Analysis
- user interaction
yes - max time kernel
600s - max time network
578s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 07:50
Behavioral task
behavioral1
Sample
.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
600 seconds
Behavioral task
behavioral2
Sample
.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
600 seconds
Behavioral task
behavioral3
Sample
Forza Horizon 5 Opti 7z.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral4
Sample
Forza Horizon 5 Opti 7z.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
600 seconds
General
- Target .exe
- Size 3.4MB
- Sample260930-jpl23azbqa
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process \??\E:\ explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe \??\F:\ explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240816578 .exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe .exe File opened for modification C:\Program Files\WinRAR\Resources.pri .exe File created C:\Program Files\WinRAR\WinCon.SFX .exe File created C:\Program Files\WinRAR\WhatsNew.txt .exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt .exe File created C:\Program Files\WinRAR\Zip64.SFX .exe File opened for modification C:\Program Files\WinRAR .exe File opened for modification C:\Program Files\WinRAR\Descript.ion .exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm .exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\Rar.txt .exe File created C:\Program Files\WinRAR\Order.htm .exe File created C:\Program Files\WinRAR\Default64.SFX .exe File created C:\Program Files\WinRAR\RarExt.dll .exe File opened for modification C:\Program Files\WinRAR\Default64.SFX .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png .exe File created C:\Program Files\WinRAR\Descript.ion .exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt .exe File opened for modification C:\Program Files\WinRAR\Order.htm .exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst .exe File opened for modification C:\Program Files\WinRAR\Rar.exe .exe File opened for modification C:\Program Files\WinRAR\7zxa.dll .exe File created C:\Program Files\WinRAR\RarExt32.dll .exe File created C:\Program Files\WinRAR\Zip.SFX .exe File opened for modification C:\Program Files\WinRAR\License.txt .exe File created C:\Program Files\WinRAR\RarFiles.lst .exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX .exe File created C:\Program Files\WinRAR\WinRAR.chm .exe File created C:\Program Files\WinRAR\WinRAR.exe .exe File opened for modification C:\Program Files\WinRAR\RarExt.dll .exe File created C:\Program Files\WinRAR\RarExtPackage.msix .exe File created C:\Program Files\WinRAR\RarExtInstaller.exe .exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll .exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix .exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png .exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Default.SFX .