Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
900s - max time network
552s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 15:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1554592920567554128/1554876382545449040/HexionZipUnzipThis.zip?backend=b2&ex=6abe7af9&is=6abd2979&hm=0b322b03486a75c2daf7960401b706160338d65d34ce69d7f4375d948439185d&
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
29 signatures
900 seconds
General
- Target https://cdn.discordapp.com/attachments/1554592920567554128/1554876382545449040/HexionZipUnzipThis.zip?backend=b2&ex=6abe7af9&is=6abd2979&hm=0b322b03486a75c2daf7960401b706160338d65d34ce69d7f4375d948439185d&
- Sample260930-ss86fabe26
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 37 2368 chrome.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 6 IoCs
pid Process 964 winrar-x64-723.exe 1752 uninstall.exe 5784 RarExtInstaller.exe 3948 RarExtInstaller.exe 2700 WinRAR.exe 5568 hexion.exe - Loads dropped DLL 1 IoCs
pid Process 3044 Process not Found - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe \??\F:\ explorer.exe \??\E:\ explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5568 set thread context of 1280 5568 hexion.exe 129 - Drops file in Program Files directory 60 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\WinCon32.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-723.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-723.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-723.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-723.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\WinCon32.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-723.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-723.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-723.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-723.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-723.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\Zip32.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-723.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-723.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240817578 winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-723.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-723.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX winrar-x64-723.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-723.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-723.exe File created C:\Program Files\WinRAR\Default32.SFX winrar-x64-723.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RarExtInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RarExtInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname hexion.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain hexion.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2368 chrome.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zst uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 956 explorer.exe 956 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe Token: SeShutdownPrivilege 1352 chrome.exe Token: SeCreatePagefilePrivilege 1352 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 1352 chrome.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe 956 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 964 winrar-x64-723.exe 964 winrar-x64-723.exe 4864 StartMenuExperienceHost.exe 4748 SearchHost.exe 956 explorer.