377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.exe
Size 3.4MB
Sample260823-ewgnpssfle
SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
MD5 15596b41dba42cdcce4f677fbbc86b6e
SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
TLSH
T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
128	camo.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	.exe
File created	C:\Program Files\WinRAR\License.txt	.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	.exe
File created	C:\Program Files\WinRAR\Descript.ion	.exe
File created	C:\Program Files\WinRAR\Rar.txt	.exe
File created	C:\Program Files\WinRAR\7zxa.dll	.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	.exe
File created	C:\Program Files\WinRAR\Rar.exe	.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	.exe
File created	C:\Program Files\WinRAR\Order.htm	.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	.exe
File created	C:\Program Files\WinRAR\RarExt.dll	.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	.exe
File created	C:\Program Files\WinRAR\Zip.SFX	.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	.exe
File created	C:\Program Files\WinRAR\Default.SFX	.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	.exe
File created	C:\Program Files\WinRAR\Default64.SFX	.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240673656	.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	.exe
File created	C:\Program Files\WinRAR\Resources.pri	.exe
File opened for modification	C:\Program Files\WinRAR	.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	.exe

Executes dropped EXE 3 IoCs

pid	Process
3624	uninstall.exe
5844	WinRAR.exe
3700	neobloxBootstrapper.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinRAR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neobloxBootstrapper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2148	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319322787700704"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r28	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r20	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5844	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
4220	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
5844	WinRAR.exe
5844	WinRAR.exe
5844	WinRAR.exe
5844	WinRAR.exe
5844	WinRAR.exe
5844	WinRAR.exe
5844	WinRAR.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1236	.exe
1236	.exe
3624	uninstall.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3624	1236	.exe	88
PID 3760 wrote to memory of 4636	3760	chrome.exe	103
PID 3760 wrote to memory of 2148	3760	chrome.exe	104
PID 3760 wrote to memory of 2532	3760	chrome.exe	105
PID 3760 wrote to memory of 2532	3760	chrome.exe	105
PID 3760 wrote to memory of 2920	3760	chrome.exe	106
PID 3760 wrote to memory of 2920	3760	chrome.exe	106
PID 3760 wrote to memory of 3920	3760	chrome.exe	108
PID 3760 wrote to memory of 2720	3760	chrome.exe	109
PID 3760 wrote to memory of 3920	3760	chrome.exe	108
PID 3760 wrote to memory of 2720	3760	chrome.exe	109
PID 3760 wrote to memory of 4152	3760	chrome.exe	110
PID 3760 wrote to memory of 4152	3760	chrome.exe	110
PID 3760 wrote to memory of 3460	3760	chrome.exe	111
PID 3760 wrote to memory of 3460	3760	chrome.exe	111
PID 3760 wrote to memory of 1152	3760	chrome.exe	112
PID 3760 wrote to memory of 716	3760	chrome.exe	114
PID 3760 wrote to memory of 716	3760	chrome.exe	114
PID 3760 wrote to memory of 3788	3760	chrome.exe	115
PID 3760 wrote to memory of 3788	3760	chrome.exe	115
PID 3760 wrote to memory of 800	3760	chrome.exe	116
PID 3760 wrote to memory of 800	3760	chrome.exe	116
PID 3760 wrote to memory of 5404	3760	chrome.exe	117
PID 3760 wrote to memory of 5412	3760	chrome.exe	118
PID 3760 wrote to memory of 5420	3760	chrome.exe	119
PID 3760 wrote to memory of 376	3760	chrome.exe	120
PID 3760 wrote to memory of 5844	3760	chrome.exe	121
PID 5844 wrote to memory of 4220	5844	WinRAR.exe	122
PID 4220 wrote to memory of 1008	4220	msedgewebview2.exe	123
PID 4220 wrote to memory of 5256	4220	msedgewebview2.exe	124
PID 4220 wrote to memory of 5256	4220	msedgewebview2.exe	124
PID 4220 wrote to memory of 5256	4220	msedgewebview2.exe	124
PID 4220 wrote to memory of 5304	4220	msedgewebview2.exe	125
PID 4220 wrote to memory of 1768	4220	msedgewebview2.exe	126
PID 4220 wrote to memory of 1768	4220	msedgewebview2.exe	126
PID 4220 wrote to memory of 5604	4220	msedgewebview2.exe	127
PID 4220 wrote to memory of 5604	4220	msedgewebview2.exe	127
PID 4220 wrote to memory of 5604	4220	msedgewebview2.exe	127
PID 5844 wrote to memory of 3700	5844	WinRAR.exe	128