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png .exe File created C:\Program Files\WinRAR\ReadMe.txt .exe File opened for modification C:\Program Files\WinRAR\Rar.txt .exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst .exe File created C:\Program Files\WinRAR\Rar.exe .exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe .exe File created C:\Program Files\WinRAR\Uninstall.exe .exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe .exe File created C:\Program Files\WinRAR\WinCon64.SFX .exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX .exe File created C:\Program Files\WinRAR\License.txt .exe File created C:\Program Files\WinRAR\Uninstall.lst .exe File created C:\Program Files\WinRAR\UnRAR.exe .exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png .exe File created C:\Program Files\WinRAR\Resources.pri .exe File opened for modification C:\Program Files\WinRAR\Default.SFX .exe File opened for modification C:\Program Files\WinRAR\Zip.SFX .exe File created C:\Program Files\WinRAR\7zxa.dll .exe - Executes dropped EXE 2 IoCs
pid Process 1900 uninstall.exe 1228 RarExtInstaller.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RarExtInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname uninstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain uninstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RarExtInstaller.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 928 chrome.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r18 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r26 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r06 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r12 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r27 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r08\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r04 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r05 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r08 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r13 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 2840 chrome.exe 2840 chrome.exe 896 explorer.exe 896 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe Token: SeShutdownPrivilege 4268 chrome.exe Token: SeCreatePagefilePrivilege 4268 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 1916 sihost.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe - Suspicious use of SendNotifyMessage 59 IoCs
pid Process 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 4268 chrome.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5832 .exe 5832 .exe 6068 SearchHost.exe 1780 StartMenuExperienceHost.exe 896 explorer.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 5832 wrote to memory of 1900 5832 .exe 90 PID 1900 wrote to memory of 1228 1900 uninstall.exe 91 PID 4268 wrote to memory of 2508 4268 chrome.exe 98 PID 4268 wrote to memory of 6012 4268 chrome.exe 99 PID 4268 wrote to memory of 6012 4268 chrome.exe 99 PID 4268 wrote to memory of 928 4268 chrome.exe 100 PID 4268 wrote to memory of 5696 4268 chrome.exe 102 PID 4268 wrote to memory of 5696 4268 chrome.exe 102 PID 4268 wrote to memory of 2056 4268 chrome.exe 103 PID 4268 wrote to memory of 2056 4268 chrome.exe 103 PID 4268 wrote to memory of 2932 4268 chrome.exe 104 PID 4268 wrote to memory of 2932 4268 chrome.exe 104 PID 4268 wrote to memory of 2492 4268 chrome.exe 105 PID 4268 wrote to memory of 2492 4268 chrome.exe 105 PID 4268 wrote to memory of 1996 4268 chrome.exe 106 PID 4268 wrote to memory of 1996 4268 chrome.exe 106 PID 4268 wrote to memory of 2440 4268 chrome.exe 107 PID 4268 wrote to memory of 3656 4268 chrome.exe 108 PID 4268 wrote to memory of 3656 4268 chrome.exe 108 PID 4268 wrote to memory of 5360 4268 chrome.exe 109 PID 4268 wrote to memory of 5360 4268 chrome.exe 109 PID 4268 wrote to memory of 1244 4268 chrome.exe 114 PID 4268 