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1352 wrote to memory of 2860 1352 chrome.exe 89 PID 1352 wrote to memory of 2368 1352 chrome.exe 90 PID 1352 wrote to memory of 4316 1352 chrome.exe 91 PID 1352 wrote to memory of 4316 1352 chrome.exe 91 PID 1352 wrote to memory of 5708 1352 chrome.exe 92 PID 1352 wrote to memory of 5708 1352 chrome.exe 92 PID 1352 wrote to memory of 936 1352 chrome.exe 94 PID 1352 wrote to memory of 3508 1352 chrome.exe 95 PID 1352 wrote to memory of 936 1352 chrome.exe 94 PID 1352 wrote to memory of 3508 1352 chrome.exe 95 PID 1352 wrote to memory of 4472 1352 chrome.exe 96 PID 1352 wrote to memory of 5472 1352 chrome.exe 97 PID 1352 wrote to memory of 5344 1352 chrome.exe 99 PID 1352 wrote to memory of 5344 1352 chrome.exe 99 PID 1352 wrote to memory of 2344 1352 chrome.exe 100 PID 1352 wrote to memory of 2344 1352 chrome.exe 100 PID 1352 wrote to memory of 3140 1352 chrome.exe 102 PID 1352 wrote to memory of 3140 1352 chrome.exe 102 PID 1352 wrote to memory of 5756 1352 chrome.exe 104 PID 1352 wrote to memory of 5756 1352 chrome.exe 104 PID 1352 wrote to memory of 3872 1352 chrome.exe 105 PID 1352 wrote to memory of 3872 1352 chrome.exe 105 PID 1352 wrote to memory of 3752 1352 chrome.exe 106 PID 1352 wrote to memory of 3752 1352 chrome.exe 106 PID 1352 wrote to memory of 3248 1352 chrome.exe 107 PID 1352 wrote to memory of 3248 1352 chrome.exe 107 PID 1352 wrote to memory of 2880 1352 chrome.exe 108 PID 1352 wrote to memory of 2880 1352 chrome.exe 108 PID 1352 wrote to memory of 4172 1352 chrome.exe 113 PID 1352 wrote to memory of 5568 1352 chrome.exe 114 PID 1352 wrote to memory of 2856 1352 chrome.exe 115 PID 1352 wrote to memory of 2384 1352 chrome.exe 116 PID 1352 wrote to memory of 2384 1352 chrome.exe 116 PID 1352 wrote to memory of 464 1352 chrome.exe 117 PID 1352 wrote to memory of 464 1352 chrome.exe 117 PID 1352 wrote to memory of 4712 1352 chrome.exe 118 PID 1352 wrote to memory of 964 1352 chrome.exe 119 PID 964 wrote to memory of 1752 964 winrar-x64-723.exe 120 PID 1752 wrote to memory of 5784 1752 uninstall.exe 121 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 5568 wrote to memory of 1280 5568 hexion.exe 129 PID 4812 wrote to memory of 956 4812 sihost.exe 142 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1554592920567554128/1554876382545449040/HexionZipUnzipThis.zip?backend=b2&ex=6abe7af9&is=6abd2979&hm=0b322b03486a75c2daf7960401b706160338d65d34ce69d7f4375d948439185d&1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcb341c728,0x7ffcb341c734,0x7ffcb341c7402⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,12163451903314331498,9365704061599219951,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,3795425495771448781,3650017675542654117,262144 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:22⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,11518203736149589239,1712821965086048690,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:132⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,8931479828259870169,10776228963090032774,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,15985423419849525823,15333770695911436819,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,11423867569077919754,14228592782359779660,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:142⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,15410074088180754207,5381884217176384937,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:142⤵PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5720,i,12908814758937486025,10329114238297348794,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5756,i,1804033316775535263,14069602535619139124,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6132,i,14960134557881660003,16757777282630053218,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6272,i,12147849533684720492,5818680441555528093,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:5756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