C:\Users\Admin\AppData\Local\Temp\.exe
"C:\Users\Admin\AppData\Local\Temp\.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x78,0x124,0x7ffe4c8dc728,0x7ffe4c8dc734,0x7ffe4c8dc740
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17512928287903812079,9108480299748541878,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,18100410985932350827,15227479604436059211,262144 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,2701998298233911807,5549066159796883472,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5750759019048557961,15547176711680941706,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,9109902127866577706,12196005731499324095,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,2074459131033422365,15945470564746913553,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,11708583939143371373,3236987225832494730,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,4943876379556315474,15490847410996608347,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5908,i,1398372135054184360,14877710365919936970,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3544,i,10601959399642907873,2005176764975654208,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5924,i,3762090519558193528,3931498502701936484,2097152 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,17761468054122430194,9486371897705456773,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,2653164104304814404,11052713106960258416,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,18294479135551915440,5416814339747731913,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,15060798008392483138,17657135412145400813,524288 --field-trial-handle=1968,i,2570711659138005996,8418080796645898266,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Neoblox.Bootstrapper.zip"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=6.24.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5844.3680.7167042318648004412
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x180,0x184,0x188,0x158,0x190,0x7ffe4b51b078,0x7ffe4b51b084,0x7ffe4b51b090
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1768,i,7755478326219658357,8356071094047460283,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2084,i,7755478326219658357,8356071094047460283,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2420,i,7755478326219658357,8356071094047460283,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3620,i,7755478326219658357,8356071094047460283,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Rar$EXa5844.41851\Neoblox Bootstrapper\neobloxBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Rar$EXa5844.41851\Neoblox Bootstrapper\neobloxBootstrapper.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 109KB
SHA256 59334a8ffff612755a64a912389bc23fbc35933cf209f845bde34f055011b8a6
MD5 b689a0cb8c288849febffafc2144576b
SHA1 4cba85fa8ac528c3ac0af6356cdb912a0ae4199b
SHA512 63e3dcae9a5a7373b7f5fdd661ae624a27e8f72ca86cb1be91533575ae115cf874bc0785350f00e919694b36b4745e6fa581252ec0d8a9ba2a99cef20e26b247
SSDEEP 768:doxKukh1SIfjcjKJUjnc4JRb+aT9E1qYiHSGot7uj5dKiu18ewxJfkIjxDftKWkH:doxKuOKKi9bbR99S5c61Q7MaF1KWB4r
TLSH
T133B3D8277E8E1371297241965F19A199E31050EF371E129538EDC38C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 429KB
SHA256 fd934c3b663679041b82c12d60b14c51060d8d04742612ed5f9cfa82cccf1d37
MD5 8e1a194cdb986b277e44afbf419d0bd7
SHA1 c6a46bfb7e829fc710fbe668900a80efdff9c36e
SHA512 3e64edeed5e50927e1c758e9788be5778af2ad3c52ee1cebf19dd020fe2378f2bf375f0a65bc87c3ffb4c3dc13133b4f9cd3f7d627310011e1325c1073634fa1
SSDEEP 12288:gSXiav7Nwt8OVYPqo3YlgaAjvwBhvBJ/+5IISY1AE7:bS4qiYlFAjoBhvn/+r1z7
TLSH
T16694BE5863E80CF8E9B7923DCCA28616E6727C524B30C79F0761165B5F33690EE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 105KB
SHA256 bf30a7d667b61a90bc00908317d96599386c841759540bdb74ca249e28ec8624
MD5 c78a76e698514a835452de89025b7778
SHA1 091869306172f2b6fab1cd47ed2d4bbf1527321c
SHA512 8696a6c11534b588a6feda356d2f9d9ee92547fb95e899490b3f355d08fecae73fc494a7817d5ad29924c7e9e61072a963aa6e59d3724145ecd3bfdd26495f9e
SSDEEP 1536:owXicDYb3fXxuqo3t5Vb5dMJeKLCD0TAXNG/MNWM9Lmh5BuM:tiSs5OFS40TCRyuM
TLSH
T1FCB3B6237E5A127229B242826F156256F318A1BF270642C47D7D838C7F36997D2F72F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 317KB
SHA256 9d96fddee6df94a3b6bfa731e962d31fedd4d8123aaf29c231b06f0cc10a2b2d
MD5 6bd7d6deb6aa6c798e6e011b7eee9838
SHA1 6766b040128e1a364e8f9f877b6ed18f37b878ce
SHA512 8e422346cf91d4757310919a6abe67ccff60dc84ef572d76fd8863bd2201dbc1c27377c382b4bdbc71c2a2f866eb1604f01fcb0d979594c22c43cd2db8877342
SSDEEP 6144:DOmlAJDCI/uXnxAzZYuY9Qyt7KnTQiEo4LaBfDBjU/4ftmueyUF:ZlAJ7+nxWYR97Knc1WFgwfw4UF
TLSH
T1796412199D6D4073FEC93D39E8EEB3EC775A04920655BA5A2A4F8D3060D8FCE2398711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 2.4MB
SHA256 0d068a6aa2df88613e1c5c7ba412a5a5bc3cadc3f3ab4b76d10035ba8eec27bf
MD5 928b05a72bdc940c450f059902691501
SHA1 7931b85054c29be4cc3c9250a5dc4a821a446040
SHA512 de47b4f9065bec41671f17f0fdd33d324e9204f323fea863774952ceaa05f17106c46ddc118c15a2fdb75d1313b6cc91b430357fa3a11d13355869507d075788
SSDEEP 49152:mlLEkH4q8hy1JWFeIrk/agsMod2ZPybt+9ZjeLBzNwui0hBdH30U:44q8hyyCX6LBquTBpkU
TLSH
T169C5AF4663E840E8D0B7D778CA669617EBB17C525F30CB9F11A1998E1F337A09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarext.dll

Path C:\Program Files\WinRAR\rarext.dll
Size 658KB
SHA256 5f21fd414a3767df77f31be26352fc2fe63adbffc75ee48ae4ade06deef07b50
MD5 d0f4632be7031cc372ffdd2d9063ffb2
SHA1 b99f58ae5b6d169be95785a9a25ef27582e194c9
SHA512 c620ceee308daf1cdd83568529042f17929dd4aa29d3d092b63fcd7b4751ff912247e68de2788c7d225a69f3d2c1dbfacdba2841c85a11308a029612e38c5595
SSDEEP 12288:dyIL0neePxyNZAcG5e7kv0E4doo6yPApu2Giw/iiiTQBd3X3uc:dwnVPxUKe7kMEieO/riTQBd3X3T
TLSH
T1B1E49F49B3A802B9D5B7D17CCA87861AF7B67855036197CF03A09AAF2F237E0563D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 63f519fb226f30f084a717860a1f6f85409fe464df642d091a47a113c67f7d9a
MD5 d313489f66d3d929542036eb1c602db4
SHA1 fa467e97695588faa817c64dcd6b4a5b52cf62c9
SHA512 1b9d0dcf5976281ffaa12184709d884d2997cbc347c7f855b6596e180b210a324770c13931d02b3b9b045d426d34731258b36536f0621f827195e55978c41408
TLSH
T166E02B65C871EC3714FD0719A4541782E755239B2B41CD4F7A3D840C8FB16364986D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6e253ae1a439c50c8b8314aa21a07fe3a4db1d5449aa53c152dd6ae61188625a
MD5 ca2140a768e6c197826694270f94a1ad
SHA1 3d8051d2bfc98b64fa7616d95567ac99c181e19f
SHA512 95b98b7c1a2e6bdff8d99f3f672f2e9dfa34db30cd87f9a8be6cb546486133f26f9eaed479727c99b1bbe1441e291c08cc475c931db52765f369c34915756e21
SSDEEP 48:WUCpUbBqz9hh9N/Jrw1FgQXmeV4rOaq+CzprhUa3/W6utc33X5jyH:W/pUbBWhArZW1q+Czprh/B3ZGH
TLSH
T152A1A118940D4D65FF76CFB04AD903F57A3EA6288A031E0B175E83F83D513EB2203249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 2b1657f9aa16883db1960de520ffdefb53706a78f050e58bde5a4dbb4975e492
MD5 61930d6e3f2a6bd129a06cdcaea22ba7
SHA1 1b309943476754988db6da56e30427a95fc63b82
SHA512 0ca51d4de02fab6026d7c3dbf7fda1edf089442762fde27686d85763ad7618a52185dc09be30e5a6399f9eefe08f2f3a5fb8c29cb67a9ce45d37d54e11a0745e
SSDEEP 3:MsEllllkEthXllkl2zE8D:/M/xT02zh
TLSH
T1CF440204ABC80805CD1062304015D3500370D42005219743299145326C866800C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 6b7138e96ac5f0cc2b21f35c6a13b9436ac5649d1814a71371c8dd6d6f21ebce
MD5 4ca323bc1a84e208b1f2bd7ffb86cbbd
SHA1 906da166d2aeddeb385feb5c1c40c958049f1f43
SHA512 204cac04f40a4aa58d892761e9a4715f16a0533cef827e21da7f5ffb06295f38cc8bd0387485f61910c809b3edd9f60a42166a525728a6b1378db68ed8d675b3
SSDEEP 192:DfwfRC8BKJxJmGFmpaI6syJ/M1AGZJ9SRaPRvQfPtNP8Nm/hmmm+mDmzmrmH:DfwfRC8BKJxJmGFmpaI6syJ/M1AGZJ94
TLSH
T142F1AEF7C3D4862DC90156F4AB15AF1FCE290628432C3C66C8E4BE5B93E2871D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 16637adc8a8442e245620f6551845601a81f1362c6c155928d946293ea44054e
MD5 c7dc2d1183dbfd34b2bef2f93609ff43
SHA1 cef41bc8e6abae2b58e28c76e36908722b96eade
SHA512 47e9d44c2bdaba78351d8de887520eeffda91d7907cb334c89f52ef573c61aefe233a69a58be0737c12f8947e53826dac196bbd7a7ca66fd8f118410c53bf863
TLSH
T19231ABE7C5BEB81F607D986F0D46BC0529F9B835014168F4DEABD12CE08A5F70F1286A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c2689978240056d965bcf620f5b7aa8c62246965a9115bd3626099b3382e26d9
MD5 1884b927b399b5df387db304c8ebe6b2
SHA1 d0808b137c90cf531c8f69494aeb5e9ab958522d
SHA512 fd43b53b246c4490214eea19327e95d614c82554068df32a729b18391777919c52047517de9f8a35ad2148432a214e585f73311db1886330a18351f0a022f730