wrote to memory of 3856 4268 chrome.exe 113 PID 4268 wrote to memory of 1244 4268 chrome.exe 114 PID 4268 wrote to memory of 3856 4268 chrome.exe 113 PID 4268 wrote to memory of 3956 4268 chrome.exe 115 PID 4268 wrote to memory of 3956 4268 chrome.exe 115 PID 4268 wrote to memory of 2916 4268 chrome.exe 116 PID 4268 wrote to memory of 5004 4268 chrome.exe 117 PID 4268 wrote to memory of 2916 4268 chrome.exe 116 PID 4268 wrote to memory of 5004 4268 chrome.exe 117 PID 4268 wrote to memory of 3448 4268 chrome.exe 118 PID 4268 wrote to memory of 3448 4268 chrome.exe 118 PID 4268 wrote to memory of 5056 4268 chrome.exe 119 PID 4268 wrote to memory of 5056 4268 chrome.exe 119 PID 4268 wrote to memory of 4156 4268 chrome.exe 121 PID 4268 wrote to memory of 3784 4268 chrome.exe 120 PID 4268 wrote to memory of 4156 4268 chrome.exe 121 PID 4268 wrote to memory of 3784 4268 chrome.exe 120 PID 4268 wrote to memory of 1512 4268 chrome.exe 123 PID 4268 wrote to memory of 4752 4268 chrome.exe 122 PID 4268 wrote to memory of 1512 4268 chrome.exe 123 PID 4268 wrote to memory of 4752 4268 chrome.exe 122 PID 4268 wrote to memory of 4024 4268 chrome.exe 124 PID 4268 wrote to memory of 4024 4268 chrome.exe 124 PID 4268 wrote to memory of 4332 4268 chrome.exe 125 PID 4268 wrote to memory of 1308 4268 chrome.exe 126 PID 4268 wrote to memory of 2032 4268 chrome.exe 127 PID 4268 wrote to memory of 3948 4268 chrome.exe 128 PID 4268 wrote to memory of 3948 4268 chrome.exe 128 PID 4268 wrote to memory of 2840 4268 chrome.exe 129 PID 4268 wrote to memory of 2464 4268 chrome.exe 136 PID 4268 wrote to memory of 2464 4268 chrome.exe 136 PID 1916 wrote to memory of 896 1916 sihost.exe 142 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1228
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1420
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe76e6c728,0x7ffe76e6c734,0x7ffe76e6c7402⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11363309922386019140,2180515345697653103,262144 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,17639342218253898250,14134349111984085782,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:112⤵
- System Time Discovery
PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,14350089336818590917,5980710173125343061,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:132⤵PID:5696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2732,i,9638322529597555828,17106276125513066954,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=1928,i,10345483587917690839,10790985978648540519,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,17352676042784987816,7117392345695049594,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,8667468136401003691,17798343308876348171,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:142⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,16797545816534300030,6132363552923041839,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:142⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,4109598740952932912,17639218483058681001,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,16303183081955682970,3140513401279660615,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5428,i,9553614421272698014,16879212606282984349,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,8271348003362062433,2687957352976748584,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:142⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,17933583335784415909,9666860236826623534,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6276,i,2731370347619405297,7298684053289365467,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,3504217894715250938,7568785202935081841,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:142⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5820,i,4599966183109924529,11771820683530253438,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6388,i,1071672399538214372,14766997308363964312,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6156,i,12363475831930622930,18070973453380335218,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,8396738960041163095,8170634592022036166,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:142⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6360,i,4389010321184324920,8811469662389516780,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6064,i,13116775522154810582,9878563740182551317,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:92⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6068,i,926026166341134459,4589342637961900069,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,18090240537049561986,17521204242454027508,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:142⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,3579272391136341623,3976026008011085154,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:142⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,5367712984102501034,16877290911564827554,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:142⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6012,i,7430639366466495293,4835606072099627072,2097152 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6304,i,8279766652909019070,13360917321306902188,262144 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,14638350816420697583,16705322769986201670,524288 --field-trial-handle=1960,i,9509373469434929799,11017211646041470413,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:142⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:4948
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:896
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4020
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5656
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 109KB
- SHA256 59334a8ffff612755a64a912389bc23fbc35933cf209f845bde34f055011b8a6
- MD5 b689a0cb8c288849febffafc2144576b
- SHA1 4cba85fa8ac528c3ac0af6356cdb912a0ae4199b
- SHA512 63e3dcae9a5a7373b7f5fdd661ae624a27e8f72ca86cb1be91533575ae115cf874bc0785350f00e919694b36b4745e6fa581252ec0d8a9ba2a99cef20e26b247
- SSDEEP 768:doxKukh1SIfjcjKJUjnc4JRb+aT9E1qYiHSGot7uj5dKiu18ewxJfkIjxDftKWkH:doxKuOKKi9bbR99S5c61Q7MaF1KWB4r
- TLSH T133B3D8277E8E1371297241965F19A199E31050EF371E129538EDC38C7F3A8A293F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 179KB
- SHA256 48b44bd3342a68ecbbd40a485930a22e02fdf157b2939ee346c2b123f6d5e99c
- MD5 1e1cac0725cf47e62ea96669eac678fc
- SHA1 bbce70aa9d4177e637c41673fff97c77e932d672
- SHA512 9a0f544349a0dc6c4e1335d6ec5d84d29904330c3f93c3d88f3d1daddd6499851e624532b5d3d7719e42e16267371a3cd820eb18efcdc27a3312ca5e3646b614
- SSDEEP 3072:QYMVL7FtFKSRTalv9EGPvPjTiB37HIv71F6v8oGtn9:QYMVL5vMvauPyB3o1c89
- TLSH T1E7045C47B3A521FCE567D23888924605FB7278365B708AAF1760437A5F237C1ED3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 10a9e66b22922211668c9d9be62e309e824ca72114be9e0d090c15ba297ca787