5784,i,9127943361441483415,8716997043888291898,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6732,i,13972970219188864385,16264936028583263742,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:12⤵PID:3752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6496,i,17420168694596936325,4410218286709265747,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6988,i,3409090353547960799,1893575257419532994,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6755618522945835244,8412050992170852554,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:142⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,4211777330910359941,12200560137635344028,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:142⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,16083501225963164429,5663784873385510247,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:142⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=1436,i,14465282704257337174,2051967737178965776,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6432,i,8163256825884154599,5423692307500294198,2097152 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:12⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,7886814874658724125,6212380150305682636,524288 --field-trial-handle=2000,i,5097544146610140045,17081982995191861683,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:142⤵PID:4712
-
-
C:\Users\Admin\Downloads\winrar-x64-723.exe"C:\Users\Admin\Downloads\winrar-x64-723.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5784
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:1584
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2340
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
PID:3948
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\HexionZipUnzipThis.zip" C:\Users\Admin\Downloads\1⤵
- Executes dropped EXE
PID:2700
-
C:\Users\Admin\Downloads\hexion.exe"C:\Users\Admin\Downloads\hexion.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\System32\dwm.exe"C:\Windows\System32\dwm.exe" --resident2⤵PID:1280
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5492
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4864
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4060
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 110KB
- SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
- MD5 af2f59a1c3b3589c2e1506ab00b6148b
- SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
- SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
- SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
- TLSH T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExt.dll
- Size 669KB
- SHA256 4f00f5046b05862fde74f892ddf8a87110455db4ab577083d4e9e137ed1b5a04
- MD5 4e3e0fba53698c4fa45c1365866813c7
- SHA1 ce55226b22eddc19bd3553b65af85307544e29c3
- SHA512 0220ec96a08444fc25538ef67a32d2ee759000bc6c85845f9b29cd0c4d79448d4544b91b4d199fa4db15b84c057892fb0bd51174a8ebe8ceb9c2cef87527b90d
- SSDEEP 12288:3yrI1lJlLZHJndEB7UFJtdqri2+arBQKuk9ltyiz:3yrIHJxHdEB2JbqzrBQKdltyiz
- TLSH T17EE48D09A69853BAD47FD07CCA83461FEAB278518772C7CB03A516AA1F177E0573E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 229KB
- SHA256 091f077e4a8ffdca19430e9775b97d3b448e0c8ffdda52fb93b98268d38356f5
- MD5 df0bc41ab3ae25dd01399897b6333249
- SHA1 89ca2d451bd8c21f0ebec5a4f715c4936a082f65
- SHA512 98a70066cd44b8c58d359f05d3688746843067f811699bd1c20a7ed2c712de9f7244f224ec367d9540d8fc4298bf85ee08002f6391d952857da6e72182dcf305
- SSDEEP 3072:ORWlXxJQ2QJUz/d6EsAm8kRq/FSGXUaszUQvHXcbviDktdNTvfSW:5Xk21/ghAmONSmQvHpSdF
- TLSH T1D3347C49F2B950F6EABBD835C9664501FF3278414760EBCB27500BB59E23BE19E3A701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 9bd99b011fc9053589e97a4845ba2951d334fa6412190cd0d5f78d6a3e4d3d3d