SSDEEP 192:5RScBzVzLGUQAdv70pAPRp2d4KANj29+Hsb+WNot9qvHc+hmFZ2eqeCOHH48hAQu:5RSmzVHBdgUX68wXkwIZ2lQ/e
TLSH
T1E852F82AA9506D7B9CDED259FD217757E3F2102124E51E80EAFCC91C25E7ACC321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 01aad292e0d0bc5803a913005ea94444619b64bb5221c37a4a70324e3bcb872c
MD5 20d540cecb4adbd192de3695958c9b33
SHA1 1cf5fc244c376700938a69eaa9ed4236ae63044f
SHA512 7d50c319c5e8fe10e954de5492febf2fa6d0fd436796799e9ac9abc5a256ee08d4559d47058df60b42e7b53977d07400390bca79a4c14564e4dada2d25e2f866
SSDEEP 192:5RScBzdzLGUQAdv70pNqPRpxd4KAIj29+Hsb+WNLWt9qv6MMhmFZ2HqeCOHH48h9:5RSmzdHBdgfcX28w9pOIZ2KQCde
TLSH
T1A462D81AA9502D7B9CDED269FD21BB57E3F1206114E15E84EAFCC92C25E7ACC321B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c7f1b57049a9ecad264ed2fdbc8e527c159b6d0204990521e2794b01d5d69bda
MD5 b1cefab981125e58a00840b7624c8b04
SHA1 fe3c66998d3e29e62a1a4f4ff7f2fa6d33bb06dc
SHA512 65e5579676cbee9b7ca1461cc2ae1e4a5941023755b7d10b19dcc9faa77e2011b2e8d6787b4af711e3ec946c0f43bd23ee6af10c7b39f01e577db50535e571c2
SSDEEP 192:5RScBzVzLGUQA0v70pAPRp2dAANj29+Hsb+WNot9q4hmFZ2G7qeCOHH48hAQsVyt:5RSmzVHBwgUXt8wXKIZ2G+QQ8
TLSH
T1A852E82AAA50697B9CDED259FD217757E3F2102124E51E84EBFCC92C15E79CC322B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 189caeeb35ccadf513211e0a98ba7d79428f8124baa01745954356c926a5b87d
MD5 bd8aff86dba494a5439b7b3b3c0c6b29
SHA1 59c0251d88c944c336b9985aca8fae70d47f93cb
SHA512 c7a642778b29a934b4529cb04a30f3bd1d56a98c7d7db366dc6fda40a30dc50508bb48ffbf48c609bc27e3053264695f3af682a311cdfbf97ddf3d76093530eb
SSDEEP 192:5RCVzLGUQAUv70pAPRp2dj9+Hsb+WNn9q0XqeCOHH48hAQsVyIsnAUgtaJ:5RCVHBQgUX68wo06QQ8
TLSH
T1BC42E82DAA50697BACDFD219FD217757D7F2102124E51E84DAFCCA2C15E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a4b125dccdec4efcc9bdf5b2e3ab11d515373d52e45c404f8f283ea6ed428b7d
MD5 48508f17ab464d6f13a14deb5386f30a
SHA1 0379aa8828f53593b7547949ff251da20d1398e8
SHA512 0c724c0d121bdcd92e1ddaabcae3121b8ac7ff9f755f8122361c0ac70f309f2f9a33baa114c6f0a77dfe786233063760729e5d4de82db538ee928497c620111b
TLSH
T190B01240C0025102C04302F411A6A4C87214DF20D60B670543E069728C295D08014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592d40.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592d40.TMP
Size 96B
SHA256 4dfdf556e45a9f7ed3efeee8fcc71fc5a3db688786975117c89b98f0aa585b95
MD5 bc57569bbf1ea14f7d9c1861a0e19a97
SHA1 e94eb8f17483db1ddb45ead6d84fbc210337ffe6
SHA512 7a4d0deac087624c32fa11579a54457f72849de543ec4f6b65cae4a9aad1a93f40ac566e3b162a6938aebe57277e0f0517c743947bf4b04ec4585a9fdf597bf0
TLSH
T1ECB022C0CE0A3302C08203B038C080C83030CF22C223020AE2E00A33CCA0A2000B0820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 34146cec28d8ada219f755e1bec6fe25358d25c32b383236a85cb3194128d6ac
MD5 4b940e11d8a166a0d4d499d508d82514
SHA1 fd84bc0c09f2dd73dd317451f33f67842e6f7a1d
SHA512 5a04d998d7b64d8b513eee4ae0d9e4eaec627d60f0703a18bf1e189289d57e1af0d1ed96d84228e369aa3bff36285c52bcf1df8a2a70c91c9908e5af464533a3
TLSH
T100B0021140181632D615A77664FB51847AB42E9823AE6257559309769628271C67342A
MD5 SHA1 SHA512 TLSH

Submit Download

b5a286f7-ba4b-438c-9caf-3f2f6dd7224d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b5a286f7-ba4b-438c-9caf-3f2f6dd7224d.tmp
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 35fb8084a9fa8829f9dd9f1c80ea9ae4d15cca90098ade63c80258c70aa93cf3
MD5 6af1e96d9a7d4198ba06bc182185ea61
SHA1 082d28e16f8c5c1673f661fcc15dad98a0538079
SHA512 4e75dde216f961e90738c71653bb0c2a8d925dc5f09a3b32d94a63e44c9e82fe70ca7d165e6f879cd960be30eca06b8da93f5e1a4ec7c83a1cae819ee389d106
SSDEEP 6144:Ui5PoycD6S3l/31Xksp91x3qZ/ZLW3ExM:rhoy5s1Xke1NqZ/piQM
TLSH
T16A3412327BE45F3B4F47CA64902B1D0A89B784868834E21DAFAA7FDB78834E015135E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 793a83cc8947b0341d65a44c3ea03cd623f206a84cfff9b281845fa8fe1ec4bc
MD5 bad9e3eb83580fe0c6c9f2f75d3c7d90
SHA1 ac13d42831b56ba13838848faac4f43207e35110
SHA512 e287818b3a8e59c600bed67d88f7a90ccbbf9df57a7011f243643316e4a4fe0e8fcf418c1883fc7fc4dc36a1e7f35fbfe5cd39f624891492c945b8685f503baa
SSDEEP 3072:c35PoycZ4g6S3l7D31LSMkdhnMCO131x8Lmqfd7NtZL8cHQRZEQ6SpsM:U5PoycD6S3l/31Xksp91x3qZ/ZLW3ExM
TLSH
T14F3422326BE55F3B4F47C764906B084B92B784858438E229AFFE7FDBB4838D116131A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bdd4be5c5e946a7cc5b37c910f49363e6962af61afdb926291de29647c832e26
MD5 77b712abf4baf25720f301ca5d001ef9
SHA1 3281e269d36dde3f1d9c0943a895be4cd813c916
SHA512 70d0e308286768f4769aab12f9b6347e890dbe5b40ccbced2b8730a1b371c968bdbd129559a578da432818f2a1d05e5f5708b619fe35075e4f120255b88f458a
SSDEEP 1536:b2LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:qqfd7NtZL8cHQRZEQ6Sps3
TLSH
T178C30237ABC21F339D92CF64B9130FD6A7B644A99034D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 1908d92443589cd6bfd7df488f5da694435a58c91b50be383c9ac84a08e003f9
MD5 7cbdbb9f4b6499ac0571c54fb259825b
SHA1 627b5946e15f7eac4d817e55fbcab283cbe47372
SHA512 9cf6441cc85d9463998204b7d6e476af1077899ea480cabababc51c51f258949400104a32efcd923b6ab819741d535397cbc17a9445f2ac51dcd6e547f2c850e
SSDEEP 6144:pslWGxsLI5PoycD6S3l/31Xksp91x3qZ/ZLW3ExM:a1hoy5s1Xke1NqZ/piQM
TLSH
T1C14423377AE59F3B4F57CA64905F190B8EE38086C434E22CAFAA6FD778834D116121A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

neobloxBootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa5844.41851\Neoblox Bootstrapper\neobloxBootstrapper.exe
Size 320KB
SHA256 bfc86980dbdeba54753d23f98a6be07edf17b8fd2e8cf798afc924989f9b0f89
MD5 0b56327caa16d08f1125c7322fc33c01
SHA1 8a051f0f162cba2368eabfad04a8a43c9adb1441
SHA512 07567c62773c461b75f9c25aa26cf1cd8d37593e6e9bdd91ecc702b8aa5ce5af62f8211d2dad7957cc9fcd04253bcb0f9b22095483476d241302304356c2010d
SSDEEP 3072:6UO2N00bFdFUq6C3IfTprNqHSR3/16dBei:yrwFdMV7eBe
TLSH
T13A646DA437C997E6D468087F945D55C2BA73FE4DAB0A03DBF0487B2E0A7C1604EDA721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 10ed4cbd9daf5c8536bd965bc38d48012c2d1fbaa9f6dc44dd0e87009d634c2c
MD5 a4f15718c0cefc1f299d8609339700c1
SHA1 afee0229b0972b75cf980bf03d365d12fe9a3140
SHA512 079a07a120007d08b9bbc7f3d63275658d3d0dcb3e01563a7b77f0bef7d180d02df7b099124a05867f99bc6050ac28e16e3f5336b13d0bb4f9e3eb0bc0260e84
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3a2bb35573c36e4b54b7c79ce6e51e029ae3668f74fdfb090daf8c7c9a04e61c
MD5 003666e1790f602dc6a32ae95807a50e
SHA1 63ee9b220bd9f2e5b9a4f67f0efe2deb2e4e1096
SHA512 a335943a62ba6b7c4de0ff4815e092211387f02557afb3b26f80067d034aadb4938e9a813b54bc1da608e58dc51becb20574d4f2c090a766809c1aa882f94429
TLSH
T107D0122632110134C13021330012650D0800C30B400A41155438895E9B444D01E06C43
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 32f61cb16cf5c4777b5d3faf048b23ec1fa6f5362df28b7aee21416e203ddf9d
MD5 b2096325978a24b104e26598367336b6
SHA1 54f79594be3e2465bd2a7368d5cf4474026be6a8
SHA512 3aae95c0c7e213a7d9a60d399b0ac19659d4b413bc2bc1ca45b108e83e62034559865134c68606be01086a55670238503e0b2e1a54f38bb4a5d056aa29561e5e
TLSH
T1DF31A7B3A8D03E3B6CD2760675957B877FA040AAD1300F44A7DD1B1C22E618C532AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 c639f8b9712ff19cb0c73ed7f6b50d71e4998f2eb0a716375d3d00af34b54be2
MD5 18f0ec38270e11b916bb371c047fcb3a
SHA1 059a5bb91546946eb3432ec6c36a5312761970b8
SHA512 ea5d7c3a3e46bdee287abc1c05bb10bb59bd302a420dc7ad256752f9e549b001aa930be825ac1391bf3a781bc66be5f5b6357634cb1f7d141bdac1d49e1f86a0
TLSH
T1F85196737894BA3B8DE3660879893F53BE7550A5A5712F949ADD1B1C01DA14C2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 05b270d2daec4f7ea193e745c8ee6d6f6a54f0dc6d22ea57e0d6d05c6aae218b
MD5 ecdba08d287952049eeab2898f53f6d2
SHA1 f0b336d0efc7bae9f0b54b541dcae5531c00def4
SHA512 4672dc5f0e9ad556b9b91e52021e67a7a47861f0ff40b6f2f4a07b7f18f775666b07c66d6be5631489bf04ffbf970f0133e81ea13d656e9e9eeab6eac6f9ccf6
TLSH
T1B271967368A4B92B4DF3A905B8C52B06BBA55167E1A53FA8DAEC1F0C01DB3881352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 5ca626ba7a65ec7b4a0c1682ca4c04a7d8522ac24dec5714405791a4a8137452
MD5 1b1cac67ceb1215a2d59e1e01031fbba
SHA1 4d61d991af10ae4e84d0306463c51edc362b296d
SHA512 67923c6ec5e1dec9afeab1dab75f71f3cc0c22faf222452e363e26aabdb8cfd168a9b72d114cf100d8c58d951972b7c2ed60a832eb6d723030071c4632cb7f08
SSDEEP 96:zud4F3NkCERlf2aiyTL58Frh/cInURoDotoT3E+DJB5ZwP6dkZ/iOOTVlla:zTF3NbogFyqooDU4NP5Z7OGI
TLSH
T15991A67268A4A9274DF3E905B9853F077BA45067D1A52FE9DAEC1F0C01DB28C1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a5862.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe5a5862.TMP
Size 1KB
SHA256 b394010ae52fe0cb7394dbf9269f350645e39affa006c047c20122b48d010888
MD5 3b7ec1b70ed33c6355611518c29f6fcc
SHA1 03e4a36090db7fbfd309198f106308890d1845dc
SHA512 bf8eccb1d10bfd62cdc3650d5d492f67e8db34087ce4c4de22e4cd16e830b8e90203e0a6f920e45b459594962288cdfef7e4a48672c68479e7d3c6b7b52ec07d
TLSH
T1FD2192B398D43D7AAD92651175917B873EA040AAE1200F08A2DD271C22DA18C5367C37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1768-929-0x00007FFE692F0000-0x00007FFE692F1000-memory.dmp

Download

memory/1768-928-0x00007FFE67EE0000-0x00007FFE67EE1000-memory.dmp

Download

memory/3700-1176-0x00000000007B0000-0x0000000000806000-memory.dmp

Download

memory/3700-1177-0x00000000010F0000-0x00000000010FA000-memory.dmp

Download

memory/5256-886-0x00007FFE682F0000-0x00007FFE682F1000-memory.dmp

Download

memory/5604-1002-0x00007FFE682F0000-0x00007FFE682F1000-memory.dmp

Download