- MD5 9301f2ad24daa60404407053635cb2ad
- SHA1 a2df6e5af472dec9594d32b9595feeb4c48c1c44
- SHA512 14ddf7c2cb464a9e5156b023efaaf428b264606cd6cf01eaf96ea0f0c192de7c7b3960c66ef67c2fed90d8a4764a0673e720fefa0300f225653f9b1fe4f6d1c2
- SSDEEP 384:LZR015ziBz4oqvhFv+qkDGm0fxPZF7SxEDHV6sZd3NsKYoZ6SWoSoI5f7Y4IyvoF:fYzMzHshFvbkDdoZw6MsZd3UOVVu7Zab
- TLSH T1F3B2C0F2F34A3A2BCB4CC1778B661D305960FE604813CD827759299846B8B790365BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 429KB
- SHA256 fd934c3b663679041b82c12d60b14c51060d8d04742612ed5f9cfa82cccf1d37
- MD5 8e1a194cdb986b277e44afbf419d0bd7
- SHA1 c6a46bfb7e829fc710fbe668900a80efdff9c36e
- SHA512 3e64edeed5e50927e1c758e9788be5778af2ad3c52ee1cebf19dd020fe2378f2bf375f0a65bc87c3ffb4c3dc13133b4f9cd3f7d627310011e1325c1073634fa1
- SSDEEP 12288:gSXiav7Nwt8OVYPqo3YlgaAjvwBhvBJ/+5IISY1AE7:bS4qiYlFAjoBhvn/+r1z7
- TLSH T16694BE5863E80CF8E9B7923DCCA28616E6727C524B30C79F0761165B5F33690EE3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 105KB
- SHA256 bf30a7d667b61a90bc00908317d96599386c841759540bdb74ca249e28ec8624
- MD5 c78a76e698514a835452de89025b7778
- SHA1 091869306172f2b6fab1cd47ed2d4bbf1527321c
- SHA512 8696a6c11534b588a6feda356d2f9d9ee92547fb95e899490b3f355d08fecae73fc494a7817d5ad29924c7e9e61072a963aa6e59d3724145ecd3bfdd26495f9e
- SSDEEP 1536:owXicDYb3fXxuqo3t5Vb5dMJeKLCD0TAXNG/MNWM9Lmh5BuM:tiSs5OFS40TCRyuM
- TLSH T1FCB3B6237E5A127229B242826F156256F318A1BF270642C47D7D838C7F36997D2F72F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 317KB
- SHA256 9d96fddee6df94a3b6bfa731e962d31fedd4d8123aaf29c231b06f0cc10a2b2d
- MD5 6bd7d6deb6aa6c798e6e011b7eee9838
- SHA1 6766b040128e1a364e8f9f877b6ed18f37b878ce
- SHA512 8e422346cf91d4757310919a6abe67ccff60dc84ef572d76fd8863bd2201dbc1c27377c382b4bdbc71c2a2f866eb1604f01fcb0d979594c22c43cd2db8877342
- SSDEEP 6144:DOmlAJDCI/uXnxAzZYuY9Qyt7KnTQiEo4LaBfDBjU/4ftmueyUF:ZlAJ7+nxWYR97Knc1WFgwfw4UF
- TLSH T1796412199D6D4073FEC93D39E8EEB3EC775A04920655BA5A2A4F8D3060D8FCE2398711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 2.4MB
- SHA256 0d068a6aa2df88613e1c5c7ba412a5a5bc3cadc3f3ab4b76d10035ba8eec27bf
- MD5 928b05a72bdc940c450f059902691501
- SHA1 7931b85054c29be4cc3c9250a5dc4a821a446040
- SHA512 de47b4f9065bec41671f17f0fdd33d324e9204f323fea863774952ceaa05f17106c46ddc118c15a2fdb75d1313b6cc91b430357fa3a11d13355869507d075788
- SSDEEP 49152:mlLEkH4q8hy1JWFeIrk/agsMod2ZPybt+9ZjeLBzNwui0hBdH30U:44q8hyyCX6LBquTBpkU
- TLSH T169C5AF4663E840E8D0B7D778CA669617EBB17C525F30CB9F11A1998E1F337A09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\rarext.dll
- Size 658KB
- SHA256 5f21fd414a3767df77f31be26352fc2fe63adbffc75ee48ae4ade06deef07b50
- MD5 d0f4632be7031cc372ffdd2d9063ffb2
- SHA1 b99f58ae5b6d169be95785a9a25ef27582e194c9
- SHA512 c620ceee308daf1cdd83568529042f17929dd4aa29d3d092b63fcd7b4751ff912247e68de2788c7d225a69f3d2c1dbfacdba2841c85a11308a029612e38c5595
- SSDEEP 12288:dyIL0neePxyNZAcG5e7kv0E4doo6yPApu2Giw/iiiTQBd3X3uc:dwnVPxUKe7kMEieO/riTQBd3X3T
- TLSH T1B1E49F49B3A802B9D5B7D17CCA87861AF7B67855036197CF03A09AAF2F237E0563D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\917f881e-34dc-4896-a6df-5bbf6281f44d.tmp
- Size 12KB
- SHA256 2c41ae807d6d1f73d57faa4c6717041f33268822224cc24657dcb5e9f00c463a
- MD5 1daaf40519c6ecb8c4831f042b6ff1d6
- SHA1 7d9f99cfe4b18d58ae1556d7a1896bc4e7054f94