- MD5 6334da1a18462485d8898de26dc80d38
- SHA1 fdf2f2464afca02a242588fc6522c370fde8804a
- SHA512 4267e6ce051419916350abdccb2b7e337be007ae2976a9d967cfbfa17d4cd349488ab392a042e92671d9355ade72d55f5ffaba5745a24e9714ed704d84bf1cc5
- SSDEEP 384:pQR015ziBz4oqvhFv+qkDJm0fxPZm7SxEDHV6sZd3NszRZ88mbIJRQoK7Tks+ehm:QYzMzHshFvbkDQoZ96MsZd3yCHEJRHK6
- TLSH T1DDB2CFF2B29928ABCB6DC4328B630D242464EE401D538E50FB99353421E97371B5AB7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 413KB
- SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
- MD5 3950935f79f37787312cbaceef88439c
- SHA1 cac58c62f23ced8c2e075d53e7083585ab7ec674
- SHA512 eab00916e65d8155afb892959b821e2ab49ba665b9d0554044c6bf59580ad772c51b1e4d5875810a8a21cffeb8a0509663c01dc8d78fabcebb10c98e79cecb15
- SSDEEP 6144:F1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLR2III+Sn5HBK7jcR0IA:HM1m5Pwtq9VSrJFggIIvS5ejcqH
- TLSH T121949C1AE7A455F9E5B7D13CC8924507EA727C558BB1C38F03910A5A2F237E09E3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 64KB
- SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
- MD5 a1bee36438565456368f497fb69195d7
- SHA1 83940cda35e775151197f08531bd445556185889
- SHA512 35db801d5194fd21481203235c3a00adb60cac8c8e359c3ec06d75d8c50ab23d5cc4d4f1d55286ac9f90d1997729d3e0398994ef38714e69935c9391d055aeee
- SSDEEP 768:sMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:sJqKDakJ/xl41kVxwXicDYb3fXxuqoR
- TLSH T1015394237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A6D2F72FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 320KB
- SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
- MD5 b2edb6e0812a75b601019485047a17a0
- SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
- SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
- SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
- TLSH T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.2MB
- SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
- MD5 51f6a6e10dcb9452f7357aa7aef19bb1
- SHA1 2daa1a057f592d5e2d1446ed1fdf6cef8a0d7e9d
- SHA512 99a963fd8018044e9a606179a7666a7aab86cb989ef76a3bf99d78b42f6d09802da2f40a7f0c4cc70ef6f95fffa0b0b767576e988452a5f269ca12c5dc5ad4aa
- SSDEEP 49152:I7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgXUeT+uXEkjNEEBHLu:7soEC9/a+uUkjDBHLu
- TLSH T199F59E0AA7E406ACE0F7D679CED6C553D776B80D07B0A68F029098A64F772609F39713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 727B
- SHA256 9698b0d542e04d2ae9b9c7e85d23d3c5de46e7e077d79d042e91af7c48070cda
- MD5 b386c1a940db57be05d0e47533220cad
- SHA1 5833869edf6831ba46fab7fc562a0d0a97b1d9ec
- SHA512 e307da5304f459ffd9f08848620d110b6d2d898a855ff20229c5e8673d606f5d2b67cdc489f7ce6cdc1ba81553414d372c5de1978b2d257f0049ec445560aeb3
- TLSH T162016585559CEB4097E00C98CE2CD6C8B2781213037A0B1A27A311D6DA063576D1A838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 abfbfbc723ff25914997f9ad5b2cef01b259573d93648869322de8a3008b00bc
- MD5 3180de1680d1de539127c715d96a3c5a
- SHA1 a98b6bca54d03e0bbf811a0685aac49ac4e77a6f
- SHA512 7430fb60abd91978456881e24b4ae42b107c896f5e438e800d61e3f71456ad061df667194b0d32798fb18675e40d7c9e2511a7c2a1c6080ad5198a01bad8de6c
- TLSH T12C01650097BD549478000D11C6FE9998F42BA08911C14296B2761CDA1290A1EFFA5016
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 404B
- SHA256 a04363177cf06c564d873b731ce2969de0576fca7f874161655a9026f80c78de
- MD5 4055d61610223a1a2579685feebc2d4d
- SHA1 842ab7039abc9522f227b5ffb8a88741811f9890
- SHA512 bf61dd30a42c3d97437867851871ab0d32ff5501d09715fb63328cf8664cba8f82c4e89e474147f60f6e0ad303071adc24249c8758c7aca0e89e57e4417505f0
- TLSH T111E0C03422FD845CF2F4943803F658214A96F1170501C65D094057069E11F404CA1A34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 72af258b9d8248bea207efad27672d1c99db38aef1f6aa15afdabab5561dd673
- MD5 cbe421f682a49bc9f8a73c050d4b7afd
- SHA1 9d57808d4035f537b12347cda77cefa24b8aebaf
- SHA512 83dde513ed0f1e9d14a8ce35acad2a5e3701e39c7c6d9b9264c1cc08cc44c939eb9773711cce889f62a5d1c4efc616ed282a4428d27c031a8d132292284dc9cc
- TLSH T1D6E0D83C65EFA51EF1609C7586F6A1751E49E6051804DBBA16D54309AB0AE006D219B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
- Size 346KB
- SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
- MD5 fc31feb6dbd996017ba0751ebf1a2be0
- SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
- SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
- SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
- TLSH T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 840B
- SHA256 a2a8764e7f405e87613745192586c23486953405e406c236cf3ed4f71d4da10d
- MD5 fce53f288e408a9b09d18178332186e0
- SHA1 52290df454954d44cdc72893c8ebbac7107df9c9
- SHA512 29b8df14a95126a0263be834a9f631c40fa980537e424b6cc8b313e96e066cca215214f0ed3eb1959f4ba1076fe50e5ec8b835c2516ed032cf4d0e6c3f3ab8cb
- TLSH T13201D886F4F1B102CF7748B240A10841666B9EA740835FBEB01EC8CC7C1BA7A09482CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 171278d9ac8395eee4889088654adcb3cc17cc1cf42b261b06ab0644a2a876e0
- MD5 b5570cbf8b1f43f1cf06789d3797ea6d
- SHA1 e5bd44eeb8addc09e764a85f5f84acde117f719d
- SHA512 255bb8837f260666a3cf875da19021f80180cd5e247341bebe6fb609aa908903220e9d17eb039eb26cc8b74b054f6f734c920bc026c7864b51ea9c92eaa99532
- SSDEEP 3:MsEllllkEthXllkl2zERRue+t:/M/xT02zaRueq
- TLSH T18F440444FFC00D07CD0015344415D35503F0DC101D17DF53345104137CD75C30C10050
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\33ea774a-5d43-4d6f-a38f-7649d75c8476.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 6f8450bcffd7acad0b8e6115cbd724a9c50f18041f382778f9b2f1439fc5f22a
- MD5 43bae180bb2370a9706be2992b670898
- SHA1 407b7639f755d483351fa8bdd398bdcf667579c0
- SHA512 696f338ab4ba518454ea73e182ba2d480ea99c073be8594643b018c7aa4dd16001f36ec5553486f62032439c4e1828dfcd08b0341718f966b211b5c342bcaba3
- SSDEEP 48:YALlh3ehLJhCFvsJWRsAWXLsKWfoKsQWfs2WosUWKsTW1tsMW+skWqzs/gWtsqWl:DkXcVgA0Abk141f/mR8pxE
- TLSH T1D5919DF7C3D8C63D891156F8AB156F1ACE2D0914532D3C26C8D8AE5FA3E2C71E21064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 4713ca1c4c797ee3651332737c261dc2fc690acab0876d615cafaf02eb7c023b
- MD5 62726ee82cd40167de0aba9a3846925a
- SHA1 c0d5e1473eebd05cee4856091a720b2fdfff5cf6
- SHA512 b590e512d5bf5b17c8221ed5a36fb92c7ef1d8fe2370e1eceb4c8963b551097730d3b0b6bb55262fbb39d701c41183b6ff1a0f9fac54f102cad2e53fd6483a84
- SSDEEP 96:DkXcoaBOgA0Abk141f/mR83NPbnaP1Nud:DkXcoaBOgA0Abk141nmR83NPbnaP1NM
- TLSH T155C1BFF7C3D8C62DC91156F89B156F1FCE2E0928532D3C26C8D9AE5B93E2871E21464E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 690B
- SHA256 894bfcd287fc842e55b086a63372ca04f769c4085e26da4ac60ed86c59ed2120
- MD5 055c9eea9b309791fe8ad50f598f30fa
- SHA1 a5ab1266afbbd36d2a5762b48de205f77933ba19
- SHA512 1c0828f5f3b32a2355f9f9c8687ce23d476c6ddb3b8ade7894a2a3bb785bc7782bd57f0fdcece1171ff4f51890b03346c8cd477467a87b86f8d77ced43706a2f
- TLSH T1C4017BAB96BEB877547A88EB1F04BC0555F5A4300251A4E5DE9B532CB0994E35F06023
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b135d0fd888c32b6fcc71c690685a487563efda73012f66b7a905ad44a49b8a3
- MD5 392ebd5debd943017ea8f86dced29f8c
- SHA1 9d07ad63fa83c631b1f408714e8a8e0c667a4149
- SHA512 7adfb7cd8cf0a8dce33f0febfa19b7f66c0e671f32e96e85a7b15542af435c57577d912c2605adcd32f5e9880ef801b7f0a9b0c0e1c76f044852351e9d106edf
- SSDEEP 192:7RKsTNUbv7ALvAPRp2b9BHsb+WNnz/1PzO437kw+VyIsnAUge:7RKsRUj46XUDwpPRLWe
- TLSH T1BD32A42EEE14787F5CDBC61AEA367757E3F5102170942E88EAF8892C14E75CC2217457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b5eb3f904d3a3fcd9067f94823615634dc2d9ee3159f1bb8cce3aa06be1ba111
- MD5 7bc98551ef171e2ca505b3874b8342f7
- SHA1 a8b6f506b63614f5292811cc8ee58f98a0beeed2
- SHA512 fef5c988dd0faf827b1e7a2b5f1c6a3b871d50957e13cc991e347f2a18ef31c765e89f8055180093395335d4171ea137282ab9e6a00ba0077e523184be23ff69
- SSDEEP 192:7R1sTNUbv7ALvAPRp2b9BHsb+WNnz/1PPO437kwNVyIsnAUgE:7R1sRUj46XUDwpP1L7E
- TLSH T1AA32B42EEE14787F9CDBD61AEA367757E3F5102260902E88EAFC892C14E75CC2217457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bd4825d4e1a74d488e952ce3736ab32e5e410db2a71aa69bfc2736e27cf43d49
- MD5 f55fd8d36995135fe3e6e50758eaef24
- SHA1 c347b6165f34535864e6842f4039745d67282538
- SHA512 1f49a44434328f30306b4ab1f25cfcc169490da2841b7622f639925776b2b9caa78098bc0e97372149111c26b34f580aba2d1d71aa54cfe0a7fb38747de835c8
- SSDEEP 192:7RKsTtUbv7ALvAPRp2YH99BHsb+WNnz/1ZvQ2zO437kwNVyIsnAUgE:7RKsJUj46XvDwpK2RL7E
- TLSH T1E042A52AFE14797F9CDBD61AE936775BE3F1102164902E88EAFC892C14E79CC2217453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8d8c133d9bbf85932ce05e2dc155e969ebedb2cef9d6d62727cfe0e0f264d1a6
- MD5 f9394d7ecb7da96eb6f407dcc9520389
- SHA1 b25aec86d0966ea4d61d0c9b891033f004e1c76c
- SHA512 a1f1b8e761468f65cfa24b2e17842c2a0cb0d3288cf9b25014d81fa21973063331f21cadd1f0a273da485c53b05dd6afe459cf6e63bea49266e0319edc9fdb35
- SSDEEP 192:7RKcBzsTtUbv7ALvKYPRp5DYdBx9BHsb+WNIxz/1ZKNZe6O437kwBVyIsnAUgE:7RKmzsJUj4JXmDw6+eELHE
- TLSH T1B742B52AF914297F9CDBD61AF9367B5BE3F1102165902EC8EAFC892C14E79CC2217453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 c0aeb1752aa0a030669b4d0019a8bc9a3bc19bd84f623de3ab6fe2cd01938575
- MD5 2d8c8e4fcf012ebb46f7d6f5fdd11fbb
- SHA1 013fd6fdc494fb55a6fcf3fc5527e54497f83b47
- SHA512 cef3944977bb8f7d662ace8882bbee70b3884ba877de963c5b16eb0ff489fc001f639d669cf17add4fb6ca2b3aa498bd0539d47b81d20b8563cdb7ff7749ad96
- SSDEEP 192:e+R4K6v77KxkXqK4I40pUZNCgVLHrKHfFKslEUWgXzKD/Y3+ErUkKN9mZVaC66/G:XRjg77KxkXqKf/pUZNCgVLH2Hfgslwga
- TLSH T1A132E927A48D9A7F0FD8D509CC576F8FACB5029272780D2456FB9C0803A578E124B6FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 6119e08f815b0e8c23f4ffdcf55b39de632d322b875275a2f96afca67424f131
- MD5 b3e13faa166e9022677297a2478f5f64
- SHA1 5cd5a9ec44f03cdd67d59f89b8271b2c45087306
- SHA512 d724ef8221418c1bb965a6a17eef8ed4178b12abd8692a3d349614c123b7df7711370829cf9122835315da72a785e043dc40ae614906aba5ae4f7ac20219b599
- TLSH T125A00291A1D02315C1648B7593DD0AD023146F5913130B2241E909589ED155BA601259
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1f09639-4220-4e9d-aad4-bbb6d4880125.tmp
- Size 13KB
- SHA256 e922c8f68dab5914cdd43ab9d65bcaac8a3d201e229337e4ea06e8c2249be3a3
- MD5 6323eb0ca960b816d2bb97401ed881f0
- SHA1 23ddc7bbe69d7d9ada4311d051353c3ebe631d69
- SHA512 be965886b26330851d728f6026a4395549cd5c0c196aa57099ba6383d16f8b4ee413dd58bc14b49db13a4b9ae3b539bb8647f47937f08ffb1bfde56f0602a653
- SSDEEP 192:7RKcBzETtUbv7ALvKYPRp5DYdBw9BHsb+WNIxz/1ZKNZbQG2oO437kwBVyIsnAU3:7RKmzEJUj4JXbDw6+12iLHE
- TLSH T11C52B62AF914697F9CDBC61AF9367B5AE3F1102164D02EC8EAFC892C14E75CC2213853
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 1a0165f178b3d8c98de45021cf48f072073f4a57f6cacc0f073f6b59002d481f
- MD5 2a92bce627a54894289bbb9e08afcdd2
- SHA1 0e1016527b453179597f6286dc9171fc873de6ed
- SHA512 d6348120499bf2e3b160f921b34d066245c065b4ee3f7b8613d2ee40114ccf96de93930a01b83090b7cd9f9d22bd16288b2d704a89224c29d97a8787ab744e4f
- SSDEEP 96:u1C0d+qs7PiY+3oDfAIT8MASl8h4otop5FYDXB6JGyvzecdtvO0A0wWKHLQl0j9A:u1C0t+W1IWiU2kR9LcdtaWKHLQlUA
- TLSH T17EC11B71A8AD6CB754F7A945F1032A03CEB562AF68516E94DAE95F1C01D70ED1383123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 86064540dbe7bc3e6278dc774d18ae3e4a99d68ea7840d26f71b60c757a02eae
