome.exe	134
PID 4488 wrote to memory of 2072	4488	chrome.exe	135
PID 4488 wrote to memory of 2072	4488	chrome.exe	135
PID 4488 wrote to memory of 2692	4488	chrome.exe	136

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Текстовый документ.txt"
1⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0556c728,0x7ffa0556c734,0x7ffa0556c740
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,5543679415298038628,14357183844526396482,262144 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,18092928979350863248,15234749345202204030,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6403360375174939362,1508994837418687866,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,18429136282356370385,13943490928366567183,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,8273822908555753921,3481381855477293390,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,6671842644231997526,2455262227652367514,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3988,i,4426449354375119598,2935036910269353608,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4952,i,2296464513972970471,2090627572620240883,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5272,i,3584525532300120175,4388396764594235441,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5400,i,15913275347915836693,8804950465655170987,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,9331583973776968161,10748878611581244408,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5716,i,6693085544256177279,12629205995395581374,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,9944772392861750527,11219841107397910001,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,11024903016444636336,3653779988218099109,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6240,i,11520053139777105513,4387066688555576629,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3292,i,12564831432401183615,2806572188642981140,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3244,i,10312386344665931909,1674953482806020514,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,13153310088741257791,4877106928935643696,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,4503489479014652135,15107366013916760858,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,8801215981020995207,14361751725292167287,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5820,i,8020989181585578101,7811172121163689528,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6524,i,8884492880025038853,9598421441253362966,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4512,i,4629373160377597253,4134298735003956164,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4476,i,12728753581364621583,3475474616398834309,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5312,i,8263607060247705678,8427443854023581290,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6308,i,4944291054609376538,3644549652562252755,262144 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6500,i,6443203601959806845,5861540483154147245,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1568 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6640,i,1109411685905328132,5137654051533219877,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6796,i,9575118986675403081,3932192787863917256,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6600,i,10331442173493086733,9605229536855447898,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6780,i,11368466141975104267,15492756764252972108,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3356,i,2602874340276517538,16620133738847960593,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,9001508768914384817,7593584314623452928,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,1167566718121835624,274426709000911588,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6708,i,3389669191251522642,11683570180727757293,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5328,i,12674718535494096085,11537739621575425129,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7324,i,15467253128353512911,4828853847423170415,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7296,i,2309211610440687447,14576983267058255351,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=4480,i,8651082478583398829,6071816918430769839,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5760,i,4408194753176223264,14179816014117178114,2097152 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,8039215287721757121,2842537301253281411,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:4720
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2832
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4680
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Pdrcryptor.zip"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2616.516.7621167169664286445
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3476
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff9fb72b078,0x7ff9fb72b084,0x7ff9fb72b090
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,170739783600481544,15836305323123234630,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1968,i,170739783600481544,15836305323123234630,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2416,i,170739783600481544,15836305323123234630,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3688,i,170739783600481544,15836305323123234630,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,10594838149029922013,10679783826377589667,524288 --field-trial-handle=1924,i,5879523146668584839,2784730230990619834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7876 /prefetch:8
  2⤵
  PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1956

C:\Users\Admin\Desktop\Project\PdrCryptor.exe
"C:\Users\Admin\Desktop\Project\PdrCryptor.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Users\Admin\Desktop\Project\WinSysHelper.exe
"C:\Users\Admin\Desktop\Project\WinSysHelper.exe"
1⤵
- Executes dropped EXE
PID:2020
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  2⤵
  - Executes dropped EXE
  PID:548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2072

C:\Users\Admin\Desktop\Project\WinSysHelper.exe
"C:\Users\Admin\Desktop\Project\WinSysHelper.exe"
1⤵
- Executes dropped EXE
PID:2360
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  2⤵
  - Executes dropped EXE
  PID:5716

C:\Users\Admin\Desktop\Project\stub.exe
"C:\Users\Admin\Desktop\Project\stub.exe"
1⤵
- Executes dropped EXE
PID:5760

C:\Users\Admin\Desktop\Project\PdrCryptor.exe
"C:\Users\Admin\Desktop\Project\PdrCryptor.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Users\Admin\Desktop\Project\WinSysHfelper.exe
"C:\Users\Admin\Desktop\Project\WinSysHfelper.exe"
1⤵
- Executes dropped EXE
PID:4584
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
  2⤵
  - Executes dropped EXE
  PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 105KB
SHA256 59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd
MD5 b954981a253f5e1ee25585037a0c5fee
SHA1 96566e5c591df1c740519371ee6953ac1dc6a13f
SHA512 6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531
SSDEEP 768:FoxKukh1SIfjcjKVbRZHqT9E1qYiHSzoOKyGi018e5xCwVxD+wb+WkOPMYC7:FoxKuOKKV9Z699S7Kyi1ZbF7iWBXK
TLSH
T147B3D8277E8E1371257201965F19A199E31090EF371F129538ED838C7F3A8A792F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 636KB
SHA256 7b08daee81a32f72dbc10c5163b4d10eb48da8bb7920e9253be296774029f4ef
MD5 1e86c3bfcc0688bdbe629ed007b184b0
SHA1 793fada637d0d462e3511af3ffaec26c33248fac
SHA512 4f8ae58bbf55acb13600217ed0eef09fa5f124682cedd2bfc489d83d921f609b66b0294d8450acb1a85d838adb0e8394dadf5282817dba576571e730704f43ac
SSDEEP 12288:CheO83S/X2oc1fZy4CArT0pLGbNUnaC7PeUnBd3X3uK:CheOIS/GzfZpopLGbNUL2UnBd3X39
TLSH
T17CD47C4AA7A813B9D0BBE17CC583460BE6B67C545371C7CF03A546AA1F277E0963B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 477KB
SHA256 f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c
MD5 4783f1a5f0bba7a6a40cb74bc8c41217
SHA1 a22b9dc8074296841a5a78ea41f0e2270f7b7ad7
SHA512 463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e
SSDEEP 12288:9Z5zraThq5dDnHEJt1kXm+wBhvBJ/+5IISY1A9h:9Z5n2hsdDnkGXm9Bhvn/+r1+h
TLSH
T1EEA4AE59A79409F8E8B7D23DC8A24607D6B23C558B31C38F03A6165B1F33691DF3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 45KB
SHA256 33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d
MD5 1c44c85fdab8e9c663405cd8e4c3dbbd
SHA1 74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88
SHA512 46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d
SSDEEP 384:cZIEmAyhs0z4NNVmF5OgUDBA2XCh9Iq1IAnUc9joBHLKp63xUA5B33vX6TBcxAfL:cZ41kVEbUDbwXic9p63Df3fXxuWJo4c
TLSH
T16C23B5237D9A127169B242952F166295F31861BF370B4284787C838C3F369A7D2F72F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 316KB
SHA256 997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344
MD5 6ca1bc8bfe8b929f448e1742dacb8e7f
SHA1 eca3e637db230fa179dcd6c6499bd7d616f211e8
SHA512 d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973
SSDEEP 6144:0HQbQuhUP/yv4J15/8Z0lIiFiDoQRkx79WftE+qby/919rRj+g8HR:JQuayv4V8ZMokx79WfGxI9LrPcR
TLSH
T1516412881D8E4132E0C8BD3AD4DD03DD67B5208A2A207F531E6F9676DAE2FCC9599731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.1MB
SHA256 3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3
MD5 53cf9bacc49c034e9e947d75ffab9224
SHA1 7db940c68d5d351e4948f26425cd9aee09b49b3f
SHA512 44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda
SSDEEP 49152:olh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlGBzNwui0hBdH3XK:oMgZeD+hBBquTBpnK
TLSH
T1D6E59F06A3FA06ADE0FBD278C956D903E77A7C090270A75F069055A72FBB360DE79311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 11a2c57b39a8f15f2df8e23da6420d46c964eeb2a57c512a71b06f0161c90036
MD5 3a51cfc27b167183d65c702a25a2e81d
SHA1 0842ca5b5484b9978667106cadbc5c3bceb35ebc
SHA512 4370c7669eabfe8dc030ed1baa72c7342278fa51099a7e82d30bc55e935787f95a4d5c97b06cf6ee147c42517fbe01a98291075ea1147034252fea5b7c3242a1
TLSH
T18FE02B69C821AC2708FD07589054064AE751235F2A91954F7A3D511CCFB062741C6CAC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 22KB
SHA256 40c97e11264cb1ac171847f410e85599e7ba7647e6dfe8d9d7f2c4b26d6ebb8f
MD5 6a9512d6b7d560ec8d28637f1f0ec189
SHA1 b0eb2fc3cc520974f84c177ebba34cd683646878
SHA512 a541189a3eb0ce250f32a5f01c92c100233922b9fe853e936c60b75e97c010929840aca21b204fe7ae3b4cadf380ab4f2134e9554328ba7ef7e105879546aeab
SSDEEP 384:H5OXeQD+vKTt/Ph2RWJFm8D8uX/ZfR7uCqCvoo99QKcvdnjaIfiHdLCU5SClv9L:H5cD+2tHhvJjIwBJaCqYrkhjfiH/5XlJ
TLSH
T120A2E1437C6FDE68803B92753156C173E412B239119633A3E303B76A95B850DFA59ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
Size 21KB
SHA256 2634df0d79333ea639d7079f566163bb700a57783d3a8f09061c6b11a8a78bcb
MD5 16fee8edf1a69e98d81813f19fffa56e
SHA1 9aada423702d320e5dd580c831a3de3da06129c1
SHA512 0ed3ea486c66383aa308222a5552b5837ec0527e9716d837d5f5cfade007790d7f0e7f622ba41c535cfea7f510d85675da400d84863e60577af238e918913714
SSDEEP 384:80VKnq7QTS0TNdGqzD1+x9FpWtSdJrZJSk49KqdIaKLIfMuMJdPPYp:Kq7ATNYqn1+nWtS3VJmKqdKAMJdPPYp
TLSH
T1BDA2E128696925E7C4FC8E8852D6602A2D415C39E8F3AF9FFD40977C0743B284C1B2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062
Size 77KB
SHA256 4cdd6ff54245c693b427b4cd85d49ba642a986776206a7dd7ce2bd98f46f132c
MD5 7f01956fe6d730b4acaf12af0ba8737f
SHA1 0fe7d55d02ed98da7a23b17901b8c73be2b4af5e
SHA512 00ec87939c83c476ffcf013637b8524280bdabb69d129286653965338bb8d4a7afab83e60a504b0a373e564421a0182008c32bd24ba29991ccbc37c6bb389e10
SSDEEP 1536:NP2s592NDeBSjmoC99ZbzzAYiIzxOaRq0+zuI8Jf2ow4Dh3tdhR:N9592ND5DYjHAtetI+RDh3fz
TLSH
T12173021CDB758A319CE043A56287C97170823618A5B6FE4872EFCFE0B2561DD6E63339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000063
Size 41KB
SHA256 60236d92c30d157d8d13110f6c99ee4a9fb65634308b8e031a04d781ca4ab421
MD5 0020ec074158326c7e55e8352efd7013
SHA1 3a9c0bcad7235a0d9e1036d69e136e8073c19651
SHA512 eb7f5a46425f75fd9a39c5c3d1e54e4952e3a63d76dac403bf6347709cf45fa882b57b69346c48d38c6884c39bb570e4ca83e0b80052cf04b2d66f7c8431f8fa
SSDEEP 768:aS1GIh+o3q6EIwDYsUe/O9A4bhaAcsB491RFd/EAB6im1SzxVAUYlVJ:aq9/EIwDBUe/yA6aMg1RFdqSdqVJ
TLSH
T1181302E276594F7F08F7A612ADA0E8978474FD0F6D5882363D320651D0196C3F46BBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bd91c57454c05012be53fda54ae5161aa3a6a92cbbb7abb2d4c91bb163e2ca3e
MD5 ec60887095f02f766512036dc9fbf459
SHA1 48369a7bdc89beb84e51ab2fa95a2536e7f4c33f
SHA512 6a0c6e04a10280520fc3a54881fae7180786e776540b2446b3a46a634428a79011ef518c3eda66c99366931f489755558ac4be7f893edcb16e91ad23a2e4a1cd
TLSH
T12E410C5070C9B632CFDC5FF624ADAD4A683C4C70CDBA971707993C859C83EF560205AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fadf0de39b73589d50826ed0e6b3a0d9ac90d2c0031754793072665d781f0683
MD5 69ead6fd6d2f56910188b192e265e346
SHA1 5e9a0b2d9e48ca0e211bf99ad6155be0c574eac2
SHA512 79edadfbf33bc451d5d2c26a5364dafaa8856da04be061418a87b7cac125e5cfe4b0a6e5be68308d081b32af0c0d1a22ab8e2b19db13171c7265d27465a4d3e8
TLSH
T197710E84A0CDA923DF9C8FF46CEC1C4775795CA5CF298B174B5A2D296C87AF46010671
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 316e38bd7381c20dd0c8051fe461e29d957d7028afb88d9485be0cfe9e604230
MD5 1e7a43a8fb7383aafcc78c064c27f075
SHA1 a157236f661726f2d1272a01d4e5ed467861e9ab
SHA512 a615caad7636cc54729f67f38030c4f3eec2c9e2aaa386ff95925e7051cec4d9aaf9409538356453a62937fef7ef7f29a185b1083b4858861c90da888876ce5b
TLSH
T10121AB11A0CD7031CFDC5FB62099AD8E247C1C34CABA5703078E3C5A8CC7EFAA024966
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 d6329c3a8c9bacf7145cf68e9fca79c3e968bae7bb6cadcbd22363f57afeb375
MD5 c598712e9e205bfc71c74c02e60b899f
SHA1 f67fca6bb99c33f7b67ef1ed6888ebcb326f4377
SHA512 bd14ab8e661143f95a73427e3bc576eed47ecbd53e9807607206d462a62e56042ae20553906f8de8b86c79caff48c1a1b033ca84b71d917a57d6dc1317986026
SSDEEP 384:D6Pmvm+De3z/KLBLHtkbSaaIYjoWVui3KGQm6dvYuWlG/xJmHRPlz8YAUWt2PjWr:xzNCVyg
TLSH
T1E3629FF7C2E8C52D885155F59B243E1ECE2D0919432C3C5AC9E9EF5BA7E2872E20065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 044be1769798c8955fce4d6954695762adb6795a85e60b52651dc91bbdd3bcd9
MD5 a3bbae2867d50098e348800d21673d59
SHA1 07553fa837e5c094db8bd53c9aa91e62011b1309
SHA512 e33bb3a7da0ff9e6311e35d259210c0b49d5c2e73aa78b3cd30e239b2f1716efc84f32a6f2f823c0400172acd818cd26fffa6d0abcce957faf74ad212021612d
SSDEEP 192:D6PmBJm+DeQuJz/KLBL7aaIYjoWVuiCwa1GQm6QUvYuWlGJVZfJmHRPlzBxGYAUf:D6Pmvm+De3z/KLBL7aaIYjoWVui3KGQg
TLSH
T193329EF7D2E4C52D885155F1A7243E2ECD2D0519421C3C9AC9E9EF5BA7E18B2E20075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 79cc0fb1a5a923476a2e93a133a690e900b10d63a87dd81c0f133716229b3911
MD5 51701f2aeeb4cab16e7fec77ce84435d
SHA1 1ce6c3cc8384fc657de5bf40e001b1565c023d62
SHA512 5f65ec35353257ac04804e066233242c3a26470754a4985f0bfb309b29a114882d83ca496c1499787b8562342e51edc6905d70710768b51ed140a380cbbe40e3
SSDEEP 384:D6Pmvm+De3z/KLBLHtkbqFyfLREZJvJDWBOado0h9aaIYjoWVui3KGQm6dvYuWlZ:fdYzL3dD+VCUzgd
TLSH
T1F9C2ADF7C3E8C52D885155F59B243E1ECE6D1A18422C3D6AC9E9FF4BA3E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 22923b0c92d2bf07e60fa37690ee5fd4ab7e18546171d46cf8ec735f5ebae1e8
MD5 559128de215899497cc3a52ebd305ff5
SHA1 a5636620a3d82ceeedf9377305fe6364a2c4472d
SHA512 1f018d20d7ce14822694dec4e722ab933a1378b55644d960ed893bc3bac3d9f28558e0cacfe1a8b5c6cb74c958bc1dca32bd5fa64df8c9e96bc611af3dfa5c2d
TLSH
T180517DA7D5BEB46720BE8DAF1D05B80E657EF83502C158F4EE9A917CB0829B31B02512
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cd65df691446548ee493c0f68bbecf80563ee96116e935542af285cab6eff2a
MD5 62bbada0d7beb12703b002c85995df4a
SHA1 4f332b9488e916288cfa28813a958e846022ca16
SHA512 6f7d13e15b7d35ba3c085fbee5bcc2635990b24cc5a3e132aa4d65e58e098abf79dc4466a2363942c2dc299be29ce7c014cb94f37352c998127ea05d897a2f67
SSDEEP 192:iReF/TMcjlrjv7spAPRp22zV9wHsb+WNnLokeF2o22UPS9kwoOwlVyIsnAUge:iReF7zbYUX/5Kw8r272UPS9IBe
TLSH
T1BB42D62EF954693B5CCBD229F9627B67D7F5103161802E84EAFC892C15EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c48d1f3e5c8506a98e022d6f7fc9cb6e31d8284d308d71cd917bc82fd43e71d6
MD5 fab7494ffb34141ee654f27350364796
SHA1 b66e446fe16e054f384b58e3836e6021095a8933
SHA512 55d74b319fcbc691dd5f39f8eb7b70a90f48f5016b11fe275c286eb8fca2bdba82a09997c8dd3c4f692a471d839c2f14673ed054aaaa5dab9458167e7f667c8e
SSDEEP 192:3RBcBz5/TMcjl9jv7sMwPRpK23SgQNC9wHsb+WNj2zYBco4eF2d022UPS9kwoOVy:3RBmz57lbYJXbXKw1Fn2dH2UPS9IQe
TLSH
T10862B52EB854693B5CDBD229F952BB27D7F1103162906E84EAFC8D2C15EB9CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 78e4ae4cc01d4d2cb0acb2420fded0b4d3668488866ffc6a31257d45f4bb2a8c
MD5 d9017fab0fa9574872e4b4714a7d9354
SHA1 f6122aec5a7984c19e1bdc6cdc0832ff99eed5fe
SHA512 6812036f0988abd3011b88983b775562e7bd27a8121819f2ee5cb36faa4c5bcb2975b5cf8e0298424cf51c03a057d4acd289873da91ba48cdfe71cb8b5162df6
SSDEEP 192:3Rd5/TMcjl9jv7sMAPRp223vE9wHsb+WNnzY7eF2f22UPS9kwoOwlVyIsnAUgtaJ:3Rd57lbYtX/sKwsc2+2UPS9IB8
TLSH
T19E52E62EF954693B5CDBD229F9627B67D7F1103161802E84EAFC892C15EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b5de17396fc6aaa7f19d6df2bd490bf9433a8348c256a58ed485937011b758a2
MD5 73c5cd75c18c16141adc8288e17c5b05
SHA1 453e0b22304c51c37fc5620c0b916004d93a1b96
SHA512 015d8f749a1f0da8fb838398a949790c507339d381deb1ee1cb58d54059518ee6c4aba70679563e22d64438d54c5714dfa869d2d5b7781d065a6b55ba66d9752
SSDEEP 192:3RgCcBz5/TMcjlQjv7sMwPRpK23SgQNC9wHsb+WNj2zYBco4eFTx12A022UPS9kb:3RgCmz57YbYJXbXKw1Fnj2AH2UPS9IQe
TLSH
T12C62C66FB814293B5CDBD229F962BB27D7F1102166906E84EAFC8D2C15EB9CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 501a450d71c97d4ed0c03ca0cc680bdd3a64657639607888c37107b076471e6f
MD5 165b2a585f1cb6ace3d506ad065d76b9
SHA1 e4bd3a2a016aefbd6b330bd23ee9d98f416f9008
SHA512 456540dce14a0c5695eb1cc26c69546b4240395213f8ff07476e21121a397688f928f868872e5aba51883024a2b5602f3b5faf4d2f49a22b6a3295e9a1065933
SSDEEP 192:URgCcBz5/TMcjlQjv7sVwPRpK23SMrNJ9wHsb+WNj2TB1EakeFTqgbd022UPS9kb:URgCmz57YbYMXbTKw8brpbdH2UPS9IQe
TLSH
T1AD62C62BB864693B5CDBD229F9627B27D7F1103161905E84EAFC8E2C15EBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 f9f6922c0bd5d2cf37249ab6cb0ded9aa5cd4879098d3b740a41601326d16d4d
MD5 a0249ae5e15ba12d037f3947dde14e5a
SHA1 ab17088feb61d53c5d66bf4d6912bc5ea0da226f
SHA512 857d4ae3b69eb2c64bec41be86837f366321017d61da1b41d7780036093cdcf39d43b2887a389d1ee23b6f5c8227f41afa40964e10adee6cadb9f52bde8407d2
SSDEEP 192:URgCcBz5/TMcjlQjv7pVwPRpK23mgM2UNJ9wHsb+WNF5TB1EakeFTqgbd022UPSi:URgCmz57Yb1MXbkKwZbrpbdH2UPS9IQe
TLSH
T13F62D72BB864693B5CDBD229F961BB2BD7F1103161805E84EAFC8D2C15EBACC3213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 82926bbc227a12fcc2025d59431481f3db32975fef0fbccdafc20d808e8c8718
MD5 4f4f040b5532fbc6148091cc664abcca
SHA1 11fc4c577b6d9546b0a30f2b3cae691b73c93093
SHA512 cb61705440b9f2406123965e6efcedec9fd6c3e0ce9a0376bf86e53265be52e3dc46daddf7d31d38442af6658da0bd65fc2553d92ddb4bbac9b3774c0eb40d85
SSDEEP 192:URgCcBz5kTMcjlQjv7pVwPRpK23mgM2ONJ9wHsb+WNF5TB1EakeFTqgbd022UPSi:URgCmz5aYb1MXbuKwZbrpbdH2UPS9IQe
TLSH
T1DB62E72BB864693B5CDBD229F9517B2BD7F1103161915E84EAFC8E2C15EBACC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 98b0b2aa35a4a36cf6288d52b255320412e36e8fb6151acdb9a70a150e007817
MD5 b3bfccff66dc95f578b4e2cbc1555c60
SHA1 0425e86e2bfd68917e45ce11930ae58b9d17f9f0
SHA512 d27c0c03a6e8c97f6b3d6c84d49c140cc8ccfea7a629f08ef0a9dda5a232887510307c14e09c2f76b7bd8b084e916b98640c624e2435e86a6a661ce4ba6d5baa
SSDEEP 192:URgCcBzAkTMcjlQjv7pVwPRpK23mgM2ONJ9wHsb+WNF5TB1EakeFTqgbd022UPSi:URgCmzAaYb1MXbuKwZbrpbdH2UPS9IQe
TLSH
T1DF62E72BB864693B5CDBD229F951BB2BD7F1103161915E84EAFC8E2C15EB6CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 c4ddd2b6596157d1ac3417ad331750de3ce05a722ca43c3a863b726ff28abf7e
MD5 64a04eb1ab4f555abb0d8bcd73e0dbc6
SHA1 831574aa1e0e4f64c9053c04d6c92abd0ead4c5f
SHA512 d4ccd841ea713244ab4c928c789b3310fb10b47a08cf67fab43bf6c3df731a858592b246159dfd6dbd9849d949e2b1f3a0bde1794e9ff5ea527151642fa535d2
SSDEEP 384:URgCmzAahHb1MXb/KwZbrpbdH2UPS9IQe:2mzA2ZyKw7dH2g
TLSH
T1BE62E72BB864693B5CDBD229F951BB2BD7F1103161915E84EAFC8E2C15EB6CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 737d260a3369b3a8e9c337df053f8a8101b533249f533f9fdcecc787d0c64d4d
MD5 ce8ec3079e796d6de9e615741067dc47
SHA1 baba1671aa50424cf3bfca58f8ea2b4445e9d6d0
SHA512 9f454985d26cfb249a1b2664a39689b63e0373302e1d7be1792246ebe7b7a662f0b8ba7b4a70deab3d1b91150e3a148f98a235975e888884a0cb1ff034b4720b
TLSH
T1CEB012608002D502C01202F422CB1888B1549F10D60A174153F06D63C8267A0C5183D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e8f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e8f.TMP
Size 96B
SHA256 8c7cb13cc374febe6dbd8519dad9013f596404847c3670133ee799add3b2be25
MD5 762460f1df1e7044266fccbd71189ad1
SHA1 8e2e1d95bc4334bb83d06a3d0d1a319869a101dd
SHA512 1fb93a921e061280a61a46ba946ca8055420a365d3e83450e2e7de84404d9d54c0e09cfbd0d329742a4406852dc22db4e137a3769ef2487c651ca14191367e33
TLSH
T140B002A7D1536213C05303B03AA5D5DCB160DF26DA03166AA2E11E6ADC25E7055355B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c3c98aca1496b4150e45bb2f8b9d4442690c942ea8e262205cc47b5d9531f974
MD5 51d9845487d9c7ac385582ffb60f9f9d
SHA1 7613e1f7f1a138eb190dfe24bfc69f24ee9220cf
SHA512 7fbdaeaf11ede37ddffa4895959899f820f215a3cf04aed6c3d8076163f017fbfa82c62f7eaa805fbc740c2408ba82bc2a0c4c1ffcaa9f5a0540f51f8c181a19
TLSH
T147B00214FA405126C00E23B8B0E3ED8533390C36139E129294E52D69982E68855174C7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 2c0e63b3e69373eab19c0470e4addcdb93cfe4cdd4ec98b94c9969d246dc9009
MD5 787ddbbd4cdbd75d5d37166bed899387
SHA1 c1ebb7c4eed1dabbb5a49a290d7ab6a12aa4034b
SHA512 03a524352641b7b73cdd43dc1b511ea04fcd625a2acfc5c156c062f23da8a7b5ace0e86d2e0fd79b10d4899a537c0cbad3bb92ef1162f6d2b348b7273c6ebfa8
TLSH
T18AC09BD32815C55B8E71EDDC115CB63DD92B934C9CC4CDECD44455562074E37C44193C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 234B
SHA256 7e3b7f77e0b2a4ce76c323df1aeb16dce6180af1b4fbeb2e8687215c9f6ee3ad
MD5 71058d426427d138b5fb02113d1778d3
SHA1 2304c32ddd04b05bf766d23386fae4e4a00c708f
SHA512 2010df2076fa44209d2fa383df24368192719264641df31ffdb40aa2be85d949c63749f666f8ab203f2e89296e032c1ba9e1c1f4ab1c23d45ca324bb31f5533f
TLSH
T1E2D0A7D36431D8579B39ADA51168B12D942A6E199C88DDECC825755620B4622D082978
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a496e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a496e.TMP
Size 157B
SHA256 bed9e8ffe6aba39b46f1495af68d4ef274cd1caa0c0bd9d13a0c876edf11ec66
MD5 df4ee415db03b8a133f445ee06093241
SHA1 01cac5ae975d81d8c1549472a82c20c2fc57b935
SHA512 6cf0bdde525bc4636ce396a89fb7a07f7521949fb2d298db8cc3a2756481ce95742db4b0f1c17d51c8d2a333b2a53dc088268788f8a0c2aad6b8b8a2ebe9f087
TLSH
T1E1C08CD3282148474B71A8C81028B22DC82B9E0C8CC4CCE8840634022074A338040938
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 232206e7c0a9058a4fb128be83230d218aba8021316c098d040d5d1df3c6ffb9
MD5 d0dd9dac14789638cc5c7ae552b05ca8
SHA1 6e6d18307d00383f446eb3087bcdb835fad91db4
SHA512 6516846dc11a0389518d191482cda27f3441fecd8a12957d3ad0b8d51df0deb539ed89ec1157d1e041edf1621aba28f91e3fae2090cf7d12cae49c2dcc23b841
SSDEEP 6144:3l6YeHps/4uhJPiYnMm60tjSVm7Rkm1tYpBeh2BAo6:kTps/4uzznMm60tuc9oBGcAo6
TLSH
T1333412338C6AFC3759A6B74A604E16171DF14DA2C8689D9EDCD92E04B3AFB890E15930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 35ceea80e11f05cd3c6d0798dbfeecdcb64dd67a43d00b8adedf6c53f00ce7f8
MD5 be6f446453afbc6e6c1b10061b3bc4bc
SHA1 62819d26ecab16a4b18d4c7a5473d337f4e8a4c9
SHA512 ca02379f99dfe20997b30478a55573cbb081d96242de73762b2c301661ecd61313e1f94c78fd82c0811f8ba857e07d923595f2cad1749d4fbbe0cc1223b8bfda
SSDEEP 6144:Gl6YeHps/4uhJPiYnMm60tjSVm7Rkm1tYpBeh2BAo6:9Tps/4uzznMm60tuc9oBGcAo6
TLSH
T1563412338C6AFC3759A6B74A604E16171DF14DA2C8689D9EDCD92E04B3AFB890A15930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b6711df5cdda3749bca695395e67cdabbf9fca718aedbd247f8a6520f0b7f21c
MD5 2f01385e228b503083fbd25b58ae3a59
SHA1 e528b8908a680f1923ba54f7a2a78332a7ceebf3
SHA512 e0730aeb430af66fc446ee0e3c1386ad33888e7411b0e374b6b3a34329453492aff8517db9ec8e371323d922bfc83d98e37f49f92296c3304b869ad658feeffc
SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Um7Rkm1tYpBeh2BAoK
TLSH
T11BC3123B5D65E8779979B70EB08E0B1F1EF149A2D920DE92C8D86A0477EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8d6e2b8c171f9b99b5b87853ecb34820c1069808d69aa160e74e877affb41338
MD5 6ec330608684c79a3881afcbd43de01d
SHA1 29b94929389d38f5ac6858e3297a43207f96df4b
SHA512 f79f95dc6ca7bfc4d53f26aed3ad4fa13fdab9c8a4a71ec543d262ad3f2273601fc674aa2b9506a72d9b761b0a190b86c6587708b757c5d35e8f2496a94f0f5a
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:um7Rkm1tYpBeh2BAoj
TLSH
T108C312375D65B83759B5BB5EB04E0A1F1EF149A6D920DE92C8D85B0823EA7CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 65655fbc75e76fd473a8661b096303854dcfe14d33989bb20ef9c636e4746cb8
MD5 6c6897f2792e5202881470801df002ed
SHA1 1ece437eb9a5584b3a4ed165bceada3e291d756e
SHA512 cffff66e7e98841b5e2b679d57a116c6c8621eb82dd6f26599df450eb0f54aa3e4103feae297a11e480392edd807e29cfbc25e75527a8769ab4ed9284b4ba627
SSDEEP 6144:p6YeHps/4uhJPiYnMm60tjSVm7Rkm1tYpBeh2BAo6:ITps/4uzznMm60tuc9oBGcAo6
TLSH
T1313413338C6AFC37596AF74B604E1B171DB24CA1C8685DAACDD91E04B3BEBC90A55D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 bcc4395f52c2babd56c9d4dc601287ef4a9a80c5d8db9a3a8cf5e32563e63383
MD5 dc7c03f6fa5dac27fd17c7c530b7ce91
SHA1 914dca195da76337ae4049785021192fa9c1c0a7
SHA512 872bb1d3775f999f4d35fdd6e09ba5d145daa1ba1e1c06fbe1ae0750e7219c72c783000b1344ac9c1128afb0157a03e4c447973c81186d900681ac0794f18a9a
SSDEEP 6144:26YeHps/4uhJPiYnMm60tjSVm7Rkm1tYpBeh2BAo6:1Tps/4uzznMm60tuc9oBGcAo6
TLSH
T1453413338C6AFC37596AF74B604E1B171DB24CA1C4685DAACDD91E04B3BEBC90A55D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 df8a0a5733429cc7918de66fdec2f7de9f435546d917eb3b2c05ad194d2fcb6e
MD5 183704f8ba3d418e5d7a829df50cd0bd
SHA1 4bea252fb1fc3cf2703d0d5ba900238c2fefad96
SHA512 fa86f76c787ff059dccd086ff38c43a652298356ce39fd19cc05a47dd4653d42451af764c593e30cf764fd1979885385b96faa7e6eadbfa031f34f5b26b7dc25
SSDEEP 6144:FW6YeHps/4uhJPiYnMm60tjSVm7Rkm1tYpBeh2BAo6:TTps/4uzznMm60tuc9oBGcAo6
TLSH
T1C93412338C6AFC3759A6F74E604E16171DF14DA2C8689D9EDCD92E04B3AFB890E15930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Program.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
Size 3.9MB
SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
MD5 e7107300d20c25a5253022fe6b1e04cf
SHA1 8cf0ad044769d9199a0c53e1b0d471ca081cd475
SHA512 b7cb6dfb60e983bc07e3bedb35296f88d46ce33273ed80b039a93a0391a9f0e90e255dea0eb9805df731d87938d61d70a4635de40e221dfdc005dd0bba9778f9
SSDEEP 49152:5udQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:rijnUdYd+RaAj
TLSH
T170164903B29940D8D049D074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ca4cdad24b3d7763bcec8fd8edf9d0830f807f37994356bb9d79777f2dbde56
MD5 590cbb37d8380d1c6b9b037cca27326c
SHA1 90175bac74c94711187745acbc32eca8878e09e9
SHA512 adfa77358f728f775096892e0b8e25a3d3be7772e7834cfbb298bcefc04562d72b2cac0a6e16bb7949659af3ad7cb3042becd97ff0de8618368c393bf4772993
TLSH
T150D0121272114135C41032330222752C0904C20F810AC0006C2C899D3F050900D06443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e231dedf0a927b5b20ac168d20a3056b5a09d78ffd1a783cc9d18f9ae3f557d1
MD5 0150faaa36f09bae2e8178c631cc560c
SHA1 f05141fe59c844b3e179bf7b3ecedaf3c912db15
SHA512 290054c14bc8d1976388c72af5a20e5418bf44bf67349e5ff5f4aa6f910b5922f4ed4f2554e616e0e881c4950595ad3e2048d34d75a18ee05b47ab6abc645728
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 b487d660109a31650798c5fab8b978a9e362326828156613ca6b4d584dcfea6f
MD5 7827f0042f37c5561f142b3bc19a83d6
SHA1 64891bcc17a4730b1810d9f58ce1a46868538345
SHA512 36a754bb4f4c591ee89918883a8bfe89b3f8bb1da7115fcb0ffe7a2fa003bde1c2072cc41a118c096866a041fbc4e02fb131f0dbdda49373c41e6c58169125fc
TLSH
T180214272C8D82A765985B8A9B1067B879E60517A92A48F08B4ED433802DF19C9736C72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 9d3b23ff14ee99be1ede0a6230b9fbe936158d218cd8a23fa0f7369c99ae760c
MD5 9e5c8e0581eee4fc0d75a94212fbb7b0
SHA1 2ae1526f75a2b6879ba5956163d8eccbf34b0d3b
SHA512 fb63a5e0f7d5eab8616a8620b75d7056df121ba98158596cb287d4e2ea423a6ba0af7b6aaf5f393baf09164b76f95cd647efbabf28d908be14b996c6cb0890b0
TLSH
T1D63165B2D8D42F365CC2B99971067B979E70207AC1A48F48B4ED473C02DB18C9636D36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 4e5c177e951a639220850657e32f0aeb34f1d07e962907a64f6c27fd51eb3de2
MD5 12a20e805d1ceb63db5b2f437a9b935b
SHA1 d83f00cf05211f1db0ec432f748b2d402bd4ecdd
SHA512 3ba30d272fbe28d59d30f2e6e8eef9f457eacc145b75505647449663b83c7c0d6a948f24e37332000d66102e97d596433ae50cf564973f58152ab1480c58499e
TLSH
T13551C573A8586F3B49E3B958754A3F53EA346175D6A26F50B8ED0B2C02DF25C2312C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 e984db635be6e5f2e49fb4fb107ef536e63c7cae864e38df819800842ed3dbfe
MD5 878a184b22ea7f1442ec705f313181d2
SHA1 8d47e32d5386e226073e31d1640841f8e841f2a6
SHA512 8d497722c335bbb151d791bacfc1e5987ec42072212f6e12aa986205236fc3fdcf2f357cb2eeab565cc5f09babdd66a62afd30330877d050c08de5d22e876544
TLSH
T170719532A9A4AA3B4DE2A959B48A3B13B7A45137D5D57F94E9EC0F1C02DB2881312C16
MD5 SHA1 SHA512 TLSH

Submit Download

e4c249c9-8e9a-49e4-81d3-54b3acff93a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\e4c249c9-8e9a-49e4-81d3-54b3acff93a1.tmp
Size 3KB
SHA256 c90af44e2e548e7396d302515e6cc1b0fcbedd3c4e968c4e9b7033d4e2e8fff2
MD5 d66011079b45fba7061ea0f6cb414c2e
SHA1 eeea37d1c68d2b37ab5f18495fe82e390036815d
SHA512 395508a5fc0a9de18f68a3582f39e79e670a97c1e9d48a96e415a744eb7380ea9e2be755deffb39727f1961e7786089cbfe99e1649b26192bb7f47c536167b97
TLSH
T1ED81A73298A4AA374DE3E949B58A3B03A7B45137D5D57F94EDEC0F1C02DB2981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

PdrCryptor.exe

Path C:\Users\Admin\Desktop\Project\PdrCryptor.exe
Size 144KB
SHA256 37e96f6c0ea7f42f51e7b4e77640e9ce0ae1613d7b6b39713c9f2de5abb21bae
MD5 87146f98847b5da72fe35d541cf881f8
SHA1 adb7d07fbe9b08526c2aa5f35a077ff9240abaf1
SHA512 70f4022d0c9952a879a5d69369de4c72b89687ff9c9e8aade96ebf74aa3d5156ae4691c0c7d750f3fb4246ea1c27cd0a65fc6bc89947008010b7112eac1438d7
SSDEEP 3072:VlCh7Qp9AOwL1wwtJ1SYE2X0lkHNxX2OuLpULeAcJ:6hQfqENkHz2OuLse
TLSH
T164E312E27396CE13D93E323224568588A3FAB045E069DDBA0DC452DA3D53F3129D5F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSysHelper.exe

Path C:\Users\Admin\Desktop\Project\WinSysHelper.exe
Size 9.7MB
SHA256 e59852ab9de67e796dffdb80e76b02569eb38d0ea7fc84b9bfc3245989f4bd98
MD5 fad244b67359190d07376aae3dda1963
SHA1 8bad61fba6a3d024d82ff519b0a21db023c2fdab
SHA512 bc2ff0dc5ce31310beec7f81368545cddb1407307ac47a0248f2d7d42e2a5bff245e0c10dd589197f003972c3faf3a82527f66fa267bd2b2ae21c596346c7595
SSDEEP 196608:n9wZMgtgMIFGt34yb0fTjVhTHfwE3yewxxX5Vn5/7UdiqoVxCuiilB:nSZMugvFG7bIPfN3yVnP5/wduDii/
TLSH
T1C5A6D0B5A4AE64F0C58FBA72D935795BDB3528224F5621EB07143E800EB3395CDB8F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub.exe

Path C:\Users\Admin\Desktop\Project\stub.exe
Size 1.9MB
SHA256 edf267fd7123769864c4f3d0d757f05c040be42cf8b29586f67f7b4b5b9d339e
MD5 d90b1a963b592dbf72eb3366817d24a6
SHA1 45773e2efe7f455724dbfb95171d18ffd4068eac
SHA512 773a21cbacd3f84aec8bbfb0e32e6e4986f2b54c6d8a7c88d476cfcf2a0904be9114a388e436f8a9b8ec2160d46c3cc73024b4431105eaa3b8a393c232897aeb
SSDEEP 24576:nhvZem5tTBKBzHryCpHaRKhFTTRLyI8ANkh22t2MdPPDFjMSk:nhBftTBKtLydKhR8Nt2OMh
TLSH
T1F6955C17FCA129F5C0AEA6314D7652927B71BC491F3223DB2A90B6782F72BD06D74704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdrcryptor.zip

Path C:\Users\Admin\Downloads\Pdrcryptor.zip
Size 967KB
SHA256 ba9bd3f0d5f04f3ea3a257ae6c0177e483071696e5572c6c3c34f4c2b3fbc905
MD5 0f3e7eb0aa149f4cbcd79ac129d81651
SHA1 051185b5aaaacfe1b06a7d7591fe6fea86460e30
SHA512 b7b556b3a1be701fea6b3a015343bf6ce295d3f12c68292abd51b7ecbdf593cb86c7c7cd463e3e80b0bea73e150e7f9232dca3b1280aa1ce67fa6714bfa55207
SSDEEP 24576:2AxrKtUdDvH0F+HydPpbmifYn2KY3aGn4vkUBnNgAsZQS40q:WWvJUpbdS2Sq4cUBnNgHjq
TLSH
T1D525338041AD37A0625C055DBAB6AB161FC6CB9FE3B574D0B94A4183D207E3DF3B1AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 658593.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 658593.crdownload
Size 3.8MB
SHA256 c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
MD5 46c17c999744470b689331f41eab7df1
SHA1 b8a63127df6a87d333061c622220d6d70ed80f7c
SHA512 4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
SSDEEP 98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
TLSH
T18206231AF7A904F5D077E178C9A34607E6727C9D4771928F23E60A492F277909E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2072-1391-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1392-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1398-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1399-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1400-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1401-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1403-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1402-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1393-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/2072-1397-0x000001E0A5000000-0x000001E0A5001000-memory.dmp

Download

memory/4844-956-0x00007FFA203F0000-0x00007FFA203F1000-memory.dmp

Download

memory/5200-1006-0x00007FFA213D0000-0x00007FFA213D1000-memory.dmp

Download

memory/5200-1007-0x00007FFA1FDA0000-0x00007FFA1FDA1000-memory.dmp

Download

memory/5752-1077-0x00007FFA203F0000-0x00007FFA203F1000-memory.dmp

Download

memory/5784-1253-0x00000000057C0000-0x00000000057CA000-memory.dmp

Download

memory/5784-1250-0x0000000000C10000-0x0000000000C3A000-memory.dmp

Download

memory/5784-1251-0x0000000005B10000-0x00000000060B4000-memory.dmp

Download

memory/5784-1252-0x0000000005610000-0x00000000056A2000-memory.dmp

Download