- SHA512 710ac9be1f2453f836da40076239e05a6586cf3430a03d478307a062e2a90c2063e0f45a1ecb12694ad76c2934ee88f2225670c3d4e2640f6596f9821bc8bf39
- SSDEEP 192:qRncBzv0CFv7sqPRpQ8Sx29bHsb+WNnL54Z3ESSSFtvkwYCnVyIsnAUgE:qRnmzvv1fXOABwtaEqF14CBE
- TLSH T18242C52EED50797B9CDAC229FA61BB97D7F1102160941EC8E6FC8A2C11E76CC7217413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
- Size 346KB
- SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
- MD5 fc31feb6dbd996017ba0751ebf1a2be0
- SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
- SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
- SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
- TLSH T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 936B
- SHA256 513f9cba551d413f73fd469a4e1a56762d08e734d6ebd9fb74cdf666f2cd4dae
- MD5 e37619e5ca2dbe654090efec6ee258f8
- SHA1 b4b436e2ae02f89d0d9ed08a8ac01505e7e3a47b
- SHA512 9b01f40fce628c4bdd693092c4c65c35dd0ef83988499cef7d07f7a99e5ba60072e5bd9303446ce0ea1ccb7556970b8b124a562cc54a4b9ad040db0101c0ec01
- TLSH T1ED11684D2652780BCBB53EBD0CDD417B26074A7A0372364D88CCF0C43C1327A1818A02
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 32864310797d6ae265d955d59d6c582f58f14ad107f25e11c061050133f0eea4
- MD5 77ad6b5c3957b6ba721dd71dd941c46f
- SHA1 822559bae290dc405356c10e9135a4da681e0e67
- SHA512 e37a617b2c80c74e87b704f1d6e7dda4d61855ae3ed1d4a67d7a1b3a1ba07e414927ac24fb118e788d96ee14e6d4b4cb433bf71447aefa95dd4dc81e0ada457d
- TLSH T133C092EC12616212F77D4ABA01A6120F72370924076665E9C1C0D6A8BC2367F5908D20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 fc65e3c6d58ff96f3658a13fab8c453e8e847ef8f85d00c5bd1f9e96113a5bdd
- MD5 cc689859c3a94d04f7fb2658334a8538
- SHA1 251d39ddafef44dc5a21e6b50ce73f5ecbaaf4cb
- SHA512 47024573f7d0dc96e78a28eda83b55f2bcb63b498d5b245d51023e6e51bda2174da35236293e1af30ceca9dc88e5c2721018caab8961d9f770a2945a91c28d24
- SSDEEP 192:DpJO8Jupj2H5J+JQQHiKTY2VuPwaPgIUI+1vqbXfPtNPr9jh3W:DpJO8Jupja5J+JQQHiKTY2VuPwa4IUI2
- TLSH T18EF1BFF7C3D8C62DC81556F4AB256F2FCE2D0A18432D3C26C8E9AE5B93E2471D25524E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 b4d0abb26debd69a733ebe7b1b245afdb039218dfcf9db87055d1a01c06a0c0e
- MD5 1e0bb6633b1fb9051ba2d66396197095
- SHA1 7f45837e9d72ced36f8f50829e2a38bec9465f5a
- SHA512 d4732e1f85ef2c76a332715ccece702e41e4d0844183a1ecf646f2e2dfd15433dc5bd74fe10ca9cecda5126f12e521dad847e4dacd0f0f304ef808201ee727c2
- SSDEEP 192:DpJO8Jupj2H5J+PQHiKTY2VuPwaPgIUI+1vqbXfPtNPr9jh3W:DpJO8Jupja5J+PQHiKTY2VuPwa4IUI+B
- TLSH T102F1C0F7C3D8C92DC81156F4AB256F2FCE2D0A18032D3C26C8E9AE5B93E2471D25124E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 d449cb5ad4f92a4588dfe6c4975b3b1bb69449c83ec470a2a35b954a527aacc4
- MD5 a58c9f620affa933f8689c0a59a8d62e
- SHA1 2f332b732a1cdd7d1b0b63ae497a1fb7973e6e5f
- SHA512 94070f25a28312f69ffcf850d65bfa6f86b71bf7b740282282c0846ae7cded04fb2370e898d8c24b5a7521d3c82f75849c479b19aad2574d319f6d1c30ebfc89
- SSDEEP 192:DpJO8JupjfNQHiKTYEEVuPUNPKaPgIUI+1vqbXfPl:DpJO8JupjlQHiKTYEEVuPUNya4IUI+1k
- TLSH T12EE19FF7C3D8C52DC81556F4AB256F2FCE2D0A18432D3C26C8E9AE5B93E2871D25164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 a7460410186644bb8fd150220765947336555ced68c7c4eb53ce3024de06fd1b
- MD5 c44bdf0f27999ec679b93ef0030cbe06
- SHA1 7ca91326bce695043be16e2b002373b6bb0370d0
- SHA512 c5672b5756b0e7e5e0208b5faa074eb981fe7e528bbe515b11ed8f8129238fa0f0f71202d8084259f3a45bfa1b3fd82e039281ecb5ae1ab86c19369bf92897e1