- MD5 334302e69658c94c5f1b072ba5fd9d0e
- SHA1 12f4c29506229a55c6d1ffb18d2f0b106424c0b5
- SHA512 14a62db90709ddfbe88ea177ebbeb154a5373a647b0f256286ed229f24ed0035c7d0714bb2b79a610a10ec5f8919b2aaf6f89d908251f6b9827f82badec054ad
- SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIT8MASl8h4otop5FYDXB6JGyvzecdtvO0A0wWKHLQl0ja:u1t0t+W1IWiU2kR9LcdtaWKHLQlUA
- TLSH T17BC12A71A8AD68B754F7E945B1032A03CEB562AF68516E94DAE95F1C01E70ED1383123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 12387bb6c207fc22c300054c8f69711385d79f427909c3443bdfe5b0f9e78bf1
- MD5 175ac87e675f3c88d676abb9197701fc
- SHA1 2554ccf6835e29423c1cb5f1fc5ac881bfc1e2b6
- SHA512 7192e4ebdb438c81486c9fcad711aa78b53be93c2708e078e5b8fe9afb154957b572c59849f2a66a2a294bcf570d6827fc61624af7fb4bf031782a4ada57fe27
- SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIT8MASl8h4otok5FrDXB6JGyvzecwSLQbRNC39ISMVxzU:u1t0t+W1IWiUD9R9LcwSLQbu8xz7j0
- TLSH T165C108B0A46D9CBB48F6B845B1132953CDB962AB38147A5CEAE91F1C00E74DD0383533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 d199595d824c9c3f9f15729f6e719c0e2aee6501b463f57e285cc14b0ca67b0b
- MD5 679d33233a2dcc123e5205f0fbe6258a
- SHA1 815657e7633d03e7486a301187329f34fff4479c
- SHA512 fb64e44de86a5a076101ba9caeaa49cea7924a2533d631e97d0707910607e872135d2ca451ae65b2cd67d403c161236e7dc8cb024d2713a982b15da932c68cad
- SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5FgNDXB6ndGyvze9aQjbfEv4a:uFC0t+W1I04DUDSR4wL9aQjbu
- TLSH T10BA12A31E56D8CFB54B7D949B1533A03CF79A26BA8215F84D9ED6B0C05B70EC0782523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 41KB
- SHA256 d48b62564b3a95740eb3b3ad58e00832ecfe57dfc92ffe4848f76d075cc7c733
- MD5 a29e7ef89327291c5e7e2554d0e76c54
- SHA1 c4b018face69191e16690a2b63e36a62a4f765c8
- SHA512 4c5704bf8bac7ddc96fe6d4c99e4e184249c7962e4ea614a5147e355139ac99810e9e28b59b5e53c5084863a8190a2208575b23d2599e56839178b761adfaf34
- SSDEEP 768:CY+gCnyrSSUnfjd0Fnzg292VEh8boNqSFM+mNK/Ie7udxEdzvXw1AbX5yWF7jb:9+7yrSSUnf+Fc292VEubo8SF2E/D7Gxo
- TLSH T1F413E1B8C89D5C3F0DBF6260F052AD979DD9058B6C44FCE8CED54C4886F24DA1387A95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\HexionZipUnzipThis.zip
- Size 2.4MB
- SHA256 1c3e3c6abbdfff03b4abc38599d8fb9227f6194a4ba31635d0b65818418096f8
- MD5 976b041d0891a93b4212c4aee9d37574
- SHA1 78974d9eda991b522e7068b8eb6b471833916b8a
- SHA512 e9a02549c6863717783ecaf2f8bd84abcd6e9c5b2569e0392ced99f5f15c0e08b20f4cac477d365ac1ca02331e0ddbaa7c5edc4e8205d7de731dfdc3ec785b0f
- SSDEEP 49152:izh1l7HTX6dAf6IeI5UlX+yez+YhiDa0NWWH5P9ZvPmBqyj7GI9vjHtDc1:iN+aVnVz1hiDagWWZVhOBqyjp9Ti1
- TLSH T1B4C53366C6A0BE98B5AD5136AE3282DFDDC5F22D383148C157DCEC38B5C1762263788D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\hexion.exe
- Size 5.1MB
- SHA256 4a1474f880cfbbca0af35ac9e4a01149c252d1cda50529199f5de6677608dd6a
- MD5 61c3414cb39c341f3487ac3db0aa096b
- SHA1 ab1b74ef0b281fb629cd6e626149f4f34e582a72
- SHA512 8084225b0e03cd22e026a37b20c56b730af009d5341377c0dc5f45f61aedbacad65b6f894db2728ab078bef5a575669d92e3636c6d1928a04eccaae88a6d71d3
- SSDEEP 49152:z3/f2NpHF0KwlOQ08gbfmNjxFT+m2miJga/dhpgsm714cahKFss4oTVyETrL6Wgc:z38pyAQTxF5iJ5rncTn+K
- TLSH T1ED365A43E75191E9C0AEC478835BE637EA32BCCD0934B2AB5BD44B122F25F906B1D719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\winrar-x64-723.exe
- Size 3.7MB
- SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
- MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
- SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
- SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
- SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
- TLSH T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
- MD5 SHA1 SHA512 SSDEEP TLSH