hxxps://www[.]dropbox[.]com/scl/fi/t2yr1bjvpnm631kp0at5m/Software-Cloud[.]zip?rlkey=j2p3u0buwsf5rjy7164q1wzmj&dl=1

Analysis

user interaction
yes
max time kernel
274s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/t2yr1bjvpnm631kp0at5m/Software-Cloud.zip?rlkey=j2p3u0buwsf5rjy7164q1wzmj&dl=1
Sample260827-rl5c8swdkd

Score

10^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
118	1060	powershell.exe
119	5468	powershell.exe
121	3928	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1060	powershell.exe
5468	powershell.exe
5700	powershell.exe
3928	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
114	876	chrome.exe
119	5468	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wrarinstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
2468	WinRAR-723.exe
5992	wrarinstaller.exe
5112	uninstall.exe
5132	WinRAR.exe
5400	WinRAR.exe
5756	Set-up.exe
220	Set-up.exe
6056	Set-up.exe
892	Set-up.exe

Loads dropped DLL 15 IoCs

pid	Process
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
3292	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240851046	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR-723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
876	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323138906218544"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe

Suspicious behavior: AddClipboardFormatListener 12 IoCs

pid	Process
5756	Set-up.exe
5968	chrome.exe
6032	msedge.exe
220	Set-up.exe
6056	Set-up.exe
4876	chrome.exe
892	Set-up.exe
516	msedge.exe
3904	chrome.exe
3604	chrome.exe
1688	msedge.exe
5104	msedge.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
3872	chrome.exe
3872	chrome.exe
1060	powershell.exe
1060	powershell.exe
5468	powershell.exe
5468	powershell.exe
5700	powershell.exe
5700	powershell.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
2468	WinRAR-723.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5756	Set-up.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
220	Set-up.exe
6056	Set-up.exe
6056	Set-up.exe
892	Set-up.exe
892	Set-up.exe
6056	Set-up.exe
6056	Set-up.exe
892	Set-up.exe
892	Set-up.exe
6056	Set-up.exe
6056	Set-up.exe
6056	Set-up.exe
6056	Set-up.exe
892	Set-up.exe
892	Set-up.exe
892	Set-up.exe
892	Set-up.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5132	WinRAR.exe
5400	WinRAR.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
5756	Set-up.exe
5756	Set-up.exe
220	Set-up.exe
220	Set-up.exe
6056	Set-up.exe
892	Set-up.exe
6056	Set-up.exe
892	Set-up.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
5400	WinRAR.exe
5400	WinRAR.exe
5400	WinRAR.exe
5400	WinRAR.exe
5400	WinRAR.exe
5400	WinRAR.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5092	OpenWith.exe
4472	OpenWith.exe
3380	OpenWith.exe
2468	WinRAR-723.exe
5992	wrarinstaller.exe
5112	uninstall.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4712	1444	chrome.exe	86
PID 1444 wrote to memory of 876	1444	chrome.exe	87
PID 1444 wrote to memory of 2096	1444	chrome.exe	88
PID 1444 wrote to memory of 2096	1444	chrome.exe	88
PID 1444 wrote to memory of 3808	1444	chrome.exe	89
PID 1444 wrote to memory of 3808	1444	chrome.exe	89
PID 1444 wrote to memory of 4132	1444	chrome.exe	90
PID 1444 wrote to memory of 2160	1444	chrome.exe	91
PID 1444 wrote to memory of 4132	1444	chrome.exe	90
PID 1444 wrote to memory of 2160	1444	chrome.exe	91
PID 1444 wrote to memory of 4720	1444	chrome.exe	92
PID 1444 wrote to memory of 4720	1444	chrome.exe	92
PID 1444 wrote to memory of 4408	1444	chrome.exe	94
PID 1444 wrote to memory of 4004	1444	chrome.exe	99
PID 1444 wrote to memory of 4004	1444	chrome.exe	99
PID 1444 wrote to memory of 4728	1444	chrome.exe	100
PID 1444 wrote to memory of 4728	1444	chrome.exe	100
PID 1444 wrote to memory of 1576	1444	chrome.exe	102
PID 1444 wrote to memory of 1576	1444	chrome.exe	102
PID 1444 wrote to memory of 3460	1444	chrome.exe	103
PID 1444 wrote to memory of 3460	1444	chrome.exe	103
PID 1444 wrote to memory of 1484	1444	chrome.exe	104
PID 1444 wrote to memory of 1868	1444	chrome.exe	105
PID 1444 wrote to memory of 1868	1444	chrome.exe	105
PID 1444 wrote to memory of 4384	1444	chrome.exe	107
PID 1444 wrote to memory of 4520	1444	chrome.exe	108
PID 1444 wrote to memory of 2916	1444	chrome.exe	109
PID 1444 wrote to memory of 2772	1444	chrome.exe	119
PID 1444 wrote to memory of 2772	1444	chrome.exe	119
PID 1444 wrote to memory of 2108	1444	chrome.exe	120
PID 1444 wrote to memory of 2108	1444	chrome.exe	120
PID 1444 wrote to memory of 2392	1444	chrome.exe	121
PID 1444 wrote to memory of 2392	1444	chrome.exe	121
PID 1444 wrote to memory of 852	1444	chrome.exe	122
PID 1444 wrote to memory of 852	1444	chrome.exe	122
PID 1444 wrote to memory of 2232	1444	chrome.exe	123
PID 1444 wrote to memory of 2232	1444	chrome.exe	123
PID 1444 wrote to memory of 3432	1444	chrome.exe	124
PID 1444 wrote to memory of 3432	1444	chrome.exe	124
PID 1444 wrote to memory of 3872	1444	chrome.exe	125
PID 1444 wrote to memory of 1260	1444	chrome.exe	126
PID 2468 wrote to memory of 1060	2468	WinRAR-723.exe	129
PID 2468 wrote to memory of 5468	2468	WinRAR-723.exe	131
PID 1444 wrote to memory of 5624	1444	chrome.exe	133
PID 1444 wrote to memory of 5624	1444	chrome.exe	133
PID 2468 wrote to memory of 5700	2468	WinRAR-723.exe	134
PID 2468 wrote to memory of 5992	2468	WinRAR-723.exe	136
PID 5992 wrote to memory of 5112	5992	wrarinstaller.exe	137
PID 2468 wrote to memory of 3928	2468	WinRAR-723.exe	138
PID 2468 wrote to memory of 4892	2468	WinRAR-723.exe	142
PID 3028 wrote to memory of 5132	3028	explorer.exe	144
PID 5756 wrote to memory of 5968	5756	Set-up.exe	150
PID 5756 wrote to memory of 5968	5756	Set-up.exe	150
PID 5756 wrote to memory of 6032	5756	Set-up.exe	151
PID 5756 wrote to memory of 6032	5756	Set-up.exe	151
PID 220 wrote to memory of 4876	220	Set-up.exe	156
PID 220 wrote to memory of 4876	220	Set-up.exe	156
PID 220 wrote to memory of 516	220	Set-up.exe	158
PID 220 wrote to memory of 516	220	Set-up.exe	158
PID 6056 wrote to memory of 3904	6056	Set-up.exe	159
PID 6056 wrote to memory of 3904	6056	Set-up.exe	159
PID 892 wrote to memory of 3604	892	Set-up.exe	160
PID 892 wrote to memory of 3604	892	Set-up.exe	160
PID 6056 wrote to memory of 1688	6056	Set-up.exe	161

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/t2yr1bjvpnm631kp0at5m/Software-Cloud.zip?rlkey=j2p3u0buwsf5rjy7164q1wzmj&dl=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe047ac728,0x7ffe047ac734,0x7ffe047ac740
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,1033051143145308246,15443777405942344964,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,12245700166854366979,8372299068706964248,262144 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,17945145482986701077,9418498222005834415,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,13257108109983764601,10563580463321078135,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,12213591535686132139,12171788938937882965,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,10002770850855284501,3742322816454632196,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,3503767318712083312,13234641542851856069,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,919955281620627747,17140553811408285415,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,4869054148166600801,592792180501299853,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,15123420391605351265,14329285698584466364,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,1399255867175091175,3234386811659977685,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,8684024272470778692,7969208617136488089,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6216,i,11874328795202588452,3446706093050077121,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,5586019265558030737,2129029584503082880,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,7338924178822585743,17004429247069925197,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,1524246853070636695,13828125761045267062,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4420,i,7591568529439515063,11410150830584853009,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,5450170879443724989,14660976160714272988,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3248,i,5586269151479625961,4163969619652747909,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,7554347771640432598,7014079973484533187,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3232,i,16739038726547554288,18167483479537168380,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4128,i,7238009119268557068,6199685834380916932,2097152 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6448,i,1198689948488252938,10540703375131664751,262144 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,4178087402929622146,10058495030711246916,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6540,i,6696623023187432369,13271516972076948832,524288 --field-trial-handle=2072,i,7219381890007484615,2867382380311701730,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:5624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:872

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Software Cloud.zip\How to install.txt
1⤵
PID:3576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Users\Admin\Downloads\WinRAR-723.exe
"C:\Users\Admin\Downloads\WinRAR-723.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  PID:4892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5132

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Software Cloud\Release-арp-x64.rar"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5400

C:\Users\Admin\Downloads\Software Cloud\Set-up.exe
"C:\Users\Admin\Downloads\Software Cloud\Set-up.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1656

C:\Users\Admin\Downloads\Software Cloud\Set-up.exe
"C:\Users\Admin\Downloads\Software Cloud\Set-up.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:516

C:\Users\Admin\Downloads\Software Cloud\Set-up.exe
"C:\Users\Admin\Downloads\Software Cloud\Set-up.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:1688

C:\Users\Admin\Downloads\Software Cloud\Set-up.exe
"C:\Users\Admin\Downloads\Software Cloud\Set-up.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
MD5 af2f59a1c3b3589c2e1506ab00b6148b
SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 669KB
SHA256 4f00f5046b05862fde74f892ddf8a87110455db4ab577083d4e9e137ed1b5a04
MD5 4e3e0fba53698c4fa45c1365866813c7
SHA1 ce55226b22eddc19bd3553b65af85307544e29c3
SHA512 0220ec96a08444fc25538ef67a32d2ee759000bc6c85845f9b29cd0c4d79448d4544b91b4d199fa4db15b84c057892fb0bd51174a8ebe8ceb9c2cef87527b90d
SSDEEP 12288:3yrI1lJlLZHJndEB7UFJtdqri2+arBQKuk9ltyiz:3yrIHJxHdEB2JbqzrBQKdltyiz
TLSH
T17EE48D09A69853BAD47FD07CCA83461FEAB278518772C7CB03A516AA1F177E0573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 413KB
SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
MD5 3950935f79f37787312cbaceef88439c
SHA1 cac58c62f23ced8c2e075d53e7083585ab7ec674
SHA512 eab00916e65d8155afb892959b821e2ab49ba665b9d0554044c6bf59580ad772c51b1e4d5875810a8a21cffeb8a0509663c01dc8d78fabcebb10c98e79cecb15
SSDEEP 6144:F1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLR2III+Sn5HBK7jcR0IA:HM1m5Pwtq9VSrJFggIIvS5ejcqH
TLSH
T121949C1AE7A455F9E5B7D13CC8924507EA727C558BB1C38F03910A5A2F237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 64KB
SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
MD5 a1bee36438565456368f497fb69195d7
SHA1 83940cda35e775151197f08531bd445556185889
SHA512 35db801d5194fd21481203235c3a00adb60cac8c8e359c3ec06d75d8c50ab23d5cc4d4f1d55286ac9f90d1997729d3e0398994ef38714e69935c9391d055aeee
SSDEEP 768:sMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:sJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T1015394237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A6D2F72FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
MD5 b2edb6e0812a75b601019485047a17a0
SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
TLSH
T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
MD5 51f6a6e10dcb9452f7357aa7aef19bb1
SHA1 2daa1a057f592d5e2d1446ed1fdf6cef8a0d7e9d
SHA512 99a963fd8018044e9a606179a7666a7aab86cb989ef76a3bf99d78b42f6d09802da2f40a7f0c4cc70ef6f95fffa0b0b767576e988452a5f269ca12c5dc5ad4aa
SSDEEP 49152:I7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgXUeT+uXEkjNEEBHLu:7soEC9/a+uUkjDBHLu
TLSH
T199F59E0AA7E406ACE0F7D679CED6C553D776B80D07B0A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 26d69ce2bd4949a4af779795dd11b5d8ee0a9b789ed8176485a40824ed6bb9ac
MD5 b54b5fac83090d8004d763032bd3967a
SHA1 a6e80661c790dae37edc0d9d369d9d5a8701b815
SHA512 f631662e34628aece4b5eb05214da79e3ef7c28858c87efab57c581ae5e034c98a3269e23bc7a9483fddcc4da3170b4d3f631bb3a158cdd0a5f3909733b00a42
TLSH
T11CE02BB9C920AD2B09FD072964590647E69423172B40895F3A3DC609CFB8677199BC1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 320KB
SHA256 4a2449802aaf50999f43cb76b7e52f94b4ad9ed629f0cf0f1c8d7756e8f1d235
MD5 aaf3d5e782d4fd86316609597ff7f014
SHA1 2e82b15ea1a7dcfdbb5035ed8ce44304c2d7230a
SHA512 ed3c22757414ed48c89e6460d1b0215b5ab9498c3245d9a2c181885be68a5da172c6857055ac19e3b0e774a59ba561690e381acf0c5801e2065a42e0684c269f
SSDEEP 6144:0AeLqKHr7KNb8ya/yx0vbqXXZleSH/+NL5T05Gsk+feSQ/Gvcq:0fLTHr88X/Jv2XXKfNLO53VMGvcq
TLSH
T1C3642325B563B6702B1CBDC6EB4D44585888CE9239E00BB655B3E49CCE316EBC132DBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 557KB
SHA256 a0de70e26a3a04585947a78232d49b193d88fd4377ac6f86d84247d6b6207aa5
MD5 f61f17b6308b077f3749291948d06b6d
SHA1 3dac5ecf6246fd635bc0a4f11ba6559aa611a507
SHA512 16270f96e1685dcca869d4466c512a7ff9fc610a1a4e222dd6320cb61c644c52ce5f4896dbef7aaa41cad65bb0cfd84e2ecdd1dc797e0100e8aff2b4b938d6f1
SSDEEP 12288:VTAO3X3usBxHnpKgAK0HDfw1l2ErM548eYthvzZQs0Q4w+:VTAO3X3/BxHnMgrVrMpeAd6w+
TLSH
T126C41319ABD2CA56C0BA8B7449F1C3379A33BD120954CA47B3407B5F6933741BE1FAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 0e252fddc4f504b089f5fed5b45ee1766ad79d4c5a2ae20a482558c6ca2bc072
MD5 105b9c873a991b2ca8a89040cd6bdcda
SHA1 495da446c2e828a1486929d2b411a3e40cac6642
SHA512 a55edabc47a9a20a65918b9f6d6895924c03fe6bbe88ae5095f8f9bc5c2a7dd758b618483d0c94a23c372f3855ea77284e762d5fbb36aa157d68e8450dfcb543
TLSH
T1E711B80392B5BAB1CF409A722DE2C80D70FC03D825E3CF3A061E54A878935B731180DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cacc839e1828bfad0868e1aa341aeba5878498afa9ba64dbb1765f999e39af38
MD5 4d09e887a7d35d118a763707b6480648
SHA1 e4a43332d53011805ed6c45ba78acf4cf3635d34
SHA512 0618293b663597c65eb3c3e54e9a7d289d5c559085c41f815aaa218192844fb12d18ee9cd15d3ec4092db70df8536d82460f00b23c2198b0edcaec6dc44727e6
TLSH
T137719CF7C7E4862EC51196F4DB156E2FCE2D0A24131C3C6698E4AF5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 589d78a551b831f85df5e54faf8c24ae7051f00f3fc0e32e06cf68b5e4d017ea
MD5 15cdaba116fcc35e21f98e0d3df017df
SHA1 5bbcfccd63f69f397cd68318cd0a1023b7c77900
SHA512 b0af6a1068ea3f260b4cbcb023f51a51d118f21869e261a9e33f48edfc3e2e894f62b741e6f42edbc78f63d3838b80444802000fb0d5f0f0880d13a93d9fb477
SSDEEP 192:D3k9zS+zMrCXaIeQUfABjhXMCAM4Ce0bV1dNPHaP/89K6:D3k9zS+zMrCXaIeQUIBVMCAM4Ce0bDdH
TLSH
T193F18DF7C7D8862DC81156F49B156F1ECE2D0A24432C3D6AC8D9BF5B93E2872E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 36dd5c659e54cb2f36127674d906e76669ecd6db1ff8024f8bff3350090bba45
MD5 250530c4ba5073bda4762b9aff7d9c4c
SHA1 642cba69cb25752314a53c760b6878d7036571e4
SHA512 1e680928ec22624c39ea563182997c25c0745d4ab52ece480fabb4ece0fe15ac19d62b9641f889ccb62bc9c296f3afef1cd77326170cdeb580ea870a5d2ea61c
SSDEEP 192:D3k9zS+zMrCDFaIeQUfABjhXMlM4Ce0bV1dNPHaP/89huJ+W:D3k9zS+zMrCDFaIeQUIBVMlM4Ce0bDd+
TLSH
T1BFF19CF7C7D8862DC81156F59B256F1ECE2D0A24432C3D66C8D9BF1B93E2872E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bc990b4750f3f3552b9bf9a1931132b750204700383aae71ca130409d05196f0
MD5 c0548f7bd0173de9cd85da2c6d2d01df
SHA1 0412b9da6846a39649e6ade6aad45d143971ced1
SHA512 117d05fcdfa46325cfc270d71cf313702b813a0cf79f38443de7328db6d2bd42cb24c8f379b6386f59990f77824edc14ff1ae246e0eb331caaf70e8edbe0a9a1
SSDEEP 192:JRicBzJ6VoiPHYiuv72ympEPRpWMDX+95Hsb+WNYUJW1fMBpWeutXjskwA+VyIsv:JRimzJwoShKQkXw7woSee+XIg2E
TLSH
T1B452D82BA910697B9CD7D229F9527B53D7F5206225901E84EBFD8B2C08E75CD331B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 77841467b97ea8ef6422d4b9311481d26a842d504960b504d44afba06195afc1
MD5 26e2c9fc939d81980eedc6ded0223fc6
SHA1 47d8ced06c88dd1410f926db93309c638bfdbc0b
SHA512 8d34ca5dfca0b52bbd798a6ecd633bb547d3552f2991e661845ce3193b2f094dcb4541f1aca4cb4a8dce159ab21f399bec0312597e0a2994b7fb68ed31f04502
SSDEEP 192:JRSI6VoiPHYiYv72ympEPRpWMQ095Hsb+WNPJW1fMBVC2GtXjskwA+VyIsnAUgE:JRSIwoShEQkXH7wYSa2WXIg2E
TLSH
T11E52E82BA910697B9CD7D229F9527B53E7F5206225901E84EBFC8B2C18E75CD321B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0fd51898f5cf0b41d0042af3b895fa8d505d53b1c843325a4c3f1b1f9c382ec3
MD5 325ca8ced3a49d6ed6ffcfcf5d4d420e
SHA1 20691e85a788ea37718b36d9e55ce28e7220b480
SHA512 6b02288dd498b8231777b00180d58b13d53808e21750596c69a8e351c164f5752fbcc17381020569bfea57333d2f06048846289951d76cf196574ede2d0fbd38
SSDEEP 192:JRicBzI6VoiPHYiuv72ympEPRpWMDX895Hsb+WNYUJW1fMBpWeutXjskwA+VyIsv:JRimzIwoShKQkX27woSee+XIg2E
TLSH
T14852D82BA91069779CD7D229F9527B53D7F5206225901E88EBFD8B2C08E75CD321B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2e695afd338518a88d4a639b1475679baf1f8d056531c40bb21fc0c56703defe
MD5 13512b03048e6bfd9901997136a70aea
SHA1 93cb813d4e9dfab8ed182a0e0c2ec8fb4847a81a
SHA512 993701ffb66358cde832b7a3e9376e1900af8dc716ca2a6478cd32d44860c431410c2bcb43496ae022f4bc5a0bccf9b294b1b2f5c032cc118edbd3e8de27cee7
SSDEEP 192:wRSwcVoiPHYtCv72ympAPRp2/95Hsb+WNni9PJtXjskwi+VyIsnAUge:wRSweoSQOQUXo7wUP3XIC2e
TLSH
T15A42D82EA910657B9CD7D329FD627753D7F5206225902E84EBFC8A2C18E75CD231B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6c94b7fa2045bd6642eccd3f094968fed5ebf94b895a5ab9503ca31c428b2219
MD5 5cf0c5109c4f60364579b41885bc5ddd
SHA1 f014bdda6f7208b8292c5aaf792214b37948e59d
SHA512 0a1fd1d4a2bd2525de9ce35f5885a3f3d64bb6a8885a969614faa21c9f966264520f794040caa4b53428345b260787a3afc686bd33f4cceafe68b7d83ceab039
SSDEEP 192:cRSwcVoiPHYtPv72ympAPRp2/95Hsb+WNnv8Bc0CBMtXjskwi+VyIsnAUge:cRSweoSQHQUXo7wUq0CGXIC2e
TLSH
T1DB42D72EAA10657B9CD7D329F9627753D7F5206225902E84EBFC8A2C18E75CD331B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0416840fa760207eb135f951dfe85e393b6ebbdc5ae29ed945c22016caae90f8
MD5 3c082df4de6420f91167e6ab8b80c946
SHA1 ddc077e0074e5c4c86d2d6befb6aa36ff3604f03
SHA512 2a5996663a193768ec63c6296394a5a0913c48042ff0cebf69c355741dd58e4d3ce256a255f6d895fa2984b908152327354428754d5bddb28454e16b63f8ab4e
SSDEEP 192:cRSIcVoiPHYtPv72ympAPRp2/95Hsb+WNPJW1v8Bc0PtXjskwm+VyIsnAUgE:cRSIeoSQHQUXo7wYaq0VXIG2E
TLSH
T1EF42C82EA910697B9CD7D229F9627753E7F5206225902E84EBFC8B2C14E75CD331B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 491a7722690bac7841e3ee05c75fd1b33dacd749ee1403998380e75610e241bf
MD5 457a2b6c28f0b5174d4c37ef0379785b
SHA1 535d669d6bdab80dc62a0910e07d4bf40392bcb0
SHA512 5e7444cc8ba6c959d7218801809916db7c5e7463b27f4689a30c5f2739f4d37921cd8784c605c46c70fbb7ad3de1641b03158b76bba906b67491926661113989
SSDEEP 192:cRSI6VoiPHYtPv72ympEPRpW/95Hsb+WNPJW1v8Bc0CtXjskwA+VyIsnAUgE:cRSIwoSQHQkXI7wYaq0aXIg2E
TLSH
T15E52E92EA910697B9CD7D229F9627B53D7F5206225901E44EBFC8B2C18E75CD331B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e9ad13de288118c8c8b028a399931a602840d7e7a61ecc9396756a536e5049ad
MD5 99956787f9b9b31441c64115f5722dbe
SHA1 597615bd76dffc4186d53813b7c4d3a9a8df6967
SHA512 ec477b7b68a8b90bf4c5227925e3238dfa3c1375e8bc5cc783115fd409aa8a182193beca95a295ddee3b30f2575c7706748e294be9dc99125c1a7fa1244bc234
TLSH
T195B0120180025641C0C302B0124214C871685F149F0A1B0943F46D22CC26571D015060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bdd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589bdd.TMP
Size 96B
SHA256 1d688daafba224314e7247787c0f03d57734728150291752311e9212ccd1d66c
MD5 dd06f1779c32baefa8c1c49bf3cca3c3
SHA1 dfeb04e6bb1dbddda689e53f8ddd3877d2712e77
SHA512 a4557cbc6dfbc453d6aa8fdf560d0dd0b2aa497e628193be0f89dddfc64bfcd8ea2026617f3f2d47b55934390014896cb26793b3520cef70c34a1ccc99576394
TLSH
T170B00265C2066312C1C643F025A6B5E875A4EF25CB03125692F55AAADC257715925260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 3c41c2f83af466b5ebdd587410571a76ed3a78480e6affb8abae8959fcd01532
MD5 1430785af5ae92b914c40969aaecada2
SHA1 9a09c2d18cf6e0cc934b1ca0f832c02c54757d1a
SHA512 59b83a37334859432723f977e966226d8baa53ba00bb2da67a4064778cd24d064c9af50c0bc1a132e1bd2bd5735bf452477150516236e484c05b1354fab756e4
TLSH
T1E0B0228880A2AF2BCE0003B380C280C0B3332C203303BCC230E082A0CC20280C20BA88
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 159KB
SHA256 c92da8aa6e30a181fa28cf3baa868fc1c23a702c62df163841b7ac8340092d2b
MD5 d7c45e9a6e4569c97da924c5b15c351d
SHA1 0e8b66d49d3b0c6893a56276ecbc37a87d621731
SHA512 5e64cdf7d6cb46e028aae0397ed7d0e844d1a5207cce7fb5193fb46f7fd9ae3cf89d719fcedf099bfd7b182072679a0787f26b8388db7ad347d9a2b538fcb368
SSDEEP 1536:qi491yaNj60jRtgcJTxyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsC:p49BjROcJTvqfd7NtZL8cHQRZEQ6Spsk
TLSH
T166F3127AAF852E335D86AF30A5530E9E83F461E6C030D3055DFE3EEF688349569424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41d4a881408fb423b9a9ae5948c3f764d50d10990acde3c3faa0b9a8a544783a
MD5 680cf23a45c6e7d8d3c5bb7dc63d4931
SHA1 9f62e5421d29ce032945da1e8dc512068b520147
SHA512 8a98b4fb81b8e5759bfaadaa388e723780bed920b844afe9905671856f16e8bf2323c010c4f424fba41491e2a9104b23dcf96a65198adbd04a2981e27c71f7a9
SSDEEP 1536:qH3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:kZqfd7NtZL8cHQRZEQ6Spsk
TLSH
T135C302379FC61E339ED2DF70B9130ED793F604A99034D305EA6D6BAB6C83491A54289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 82e460d88e559f495884c050ef101ccd76c1dc32261d6d1f8a4ae9b08ebbb519
MD5 0f9420f48d8eb15902cb788015bf6c63
SHA1 72cb950fc120c8a279cf595bdf3477f967e2f809
SHA512 7c0ea183f6deb59eaaa6d9fc2e2d3159ac1db77241a0db156dc3a4563a39f73d0ed296baac0c20def2a496566fde314110b8ce332d2b21cb41c9ea1359c9f5cc
SSDEEP 1536:BKx3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:CZqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15CC30237ABC61E339EC2DB70B9130ED797B504A99034D305AB6D2BFB6883891658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1064abbde9959bc553ce9a28eed3b3d26245434b7cb1759966a6b36ab94234e8
MD5 ab480a27c18d4ba5045810a32f167604
SHA1 6de9c505ccda68aa6daafdb2e42fff5dcc84bf8c
SHA512 8edbff97b24839b0a8304278d7e3097f49b010d0f73bf214cec1becd6279c7a10e0f2f217dbf99d53dc23b3415aae44169817803e5c5149358826cd719ad7ff6
SSDEEP 1536:TpQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Aqfd7NtZL8cHQRZEQ6Spsk
TLSH
T159C30237DBC21F339E92CB60B9530FD697B644A99034D301EA6D77BF6C8389164428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb1b60fffa793c608867f8d5b97927f7926d920c855b7237c80bd438f1fca59e
MD5 85cee9482b8f136feea0bb76a81e58f6
SHA1 e63c45f7f2937946ecb34fcafd9b3bc32e6445fa
SHA512 f0de55946cf393f749fb1b014353ce80202b1694103fcc1e6e57a601ca65d199bd757fce35eaa17ce79e01c1ed505a357fe9ea365040a3bef2fcc3f3a8f03ba7
SSDEEP 1536:Bex3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:SZqfd7NtZL8cHQRZEQ6Spsk
TLSH
T13AC30237ABC61E339ED2DB70B9130ED797B544A99034D301AB6D2BFB6883891658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 32dda32884f715117b7ec6a18ac4a9b2960b79b54a03641973d4e7522d651041
MD5 161065163d27f6ba178b74785a21e4df
SHA1 23ce44a3b03858856addf72bd9a276ee800bd73c
SHA512 47d8b6ede11581b4f4c56f98ddfb7452bec753c242fc982ec1a018d10b104559e2e4871156770c38bd8aaae9262db3d818b112b6a928c5041d00cc49e25d1f3c
SSDEEP 1536:qex3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:1Zqfd7NtZL8cHQRZEQ6Spsk
TLSH
T16FC30237ABC61E339EC2DB70B9130ED797B544A99034D301AB7D2BFB6C83895658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 26dd300006652531e48910bb28d70a146d067682e3a1319bf21213236792e094
MD5 a790cd352bc9248a474018671fcc24f6
SHA1 03a47735d7cd06c8d34c82d1eb86e3ff15e76139
SHA512 f90ead92c0c874e108f60b0fac84bb5781d3bbb6380f28b8f673db8177a33636ce1986ffc4c45a2c719d00c3cc6427fd8f8a243ef7661e54c9e129d5a42fb3c1
SSDEEP 1536:yH3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:8Zqfd7NtZL8cHQRZEQ6Spsk
TLSH
T18BC302379FC61E339DD2DB70B9130E9793F604A99034D305EA6D6BAB6C83491A48289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 59f4673e75e168fbcb2d6fc707109eb130a301b29b9e0c24eb66a6947ab116d8
MD5 27ee9b237bbf6eed8dfe29cee977a7d9
SHA1 cf9c2c6dfb9f3c28fd9b106ee2a8a67f26328261
SHA512 b9cab4f876d93eccb3f187727d14eb83057cedb0f8fa721a28e1509923eea73c437c9dda3d49c1e6c2359b98098defb88e641b351622f5d5f7e9ed59f2edcc59
SSDEEP 384:Nrf+Jt9p+jhysF6XjjBizIG8V5o9oBWTo/6seYUK/993Howlw3lYkECUvZ:FflysMjoiMoBWToAivHZYFECq
TLSH
T12772B3AE600F16D3C8C21378D11B055FE4F2DE8D531A07D9BB5A9F3B8EACA5E902D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 a1ad7a33f7d433aa1d6296b5d5c493796f7fadab666f4a343a372504fbe25ab1
MD5 e6e3d35d8b0f31409a3f7468301d6df5
SHA1 2e9bbe28109ea7a4c23c3a494b8be77768921360
SHA512 93b4e254a8931e1689ca518ca5838fff4b6d799db5cb365f38d3117d835c2bfca95224cb1e304b3c894d1e565e909016da33987a273fcdcb8c375faa46422b26
SSDEEP 384:mrf+JHk1VHiYNyPJkko9o5AAYY1CucoW22ao3TMdMIl/TcoOg:Ef1VZyaJo5AvXoWYmTMWOt
TLSH
T12A72075D624F36E7C4A213B4D02707AFEDF18DCE838407DD6B99193F05EA76A509A0E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 bd57f8425b798cd1648f2413391d5b6eca48aa6b9a2552bb9ad092410013c61c
MD5 93b46f9ca79cec2fc1ab5afc88739315
SHA1 bd8ba5d95859c9e2db9b864fe850f826d468e233
SHA512 057a28158fb49bc79a2f13036469a1aa7c3db1b6f3c051ac5eeeb42e08bb025fe0513dd0eac5a7c20a13348b4bd52ffe7b3a480286507f0419a7357cee84eef7
SSDEEP 384:hsf+vtnk1YvFL15kVCvDLkfo9o5ATZYY1h1BM3rku4iVjgTu/pUcyADFntO1:GfO2Yv6VwEwo5AT24Or3jgy/w
TLSH
T1AC82295E222F26D7C09623F4D42B0BDFEDB09DCF830507DD6B98593B18E966A48690F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hwunkzac.4lo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hwunkzac.4lo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\Banner.dll
Size 4KB
SHA256 42c9387cb1749bf8338d5a6e6e8f598a22997e4cb9472da8dccc75c44b48f59c
MD5 2dffef22d117e60be69ad89cdd01dc19
SHA1 d39efb73bdc7a5c8f89c1427f0d9d284c501bf13
SHA512 9705ce9b0c2cd1eeeebcb9a951b029ca7b990cf4c4bddac2dbe1c57a6f5dca3f8b47d96a29d3cfa070c317837f9c219646489ef6435ef5014f1b143041770ac2
TLSH
T1F281633BB2F04EF7E563023300830BD3259BA9546728471A4D6791ED7A4A9D7D53DB02
MD5 SHA1 SHA512 TLSH

Submit Download

Header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\Header.bmp
Size 174KB
SHA256 30b2605b256df27baa509ee27209cec3f28ee1fcfe721484bc63dbe644b961bd
MD5 6107dcfb93cad5b9ea18a60c37e3c837
SHA1 a4d8207b7ecd28e4d04ba2ec3735e174ede9f307
SHA512 54154f5da1fd737c341579607a7a278e26abab5531ef93486d518a8bad24d1d4bbaee8b4fc431ade1af7d55964715d75bb7ff0a96c32be24a41a3f8655996d82
SSDEEP 1536:RTL1VM9PTqDF7ZB29FdtXqFZOHJa/Oz8pazH3:NLkTcn0R0Ia/OgqX
TLSH
T181041848F153C90729D2CF3536AEC97A49E278504B9A64F817EA007DB0FE9F046EE572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptionsEx.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\InstallOptionsEx.dll
Size 119KB
SHA256 b03cedb899c8737fabb3efb1d02bb8330ee73ce667aa406a5e52a10aff180db7
MD5 b8c7fda6ec3c8a8ead7d7eccae0b17f7
SHA1 bb1444aa3300e9ab4a7a10c7913ae5e4320b953d
SHA512 52d3ce369418c9fbc7645e8ab272199dd836ebf13fe5019694f01f1686e0708853188b5a2ba8241739620dce98765bdb4fee488189d40c37222a0230b79e6e91
SSDEEP 1536:yU+yEIWirTd+OY4M8D1fb8Li7c3bSC2RVNCSivZYrgr+9MmHZ+WIwvtu1/5bCl:b+y5TlhR8DL2d14MMmHZvtq/5bw
TLSH
T19BC38D403AD1D073D1EA647C9559F37187BF7971AC6688477FA02B7B5F202809E2A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\MultiLanguage.ini
Size 344B
SHA256 28bb063cbd9d8eec0dad21e815091c9a176f15035d5af2d41db4ea6a1f9ff3c7
MD5 55680fc0cd3ba2f74f5eebb05839203c
SHA1 302995226fce4f7025274c3817fdd2e2b5e0941c
SHA512 dc7c53a627ff278fa8961f71d955454253623a4fc176b1c0ae929db1b83d521550a27490e2e9cf1a3a27f98b0e83d8a8088b2292b9b1e96809ec215d8e2c0f5b
TLSH
T147E0E24B25E89415E09AE11CFBF98076D3387408480EC90EC2E34A4F88ECA40102BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\MultiLanguage.ini
Size 2KB
SHA256 af1e3a3f5c834ffdb193b66f210ae2ebd1c35226784b8c05c96a9f5415a3033c
MD5 52ecb771682d7cc8ac11486d6ced4947
SHA1 e57c90364e82e220a973fe3c37477ed1d9603372
SHA512 481439d4b99477e04f229ea6f4994a46f12b472be393dd8ca351edb7b722cd575263b8a655eab17864925f08c7c71cb65970cca98939be8099e38060e0b073da
TLSH
T1C4419D5756E95208F2F7BB08FEB04071DB36BD626C3CD54E82D0090E45E4A50C9B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\MultiLanguage.ini
Size 2KB
SHA256 85478e040357c9911b4ab5bf30578a2cc1022e44a319beb457839b72a9c95447
MD5 99ec9a95e2aa528cd4d7d6db21c561ad
SHA1 65463d416d2ea4ac6008b85b5489b6588b928381
SHA512 825322aad7694eef85242ef3d6d4f23e31d3981528e167df03e7b004f182fa7cc8f0fb9efa15f3b5974b9e3ff02973a163fb597fa2975c6f0e1ffabf8f279bac
TLSH
T19741BC535AE94608F2F7BB08FEB04031DB26BC626C3CD54E91C00A0E45E5A50C9B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\MultiLanguage.ini
Size 2KB
SHA256 f39570ede2a18d1ebed94794152c6f5a9f58eb6b38ca1d96625c4d9b6821bcab
MD5 d359abfed2ac59fa91f2622721395224
SHA1 696ca88da4c4e3e782e90a3ec48393d881573eeb
SHA512 db30fec87da894a4e3a8024361ce034f8b6eed45fda8362068cae6a0f55251082e885f20d8d65997582a887484b09296217bf8b701835e84867d4308001af2e3
TLSH
T11341AD535AE94608F2F7BB08FEB040319B36BD626C3CD54E91C00A0E45F5A50C9B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\SetupType.ini
Size 3KB
SHA256 b40a57242b14d059372e7daf267a8516ffe834a4139a120cd7f527331076c046
MD5 e43f7adcecf527f955aa2c8a43bcee29
SHA1 adb979d1c92a9ea1bfb2d20f55afd916359b4583
SHA512 03898e513a889c2b59b7686036fd2aaf74d79fc48a7d540ff12e0150d0dd7f3e1db9600efb7941b77dd247880411999bfb6e9157d10a45aacb37bb28ecc69ffc
TLSH
T1E3618C233EFC5024E1BAB248EBF58035A7397845581DC81ED1D11A0F48F6E808667BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\SetupType.ini
Size 3KB
SHA256 1022aaeafa518a35031717f6d7d8a3af9c3797031e2f09051a9751f9b14cc926
MD5 a0a451016b1b1b0e7f4c2ef0a1d24452
SHA1 482c687ab842182c111192655cfeb08490335724
SHA512 08696182834fe4e1df628f4464bb8b0157ef82bd6cd523565e2115f56481c2d557f3baa4ae2879d2ffaae1e817463e2bd446329054e1fa4cd93496580d0324d7
TLSH
T103618A233EFC5028E1BAB648EBF58035A7397845581DC81ED1D11A0F48F6E808667BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\SetupType.ini
Size 2KB
SHA256 5f9f24e37bc42555050e3d44978527607a5128f4450f12dddf8700a6cbc11b7c
MD5 b3391802dfc15b4117fb16f517665236
SHA1 fc75b31f51d5df94118805e60f9e14762dc14d9c
SHA512 a7b2ee9c811f3094bf64c61e1382c6f47db31c14734b2a42486fd77fbddfd0bb459135e7b943f6f3a1ae6b2847353118df9e8a2b4aa5735c38fabf8c06c5cc53
TLSH
T1B55129233EFC5024E4AAF248EBF68475A3387405181DC91ED1E11E0F89E6B80416BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\SetupType.ini
Size 3KB
SHA256 402486773cf43f9d0c57e9abd269ec9b7485c5621687f540d3d0abfb4e9b23a2
MD5 375923c76a375a40081d5feb2bbf3fbe
SHA1 01d0cd4d5686fcd73d71c372a54b752825fd6beb
SHA512 19acb9b3eeb7932e25b82cd0ea544f7a92b2d967c77f67a9563a988e3db008374fa26485e87d60fe9cec6d4e4ac41a5f098aed4226304e27211d385f64bc5142
TLSH
T10F618C233EFC5024E1BAB648EBF68135A7397845581DC81ED1E11A0F49E5E808677BEF
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\ioSpecial.ini
Size 1KB
SHA256 396b7557f97eea6bbfbe9bbe1fa6aa189ba8650ea89c7872461f38c3da1fe708
MD5 308dd356bd8d39d1e54be247d0b8d870
SHA1 e4fd3b66b6cd3845fb20be244590200d6e07a2db
SHA512 ca6c4f55cb13e5b569c4ccb9cfb942117b14d8b930900146821a5533c9e44f194b658f48bbed840d049797a058f26599eb081c27a97ec675d9a741011b3c4454
TLSH
T1FD113D032EF94015E2AAF648EBF54130DB393859582DC51E81D10E0F45F9B808437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\ioSpecial.ini
Size 1KB
SHA256 84d7edadb217569149ba9a101dd700d462b2f695ba56497ce850e5dc112ebb57
MD5 0cc83a6d3a6235c5e8ead7b05c36a10e
SHA1 273f3bee99a7c8378ed9d64225a8406d32d919a5
SHA512 413f17f2367320d5b634cf0591702f2ebc74787729f3b9bf34655176ed30dc8f3cb97095813ff826ffa389bf2d20228340a351e437f1005ceb4281ceb58f67d8
TLSH
T1DA214F432EF94014E2AAF648EBF581319B3A7859582DC51E81D10E0F45F9BC08437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\ioSpecial.ini
Size 1KB
SHA256 5febcca15d643f598ed295bb412a06042e0844d9d71ca2393708562eec3b5489
MD5 f319bed6ef8df4404bb1fce5cabd167b
SHA1 597203884c3e1d450c75f31b4166a87adde68117
SHA512 56480c854df11f0bd0bd894bf235355ed142746a64ef17d485e98692f82c570a15f9ed8f3a6bca3375a2c756d355b8c097a119b9cffa23994abf61a8618b7aa6
TLSH
T1CC2162072EF90424E1BBF648EBF54135973A3859642CC91E91D10A0F45FAB808827BDF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\ioSpecial.ini
Size 1KB
SHA256 71a79900658bcd1a9684645468059c60c3dbae0011ad1a5f88a9fd800efb29ac
MD5 53f5f55357987667940bc8d51891339c
SHA1 613371113b72e7120706b19b3fd491da3054cad9
SHA512 3d01d3ea2f26b7a805b14bc92dde41557b9fcbfe67fdc914f1292355c9d5dd32eab3ebfb9b6973e066aa007ca522f82f39f53ab72e661cc185a0c8e1b603ac57
TLSH
T10F3183032EFD0428E1BBF648EBF5813597363859542CC51E91D10B0F45F6A808927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\nsArray.dll
Size 12KB
SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
MD5 da4bc09439ed21faf7620a53433aac92
SHA1 94e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA512 920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
SSDEEP 192:LULA8tZt1pehCUVFpZ/XXz5F8qioPYtS/Z8i4NVhWp1h2ph30R:gLAe1peEUD/X1F8qiAFLhOh
TLSH
T14142F8429F9142F2F9F74276B9BD1930292DAD01AB2ABDDB032750582D20DE33E35753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcessW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\nsProcessW.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjC9DA.tmp\nsisXML.dll
Size 12KB
SHA256 35e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
MD5 c5285d861243f3b41648af5c0ffd5678
SHA1 50012e20b898e2f1abad27a4bdca12033e618add
SHA512 92c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
SSDEEP 192:3/ufSdX+LHASTxwSODR2bzdA74gB0jpYEfb:3mfSEL9lwpRv50FXj
TLSH
T1D542B5033FB6D9F7C84A1275BF8AA796D6F4630524800C06D3560E1E6F318AAFD7DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloadedCertificate.txt

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt
Size 476B
SHA256 4c36de43aede9c106d04c24d8f2bcbe7e74cb92b42fd88177c6ed932812bf9d9
MD5 e360e7700227921533270fa0ba500cdd
SHA1 ca21c2d3940d5543d4403e8b03a9563c2f375933
SHA512 456c20e23b4fa7a72ee32044d86f581a46fcd5b55c562085fb94dd6a00d823338bda9e313e936f6e5d0898905e3e97b3581532bb601e667cd9054d9913da1d46
TLSH
T150F097787314D9AAEA3D3CE5CC040BA1C709155A83D4E8A0A23D88173997023EF2B3D5
MD5 SHA1 SHA512 TLSH

Submit Download

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\script.ps1
Size 656B
SHA256 1a569fbaca7103ba08baa6c817826fbb907772bb46c6c836999ca956819269e4
MD5 17444f73a11cd36991f6a7416a0ccc21
SHA1 d9e162bc3df5220403078756b41d49eebf56af57
SHA512 355091a8bf0b77d904944a2d59913941114fe2bc57b64ab97a75224668771b86d879cb580248474edb37102f6132a5bb513c31b2eccb931ea81d5bc20fba533e
TLSH
T13BF04E18DC457D13A95297B8DB1378ED8D4D81FF41825841B0F29A897299531DBFC2CB
MD5 SHA1 SHA512 TLSH

Submit Download

versions.xml

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml
Size 5KB
SHA256 c9d159f8cd6b7a711b77f28267e0182f37d951f0180f64eef0a5100c5b7a443d
MD5 7d3e5025529d3f44190b57dfe010c438
SHA1 70e9520dc8241c1e10dcb921c3e329ea92cf720b
SHA512 4baf72cb15015848ba02e83e9f0255d7f781193545c4fe87cb77f9c9868e1c9448f46bf63137bec6ea5e22dfdcb85dd3e11da04673ace9991b96b773a0b2a256
SSDEEP 48:cfXPxoEOACcbzn9VDSeUJnmKoGzLmhzxXztfl2eRG0NL7/4SmbzGfcje1KR5DOHn:8OEdCqY6ZxshvMHH
TLSH
T11EC1CC3B4943EFA32F5C7BAC61D669DDF2336038BCAA40CE5CAD8E414D9B156347114A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrarinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
Size 3.7MB
SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
TLSH
T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 841740a6a194962f445ef93f74c5a7afdfea9b85cb433d092dd69dfc2d98fd75
MD5 7711f64004e32373782adf7f4dff19f1
SHA1 b09ffca0f1607a97d8cd8d0ca7ed14ba58436195
SHA512 90fe1ca6d517a8efc1512dfd65f3ad9b80106060a8b8293d01c68a044c2186b46d7f41a9dc916234e94b505b1202c1b10d378669502fd38030a976a92d35881c
MD5 SHA1 SHA512

Submit Download

Set-up.exe

Path C:\Users\Admin\Downloads\Software Cloud\Set-up.exe
Size 3.3MB
SHA256 1882d6005d1b5be5049b73224b84161fbfc05cb8ccada8b5381e129833b204dc
MD5 662c3bbb7beef662aaca93e3601aa6d6
SHA1 4b8f096257ffd87830e903caded9c811b043d850
SHA512 8e176fc6947258f86215b9baa5c72b8231d86c58e01d7a8cc9a3cec10131a08c566c469341930902becb342c2fe7789fde8fa3428f9c31e1427edb9ac8d40bcf
SSDEEP 49152:nsM4a8PfgAs4n/HxSBjcayiFoGnHMYD25trcSe8Xmbwh41WfChD:n7ho6jcahoGnHvStrcj8WU4W6
TLSH
T19AF5334FF9C934D6EEA70FBA1AADC281473037346BC4CF4BA66471369FA19918C21D91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-2095-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/220-2082-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/220-2083-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/220-2079-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/220-2094-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/220-2097-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/892-2089-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/892-2093-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/892-2102-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/892-2104-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/892-2092-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/1060-389-0x0000000005000000-0x0000000005022000-memory.dmp

Download

memory/1060-401-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/1060-400-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/1060-397-0x0000000005980000-0x0000000005CD4000-memory.dmp

Download

memory/1060-390-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/1060-387-0x00000000049F0000-0x0000000004A26000-memory.dmp

Download

memory/1060-403-0x00000000064D0000-0x00000000064EA000-memory.dmp

Download

memory/1060-391-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/1060-402-0x0000000007600000-0x0000000007C7A000-memory.dmp

Download

memory/1060-388-0x0000000005150000-0x0000000005778000-memory.dmp

Download

memory/2468-493-0x0000000002B00000-0x0000000002B23000-memory.dmp

Download

memory/2468-424-0x0000000002A40000-0x0000000002A63000-memory.dmp

Download

memory/3928-1532-0x0000000008110000-0x000000000863C000-memory.dmp

Download

memory/3928-1531-0x00000000070B0000-0x0000000007272000-memory.dmp

Download

memory/5468-1357-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/5468-1366-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/5700-1383-0x0000000070110000-0x000000007015C000-memory.dmp

Download

memory/5700-1399-0x00000000079B0000-0x00000000079D2000-memory.dmp

Download

memory/5700-1400-0x0000000008930000-0x0000000008ED4000-memory.dmp

Download

memory/5700-1393-0x00000000075D0000-0x0000000007673000-memory.dmp

Download

memory/5700-1382-0x0000000007320000-0x0000000007352000-memory.dmp

Download

memory/5700-1384-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/5700-1392-0x0000000006910000-0x000000000692E000-memory.dmp

Download

memory/5700-1396-0x0000000006110000-0x0000000006121000-memory.dmp

Download

memory/5700-1395-0x0000000007910000-0x00000000079A6000-memory.dmp

Download

memory/5700-1394-0x0000000007710000-0x000000000771A000-memory.dmp

Download

memory/5756-2069-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/5756-2070-0x000001EB7DFA0000-0x000001EB7DFA1000-memory.dmp

Download

memory/5756-2072-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/5756-2073-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/5756-2078-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/5756-2077-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/5756-2074-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/5756-2071-0x000001EB00040000-0x000001EB00041000-memory.dmp

Download

memory/6056-2087-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/6056-2098-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/6056-2099-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/6056-2101-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/6056-2084-0x00007FF740650000-0x00007FF7409A8000-memory.dmp

Download

memory/6056-2088-0x0000000140000000-0x00000001402A2000-memory.dmp

Download