- SSDEEP 192:qR7vACXv7sAPRp2P9bHsb+WNnL50pSSFtvkw1CnVyIsnAUge:qR7v7/JX4Bwt0dF1VCBe
- TLSH T1CD32B32DEE10753B9CDAC22AFA61BB87D7F5002161D42E84EAFC8A2C11E76CC6217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 371c898cc951531af35b5972faf02d490f95bb7e11af6c9ac1f9bc41bb8a6d9c
- MD5 ae1c44401dfc8e55c9717ce43f21eb84
- SHA1 8a989fa7631636c3763a987035c43fff325600e6
- SHA512 69f8172e36d1be0dc99be9d0bda7458b74fecc1e79bb2099557afea2dea2aa3267de0eb547f53b0e38c90545cf08dc6464d6cec96ebfdf31bdeffd09923d0840
- SSDEEP 192:qR7vACyv7sAPRp28w/9bHsb+WNnL54hX2/SSFtvkw1CnVyIsnAUge:qR7v7eJXwBwtq2/F1VCBe
- TLSH T1A442B42EED10797B9CDAC22AFA61BB97D7F5002160D42EC4EAFC892C11E76DC6217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5abebbafd4af579bd37e917227fa98f2d0556a62992a40790a81e06c8034a74e
- MD5 b93c42b6dbfe6a2283e47288c9146672
- SHA1 878dacfed46ec89d36c66c55435b2a4339dbee95
- SHA512 ff46dcc310e5929d26f54e1a5b3086edab95b802fa89d75e52dedfe4e063f8a9fb6ff7ce3ca0cd67fbb95be6bdcecc290e8b9b6f632a73392b4035cd98bc17e9
- SSDEEP 192:qRncBzvACyv7sqPRpQ8Sx29bHsb+WNnL54Z3ESSSFtvkwYCnVyIsnAUgE:qRnmzv7efXOABwtaEqF14CBE
- TLSH T1F242C52EED50797B9CDAC229FA61BB97E7F5102160941EC8E6FC892C11E76CC6217413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bacdf7b8369b9524f15b8213fda1d6130b89775637285a2ca5b34b97a2ec9d4b
- MD5 0d7cbe5365ab8a9d4086ff73eaf4467d
- SHA1 2cbda020e585231ac5a8104c57faeed52ab6af4d
- SHA512 51d864ef652ca7205982466c77b56dc61012ec6f1c76b6b3cd41beefba3efeaf2ac5a45ac1ca42999b8c046903553b07f2999335a46bc649b780a1be4593f339
- SSDEEP 192:qR7vACDv7sAPRp28w/9bHsb+WNnL54yoeCSSFtvkwcCnVyIsnAUgE:qR7v77JXwBwt2e6F18CBE
- TLSH T13E42B52EED10797B9CDAC229FA61BB97E7F1102161D41EC8EAFC892C11E76CC6217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 115dac8424ce168fd1057f9b9d5cfbf6e081a3a8f8743c5d8d0f58ce1c61e16e
- MD5 5c88983f8c995097d1958bcb0eb56c12
- SHA1 2b7e5195c1ce337601d488265cad2c2059f8ec31
- SHA512 1d4fc39f2a7e0af8d7b32bd57a04d5993dbbe8ad0c54df80fb42b2276f1934449d678cfb305b390ea8a1463923db9fcf5d48cbaf7d91e387eef5b5b0ae0a5fb6
- SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU3H8HGJ7sXSxbdpiFafH:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtp
- TLSH T12F520B67A84C993F0FD8DA4CCC266F8FACF502566278096492FB5C1803D97CB114A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 02466e7bdda8d950c986af614e2a08e7ec31402b31e44c7af2791cd61dcb4da3
- MD5 efa47a5ba5e8fcc982ad988f82fa3d0b
- SHA1 f3463de385b964b3df6b1ffa9936ebb495615d12
- SHA512 0dfd63553100b8a003a9365f0492fc150b696930f344f2eea987de09ba42037762255335eef5b1c11e7f556e5a4b067a478862d43d8b3b21fe865a2bc8b245b4
- TLSH T15CB0118AA0022A02EA0003F000E20282323B2C00A2AA00C280F80220BA003A083A0202
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 0e1090d34dc75dc182fbe4471b6c5287fda68965854887488f2e62e40a2e4d5d
- MD5 133940297d6dc8e08699749794b8ddbc
- SHA1 3b23b2420a331feb95bc5c6feae3c34800eb8e25
- SHA512 643b6ec22cd41023f980a522a0787c53538ca198845ad7005486580db8e88d9fe1995e4d74cf091dec412d4dfc1086e6f8eee79235967e14c75069040f541cc6
- TLSH T1CDA0022885C05916CD19527260A1464B36F75D1555D25707B8D61444FCAB1C44101A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ca32d.TMP
- Size 48B
- SHA256 0c4717ee641320556f9418ce9bb03cf61c8f7351a05dbabb4497fff38ca70b5b
- MD5 d4d95b035b3921f0cee6273860578e35
- SHA1 a2264491e7f24256a9798d51ee774d691183e09e
- SHA512 e23826fbfcb7e3b1782643c789e62aa21c37a341099cb1e7d5f1569c31a7ff23f0caaf8748e062c8d0f8ed4d124980f7093e9cfe497158d4e6a2cb8c6fd56e94
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 139KB
- SHA256 da8c14e8b9bfc5db8665d293eddc0bdd44a15800247927d336d6a4e5875744fd
- MD5 90704c7cb9540079d17ad9e18e1ffac1
- SHA1 54ca71910e36fb4adf4c53ddbb167f5fb05308d9
- SHA512 fc48292d43d64a1cb018c78648ea15e6d35fa18108b3c8ec807f4429bfd0a0fef516d41aa2bc61af43c8c0ef7a72aab0bba69c47ef86fa2e4fe5442d334df570
- SSDEEP 3072:jYq7tF+fPkWxrC1DsJYQ8Je8HOtSWp7M/5SiwFtAu29Zo:cQrWMy4s+Je+Otv7eSOu6S
- TLSH T1ABE312B2365BFFF9B9215552140B34011CECF6A6EB219EF46DD05F08AAFE0804AA7B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 139KB
- SHA256 8fbcc62df382311f1fe9754a0dfee581fe70e0db183ce04bd1373035eb74923a
- MD5 08725b506132a42e5d9f395eb52ef197
- SHA1 018f14faaa69cd8785a0e38b9685a251be4b4921
- SHA512 18dd4349f8213a48b52573c89710c3b8b55d4a235a39298b85512ec0ad04a8f26a0d8a854379a5bab37cc255dd7b4cf0c8ca38de994ba3a9433c8d9b3c7b051a
- SSDEEP 3072:9Yq7tF+fPkWxrC1DsJYQ8Je8HOtSWp7M/5SiwFtAu29Zo:+QrWMy4s+Je+Otv7eSOu6S
- TLSH T149D312B6325BFFF5B9655226640B24051DECF770F7218EF05AD05A08ABFE1805AABB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 174KB
- SHA256 04bd7c981a74056c6c052b1aef699b920b4c23e86557dd873febfc23e4b98bdc
- MD5 27ff1f4efc625f8c473d5757da804eff
- SHA1 d4745239e8a39d2010a599542bef3b31c5d0bc69
- SHA512 82d2e5188a230928df5b5c09baf4c69da91f86b66d4097b63c886ca3b5b7a6b86a2ad0055ac236b137ed5e4d0a08c73d3329f02e388846d9aaadfae4ccaac5b4
- SSDEEP 3072:8QqQYqB/o362+o0Yq7tF+fPkWxrC1DsJYQ8Je8HOtSWp7M/5SiwFtAu29Zo:84/o7TQrWMy4s+Je+Otv7eSOu6S
- TLSH T1AB0412F229ABFFF9E8611512500B35450CD8F651EA61DFE8E4F06E4CA6EE1815E7BB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 140KB
- SHA256 8302b956f6cc05293a9184b339870c5c6a8ebf8cd928df5f1ad7bcd7e24f9567
- MD5 76f2a2f3529ffe3356883bcbf7495665
- SHA1 a328f2b48a4dc45c968fa1f36c49c481e534b025
- SHA512 c23f97e2811ad186bc23c0b36c34aff40f64e051698af0e34d2be7ae484baee8c473e99dd0ed4382538a977cb8a355f7cba06b0b899aed9c2e731a6ce157f381
- SSDEEP 3072:XYq7tF+fPkWxrC1DsJYQ8Je8HOtSWp7M/5SiwFtAu29Zo:IQrWMy4s+Je+Otv7eSOu6S
- TLSH T1D6E312B2365BFFF9B9215556140B34011CECF6A6EB219EF46DD05F0CAAFE0804AA7B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 719274d2249f51083af23c9a7e3652835a8b8a056a8827017c87630eb8800308
- MD5 7641d511f4f7f74544de1b39539cb3f5
- SHA1 edddb396d00b8f507c0b09c9f57b959f6ea44a50
- SHA512 cd106ab12a6b7e1f893ff3316d223ad0d069a2ce040be8ac5a15d47986652c23958f97ceb38e9f4e8af511c8031739765e6f70af97ec20c15e0019e25bf58008
- SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5zA8DFB6vGyvQH4jY+0bblDv4a:qC0xJPz8/CkqDUDv7fr4jY+0bb1
- TLSH T1BAA11931B8694DB798B6D585B2422E03CF64B197E621AFC4B9ED1E1C10F70FC1352A23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 139KB
- SHA256 a00afb29cf0922555bfb0289118be9e6082b0201c65bdeb7bd7809f9194b39e3
- MD5 915432cad3877a1d1ea2367a24510393
- SHA1 4da8758fb060ce63e8ebf895df1c2fb9e70cab82
- SHA512 0c22746e68d188cbd9fd98d60b87e479828967888c4349dc888f88383deabd36e405e59941eb19797f13761c962b2111cb6c9dc7d711a696e237b87e98281958
- SSDEEP 3072:eYq7tF+fPkWxrC1DsJYQ8Je8HOtSWp7M/5SiwFtAu29Zo:VQrWMy4s+Je+Otv7eSOu6S
- TLSH T174D312B63257FFF5B9655226640B24051DECF770E7218EF059D05A0CABFE1805AABB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4268_776323507\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH