71c1657d4913b410d2518a3339ae984e48573eb8cf801edc12654436c3b4bd59

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
889s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DJ Fatboy Vol.1 Track 4 Remake.mp3
Size 6.2MB
Sample261003-qnk7psdd67
SHA256 71c1657d4913b410d2518a3339ae984e48573eb8cf801edc12654436c3b4bd59
MD5 93e933c5fea364528dd2ed19d4524bd7
SHA1 58b485dffb95aa3a545490fad56951b13f280243
SHA512 f852f0d504ac092d4413ad71b111a485c39f6d3e9c0bba8724c1c7538c33195d141371c46ef2dfefbec73a74d51481353c97c001abfb1a0ff85e9d5218bb1452
SSDEEP 196608:Zz019Jc2DsyzU8Iob4JjSgZ6S+ytKpuKBrvZA:Zz0BxUpo+h5+LuKBDi
TLSH
T1F666235ABB42523FF56B56BD738B0988D49A2EABA030D1C5F522F3C536B318427E05C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
246	6096	powershell.exe
247	5020	powershell.exe
249	1940	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1940	powershell.exe
6096	powershell.exe
5020	powershell.exe
672	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
244	2028	chrome.exe
247	5020	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	wrarinstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
3436	WinRAR-723.exe
5516	wrarinstaller.exe
5368	uninstall.exe
3484	WinRAR.exe
648	WinRAR.exe
2156	WinRAR.exe
3876	nate hand gesture.exe
3384	UnityCrashHandler64.exe

Loads dropped DLL 18 IoCs

pid	Process
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3264	Process not Found
3876	nate hand gesture.exe
3876	nate hand gesture.exe
3876	nate hand gesture.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240993312	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	4804	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR-723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2028	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{669CBE1B-B059-4154-B954-2261822F0BA8}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
5772	chrome.exe
5772	chrome.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
3436	WinRAR-723.exe
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
648	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4804	wmplayer.exe
Token: SeCreatePagefilePrivilege	4804	wmplayer.exe
Token: SeShutdownPrivilege	1756	unregmp2.exe
Token: SeCreatePagefilePrivilege	1756	unregmp2.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4804	wmplayer.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
5792	7zG.exe
3472	7zG.exe
1824	7zG.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3436	WinRAR-723.exe
5516	wrarinstaller.exe
5368	uninstall.exe
3876	nate hand gesture.exe
3876	nate hand gesture.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4732	4804	wmplayer.exe	85
PID 4732 wrote to memory of 1756	4732	unregmp2.exe	86
PID 3820 wrote to memory of 2168	3820	chrome.exe	103
PID 3820 wrote to memory of 2028	3820	chrome.exe	105
PID 3820 wrote to memory of 3828	3820	chrome.exe	106
PID 3820 wrote to memory of 3828	3820	chrome.exe	106
PID 3820 wrote to memory of 4192	3820	chrome.exe	107
PID 3820 wrote to memory of 4192	3820	chrome.exe	107
PID 3820 wrote to memory of 1224	3820	chrome.exe	109
PID 3820 wrote to memory of 4580	3820	chrome.exe	110
PID 3820 wrote to memory of 1224	3820	chrome.exe	109
PID 3820 wrote to memory of 4580	3820	chrome.exe	110
PID 3820 wrote to memory of 1520	3820	chrome.exe	111
PID 3820 wrote to memory of 1520	3820	chrome.exe	111
PID 3820 wrote to memory of 4504	3820	chrome.exe	114
PID 3820 wrote to memory of 2840	3820	chrome.exe	116
PID 3820 wrote to memory of 2840	3820	chrome.exe	116
PID 3820 wrote to memory of 4388	3820	chrome.exe	117
PID 3820 wrote to memory of 4388	3820	chrome.exe	117
PID 3820 wrote to memory of 4188	3820	chrome.exe	118
PID 3820 wrote to memory of 4188	3820	chrome.exe	118
PID 3820 wrote to memory of 1612	3820	chrome.exe	119
PID 3820 wrote to memory of 3648	3820	chrome.exe	120
PID 3820 wrote to memory of 3648	3820	chrome.exe	120
PID 3820 wrote to memory of 4884	3820	chrome.exe	121
PID 3820 wrote to memory of 4884	3820	chrome.exe	121
PID 3820 wrote to memory of 5740	3820	chrome.exe	130
PID 3820 wrote to memory of 5748	3820	chrome.exe	131
PID 3820 wrote to memory of 5756	3820	chrome.exe	132
PID 3820 wrote to memory of 4132	3820	chrome.exe	133
PID 3820 wrote to memory of 4132	3820	chrome.exe	133
PID 3820 wrote to memory of 4332	3820	chrome.exe	134
PID 3820 wrote to memory of 4332	3820	chrome.exe	134
PID 3820 wrote to memory of 1548	3820	chrome.exe	136
PID 3820 wrote to memory of 1548	3820	chrome.exe	136
PID 3820 wrote to memory of 6116	3820	chrome.exe	137
PID 3820 wrote to memory of 5500	3820	chrome.exe	139
PID 3820 wrote to memory of 5500	3820	chrome.exe	139
PID 3820 wrote to memory of 4984	3820	chrome.exe	140
PID 3820 wrote to memory of 5772	3820	chrome.exe	144
PID 3820 wrote to memory of 5280	3820	chrome.exe	148
PID 3820 wrote to memory of 5280	3820	chrome.exe	148
PID 3820 wrote to memory of 5016	3820	chrome.exe	149
PID 3820 wrote to memory of 5016	3820	chrome.exe	149
PID 3820 wrote to memory of 5088	3820	chrome.exe	150
PID 3820 wrote to memory of 5088	3820	chrome.exe	150
PID 3820 wrote to memory of 1656	3820	chrome.exe	151
PID 3820 wrote to memory of 1656	3820	chrome.exe	151
PID 3820 wrote to memory of 4556	3820	chrome.exe	152
PID 3820 wrote to memory of 4556	3820	chrome.exe	152
PID 3820 wrote to memory of 4712	3820	chrome.exe	153
PID 3820 wrote to memory of 4712	3820	chrome.exe	153
PID 3820 wrote to memory of 5444	3820	chrome.exe	154
PID 3820 wrote to memory of 5444	3820	chrome.exe	154
PID 3820 wrote to memory of 5800	3820	chrome.exe	155
PID 3820 wrote to memory of 5800	3820	chrome.exe	155
PID 3820 wrote to memory of 6080	3820	chrome.exe	156
PID 3436 wrote to memory of 6096	3436	WinRAR-723.exe	158
PID 3436 wrote to memory of 5020	3436	WinRAR-723.exe	160
PID 3436 wrote to memory of 672	3436	WinRAR-723.exe	162
PID 3436 wrote to memory of 5516	3436	WinRAR-723.exe	164
PID 5516 wrote to memory of 5368	5516	wrarinstaller.exe	165
PID 3436 wrote to memory of 1940	3436	WinRAR-723.exe	166
PID 3436 wrote to memory of 2108	3436	WinRAR-723.exe	169

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\DJ Fatboy Vol.1 Track 4 Remake.mp3"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 2260
  2⤵
  - Program crash
  PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4804 -ip 4804
1⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8b27c728,0x7ffa8b27c734,0x7ffa8b27c740
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10294029125207939974,5664774432425090984,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,18040522661299141766,8598409855415640145,262144 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,7100091567612750427,15109834900821404683,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,4375055346574051507,11860967321608664425,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,16063496029091296591,15032342544143127189,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4588,i,2723147615659050744,5807467871448262372,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,1282659105746198952,10737989520782993426,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5748,i,14102780880932979744,1316535520514770336,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,7256888591922495347,17369189868647881417,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5832,i,6239914512729491067,12013644863431584071,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,8229862990393738236,10327492897574953330,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,8984923811054955764,212194060292315877,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3120,i,7711061991102744297,1776315880986454176,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,7213163876500302197,7757407283327347375,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,8784743680724874272,2052242670760373857,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,15065315624411971497,15823316879857434104,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5684,i,4932265823963577692,14015442212845737272,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6224,i,6274841776257980801,14054116756622507249,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5740,i,2279761560646709915,9088046380619901656,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,2692740614532115047,11938614264759760816,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6628,i,3908926331744325904,239570671015371400,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,14362253942698967057,14240848636897470252,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5692,i,9909647657085091339,16310599429622238584,262144 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5540,i,15164179578226433522,3630963085228007733,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5768,i,11216908853089294033,18319841239316222729,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6936,i,16228097615536144753,14610859152187190953,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7088,i,6682307623815945582,16697229816386180356,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6296,i,17640141143404849761,1348276203035476135,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7004,i,11847114639382870389,17034338566762109412,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6952,i,918839416475035631,1515695544089542387,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7300,i,8891869569895619568,5161470186065396445,2097152 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7060,i,12845040899761160094,14178690430324036263,524288 --field-trial-handle=1952,i,4187948139480249400,16107122465838259458,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:6080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3788

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19524:114:7zEvent18518
1⤵
- Suspicious use of FindShellTrayWindow
PID:5792

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Nate Steam donation release\" -ad -an -ai#7zMap21145:114:7zEvent29313
1⤵
- Suspicious use of FindShellTrayWindow
PID:3472

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap28317:114:7zEvent5109
1⤵
- Suspicious use of FindShellTrayWindow
PID:1824

C:\Users\Admin\Downloads\WinRAR-723.exe
"C:\Users\Admin\Downloads\WinRAR-723.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  PID:2108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5260
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3484

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO.rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:648

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO.rar" "?\"
1⤵
- Executes dropped EXE
PID:2156

C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO\nate hand gesture.exe
"C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO\nate hand gesture.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3876
- C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\NATEHANDGESTURE SHORT DEMO\UnityCrashHandler64.exe" --attach 3876 2787047575552
  2⤵
  - Executes dropped EXE
  PID:3384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x528
1⤵
PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
MD5 af2f59a1c3b3589c2e1506ab00b6148b
SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 413KB
SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
MD5 3950935f79f37787312cbaceef88439c
SHA1 cac58c62f23ced8c2e075d53e7083585ab7ec674
SHA512 eab00916e65d8155afb892959b821e2ab49ba665b9d0554044c6bf59580ad772c51b1e4d5875810a8a21cffeb8a0509663c01dc8d78fabcebb10c98e79cecb15
SSDEEP 6144:F1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLR2III+Sn5HBK7jcR0IA:HM1m5Pwtq9VSrJFggIIvS5ejcqH
TLSH
T121949C1AE7A455F9E5B7D13CC8924507EA727C558BB1C38F03910A5A2F237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
MD5 b2edb6e0812a75b601019485047a17a0
SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
TLSH
T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
MD5 51f6a6e10dcb9452f7357aa7aef19bb1
SHA1 2daa1a057f592d5e2d1446ed1fdf6cef8a0d7e9d
SHA512 99a963fd8018044e9a606179a7666a7aab86cb989ef76a3bf99d78b42f6d09802da2f40a7f0c4cc70ef6f95fffa0b0b767576e988452a5f269ca12c5dc5ad4aa
SSDEEP 49152:I7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgXUeT+uXEkjNEEBHLu:7soEC9/a+uUkjDBHLu
TLSH
T199F59E0AA7E406ACE0F7D679CED6C553D776B80D07B0A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13d36b69-b25e-4785-931c-135b9df2dbec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\13d36b69-b25e-4785-931c-135b9df2dbec.tmp
Size 264KB
SHA256 8b0dfbf638a4c64efb32ffc20112efa71d4b9331899aeb122068294be08729ef
MD5 ed54579274db1180260d126ec19ed6fc
SHA1 b28c2f33c5b2df9390dd5a3dfbb38bca3dbe4aac
SHA512 7707ebb09594a54b0158c5dc66d01048a7af28814d642d61156dc3182a004e80125980f808c347beb750497c90a8ee0c737231c9fe917c5c58b15b5232b7e13f
SSDEEP 6144:6f+id6Azh7sdkdAHyNpq34QxhNHU+hFD+7t56OD9ZfSAppr1:6mlAJUSLyFSXD9ZfS43
TLSH
T18E4423727CEA5C77C9ADD481F12BD610CEE366ED408A570988C65F8A91FE80D0A93973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f0ba716-7e99-4cb8-900e-d0baffd53831.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3f0ba716-7e99-4cb8-900e-d0baffd53831.tmp
Size 265KB
SHA256 76723b6842e0fa1e4a40cc65fc5d229d227fdb2ddfcba3d303b0a940a67f4f4c
MD5 8ef7ef3e5f93e56b75050b2d1e4317b2
SHA1 ecbc2ad03fff6f7a8c978a5ad8b799f1a1fc9b8f
SHA512 28244b48b322c9196790b6e81cd39823a1c34f6790a0e1af055e8300d7751e253768fb28957d96f08d2be08b7dba06481b0335b2cf4da61e7ed2d6ac1097cc26
SSDEEP 6144:IS+id6Azh7sdkdAHyNpq34QxhNHU+hFD+7t56OD9ZfSAppr1:UlAJUSLyFSXD9ZfS43
TLSH
T1F84413717CEA9C77C9ADD481F1579314CEF366EE40899B09888A5F4691FD80C0A93932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55af33b0-0ada-4ff6-84d4-911ddf5eb332.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55af33b0-0ada-4ff6-84d4-911ddf5eb332.tmp
Size 265KB
SHA256 c7d7477d512dacf7d27cc1f7f052876fb29713461ff2ab2e50a91dafc294a368
MD5 9c346b4e02efa8bc9f3ebddbf2c77727
SHA1 5d4d1a774be98202ddf59f9673ed0a872a81dd06
SHA512 ad2327a3124d9a20a4f2ab7e49503c269b15cfe2d109efbf1554750738a2eca5c2f239e9b3a8f9e021adda44422d833da811891ac418bdec614b840d3ae67485
SSDEEP 6144:9S+id6Azh7sdkdAHyNpq34QxhNHU+hFD+7t56OD9ZfSAppr1:3lAJUSLyFSXD9ZfS43
TLSH
T1BA4423717CEA9C77C9ADD481F157D314CEF366EE408A9B09888A5F4691FD80C0E93972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c17dce6-5982-40a2-ab73-3f921d434a8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7c17dce6-5982-40a2-ab73-3f921d434a8f.tmp
Size 130KB
SHA256 80e78c82dcecd5ac4dcd06434cb70612d3dd419011c77244ca98b235184eeb63
MD5 31c15f63bc42f18c3e888b5316aab516
SHA1 7ada4c511fe60fe27c30bb72522fa26f6986771c
SHA512 b5225371f9a51f6915b80958f2bac5117fcb1c82c6e783e9168f809ba9e8ccee9837e9279407f78a32a14f19d9aa5b717a90624a4811cbd986d5df704bac162d
SSDEEP 3072:G+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:G+hFD+7t56OD9ZfSApprZ
TLSH
T1BBD31232AA91C8BBC9FC6541B197A300DE626CED55DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

049e1f16-2384-49d7-bad3-1d53ba68cea3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\049e1f16-2384-49d7-bad3-1d53ba68cea3.tmp
Size 13KB
SHA256 11b0924f60f6037c64627c5eefad3a31fafa845b67908f726e0351be04072503
MD5 0df63e4f4741d1060623f8bf30bf7c64
SHA1 dabf7070643298146b9b40dfa1b6fb13046b91c2
SHA512 1e252aa4daec10f7c71107d3376fab1e810fc976b2cb3df1db3e7b685bd48594e5aed773fdc8836ff3bae417f767e95ceecae9fa11fb485b96e4278920f5fb91
SSDEEP 192:LRYcBz+o8b5QBv7/ApCPRpcKLCRlg9vHsb+WN0i5+wZpe1y2B9ewB+VyIsnAUgrK:LRYmz+liLAGXfhw4At252e
TLSH
T1EA52A52AAD206ABB5CE7D62AF9227B57D3F1102264D41E88EAFCC93C14E75CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21aee838-d5c0-4ca8-b69f-14322ecd2418.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\21aee838-d5c0-4ca8-b69f-14322ecd2418.tmp
Size 14KB
SHA256 42f13f6af2d8be7faaeca05815938b37ef18344300f7e042d57ba2088b52dd8c
MD5 a99b2c5b7c02e126c6c254495cf69a69
SHA1 19068c8a92c73331c398b80479984605f688c662
SHA512 25ec3694b0ed39f9b65d74c6adeee3b6895646e04e60313e84391cf9309d98ec6d7a610117212b63a8ea10488dc6aa75351befc7b9eb3e81bd3926a11f03a2c5
SSDEEP 192:QRYcB4voLbIBv7/ApCPRpcKLDFlZ+i9vHsb+WNbIcxm8D4L1lvZpeZJYt9ewB+VK:QRYm4vyILAGX5hwb5xJUjXyYl2e
TLSH
T17162C82AA92076BB5CEBC62AF921BB57D3F5102264D45D88EAFCC93C14D76CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a22e14f-cbaa-4918-b810-0e36c2fea346.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3a22e14f-cbaa-4918-b810-0e36c2fea346.tmp
Size 12KB
SHA256 fd6adad730a14316b6610633b2c93636d5f9883e8417868c9bd60b77757466fb
MD5 1140678876e7286bb5be4da1eec14232
SHA1 e9ecc4ff91c4a908ca497c35d6ae0ab8d2b62ff3
SHA512 8ddc98ec49771d1426da891f341a603bbfabc91d84e2177f86f37367410ed396d13af7629bced36c3429e4534c47d4744fe3e021304043f8334a4c2e98de148e
SSDEEP 192:LRYcBzqb8b5QBv7/ApAPRp23CRlW9vHsb+WN0i5+41y2F9ew5+VyIsnAUgtaJ:LRYmzqAiLAUXwhw4P2N28
TLSH
T17E42942AAD2075BB5CEBD22AF9227B57D7F2102274942E84EAFC883C14E75CD7217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e60d64b-e054-499a-beb2-7714973b589b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4e60d64b-e054-499a-beb2-7714973b589b.tmp
Size 14KB
SHA256 43bb2dac38327780bf0daf8bf28a49c90a6cf33983599b605ae09d87136e31eb
MD5 10a072300c0952a37e9ca37630ab7ca1
SHA1 cc9e08e83b6ae1fc4691d1ae015000000193df77
SHA512 a5d9f895c7c577b5728dd34d238434432dcd4d20c0aa38144369a0197143ce4bf77f478c1f62d204f821aa5ecf6dbd32edebe37c5aeb4805bd19f485de7fed7c
SSDEEP 192:QRYcB4+oqb5QBv7/ApCPRpcKLDFlZ+H9vHsb+WN3bJ8D4L1lvZpeZJYt9ewB+Vyr:QRYm4+LiLAGXkhwrGUjXyYl2e
TLSH
T12F62B82AA92076BB5CEBC62AF921BB57E3F5102164D45D88E6FCC93C14E76CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a51e5ff-5564-4ab0-a2be-36f5d17075f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a51e5ff-5564-4ab0-a2be-36f5d17075f3.tmp
Size 14KB
SHA256 887e487579b3be29d69679155ad21b284f28c1c0657df98daa55b02085ced5ed
MD5 2f17d49c5e1c2c962daefa6a14c88da0
SHA1 6eb7bf4d156bbc7c3df6d897f1446e1b198845ea
SHA512 270416aa296bad0f1d8f5ce56453cbf022af6aab0d8e59febe079c42e844782375d03842a6c7c4a68d5f9f64c182b567d638eec381dcc339f67cabbdb275e7d0
SSDEEP 192:QRYcB4voLb3Bv7/ApCPRpcKLDFlZ+i9vHsb+WNbIcxm8D4L1lvZpeZJt862A9ewp:QRYm4vy9LAGX5hwb5xJUjXyt2E2e
TLSH
T18E62C82AA92066FB5CEBC62AF921BB56E3F1102264D45D88EAFCCD3C14D76CD7217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8255d0cd-a001-4bb7-a759-0a94e7f4ca13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8255d0cd-a001-4bb7-a759-0a94e7f4ca13.tmp
Size 649B
SHA256 a90d960c1a72bc7726d4418b614b8b8868019326328a20a5cbf4cbbe9fc3203f
MD5 1143f31ceb9c92cd255d316610de4c8c
SHA1 8676f8edfd9296c7b31eb697335cdea8ddbe9b9b
SHA512 c3a8521e05c12231c78341e80159fcb55a8e9f43f06ff4a8f51ad49fcd0658f30a451f066750f0b69d5ab426d34fc38bcb5d068e3221d6719ccb49eb50179dfe
TLSH
T1EBF0F4A5C921FC6718FD0B6960A80746FB51136B3790884B3A3D820C8FB563B858A81C
MD5 SHA1 SHA512 TLSH

Submit Download

8e3047dd-4fc6-486f-ae84-921c47ec429c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8e3047dd-4fc6-486f-ae84-921c47ec429c.tmp
Size 13KB
SHA256 4b5cf385631cd66ac419042607b95d73c0987cfec9416d15d001be20e561d744
MD5 993690e8881bea09a8cf2e07fb6f385f
SHA1 8cb170d79cda9a08937ffcf74975409dd0bc9a86
SHA512 b2cdf61a2880b1a9c7d6b010c3810a181692982efc3d2af017c2e3c0d3691bf73874e6567547f16e1d8d9d9ccfe9c90cbfa35c198072042ab1eded0fe309e3e2
SSDEEP 192:QRYcBz+oqb5QBv7/ApCPRpcKLDClhH9vHsb+WNQQu1lvZpeDfW79ewB+VyIsnAUp:QRYmz+LiLAGX2hwbqXeWD2e
TLSH
T11D52B72AAD2076BB5CDBD62AF921BB56E3F1102264D41E88E6FCC93C14E76CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96376cbb-6574-4a2d-b89b-ce4136a2d8b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\96376cbb-6574-4a2d-b89b-ce4136a2d8b3.tmp
Size 13KB
SHA256 9137cceacd08ea1bfec906f017240f7a632ef10ff0747514719064dc06f2816c
MD5 4f3486bc115a9c041dc7dc99d09f9d8e
SHA1 0c7255629a27661acc5e0b54b68996d84fc044cc
SHA512 dd681fd5bd5aca57663dd75151694f3dbfe4384ec68ff3694e8f9d4d79fa550d3789ef2c9d724976ba2457dc525d045f5c938213efb8557d9ff3afdef0776208
SSDEEP 192:LRYcBzqo8b5QBv7/ApCPRpcKLCRlg9vHsb+WN0i5+wK+c/1y2O9ewB+VyIsnAUge:LRYmzqliLAGXfhw4Yn2q2e
TLSH
T13552A62AAD2065BB9DD7D62AF9227B57D3F1202264D41E88E6FCC93C14E76CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 73KB
SHA256 f3da3acb05ffefdc9ae669d4d171476ad2d7f4aefefa8fa9e0245a7a3b5ac2dd
MD5 9a896a1d99d04ee0f3fd1b7983fdf1b7
SHA1 a8e793d6fcdf858eceb9f42a9f75665d6a92abc0
SHA512 227c7027b7c944a7472f41c28056bad40b0d3116a3ea88fd350cd9f3c1a44f36d475ae8fee82b558619be48bf78982da14e87617a7a4e7a2241b94ab8272ef8a
SSDEEP 1536:O77BHwf0DFsAQtr1cHixbkJJqPrfkqrFDMllDv4nhz7y4vj:O779wTAwr1wGYJJkfDMXAnhny4b
TLSH
T1887302F82C92C0851875371B2FCEEC37990BBCE11295CE64368DF065D6B7A1B8E16D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 516KB
SHA256 51e152ba0c19557d2cbcff82a86943acabc1c5b3f75f9ec0931b278fb6e9e3bb
MD5 32023108a7de55590dae3aec720b1cfb
SHA1 e715371099408b308cb9df1a75d1afd3fe799b82
SHA512 3a020804e6e969ddb8a3eaf15f5b245832adf1b4d621c68505c747c7ddd88dbe72c0b6f2d30dd366e87ebc980c10bbeaa99cf810120efd26346acb1b0a09ffbd
SSDEEP 6144:EDn7zOGmWHQ+F2TASdPAwWd7xNK0BO4Hdu4+4KvMtdXt11E//irPzY9ZHj/5ZNvT:ED7znLrULyQ0A49F0MxwK3yNMKf
TLSH
T196B423920E5CE8365433DE96528EF79FF607E858E2B219505FB0C296A6F3D43F940932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 88KB
SHA256 233bbaf591c2daa1003b79a816fc6e23315e2087e04796482b2c862e44f1506a
MD5 26b4ac88375fbac7219351532bfdd790
SHA1 911d9a3028ae3984ebbe6792890d6e4f987d9a23
SHA512 4560a3bd7e728ee7674e2d70d4b2c54ea79443aeb576036320a26a4404bfa2dd10bf0348bccced814e0db5acdd0c53bdaa1632ff93fc8a8f0c87b5420726919f
SSDEEP 1536:t+OC/plzLOeu9aIE3RZmsstHt7gYRDkEUii0WYteXM43oYEY:t+PzLU9a3Rpc9qEUiCX1YYEY
TLSH
T15E9312C2C5FE29A087477C55A1BA2AC2CEB0153285F6F3CD33CFA54A82AD4C4DE45E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 66KB
SHA256 d9d209c4f4285998afb87d83f0d5039f45e0fdf893e3460569cb090e855d8e5d
MD5 8834099c22fe5f6e100aa98747f32204
SHA1 9927b99716ec882973fbd59d70c36fbdce3dd3b1
SHA512 0b751ed4d799da476cfc4fd5784bdbe7b75d6329e02157dac5dd9b0fc16dd43f76911e2d6ffbca8a4a413e2a1f5db16c130129105929dbc73f68d5adb8eb4c20
SSDEEP 1536:75XQVR5d0blr03TMhRrS6oUq+MERP56tcliQWpYrxdtx25Ku6Nxb:Izixr03whtSM060bYVkzKb
TLSH
T170630195BD6353C150E4D160D13793AAD11A033EF65633F318F70A99B6C9EAE6C07461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 50KB
SHA256 e48c5d91c1ff0601ccdc1b08aa972a0057c2319b9218e6d5907f98916a651ecf
MD5 d1f958cb44570b7650a93d69b79a3278
SHA1 00248cfcbe7524007e88fc9b936fe8f4c10afb67
SHA512 a60f27eccdc6341477f8e8370c657c2e7e10f8a02f0f48101fca0f579a54be1545d93b451bf8c9590f5d8ad63ee26ce991c388b32db6eef0e22f719e1e3cf678
SSDEEP 1536:4FyE2XIBemHJZ3T5rA+iU8AKqy3kKcm4Aw+0:wbmTmHG3qy0KE/+0
TLSH
T1C433F15BF1DA0367EE1F6E1DE6C87954A6C4054530B043E39253C665AC158AEC0DBE3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 55KB
SHA256 55b52a05e2a2fbe1db1ccdf12d4f14fcc3e9b1760109d8c0b87b6af92c94bc70
MD5 0d7bf725893070054f0fa7f7d16a9134
SHA1 8698b15b660b66f5f8aff12b093b4ab65cc5e141
SHA512 d18aafe2b335698071b925644d9107ea7c6db6243eff3e9c3ce8bd448eb37530027a537f41931ce0eea81ece6fd9a5077a5acb5fb6dd23fc9807bfaec124420e
SSDEEP 1536:l983BCPwAB+hYNM8tEDYACJ+JKL1K23keNMtDqYheDODTOC8M+:l98GwAB+hYNHElXJm1KcMtDaODTORM+
TLSH
T11A4302AEB35796C3B8AF213F5869D3CA85B1ED929A2044D4F769AC8C1D43F44424674C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 122KB
SHA256 14027d5f82cff3ab076e096db38ba543c9139e823fbd8a9ec3479cb269f259f5
MD5 6efa6d8397acb353c5fe7bc32b7eaa17
SHA1 83af640265cbd984f05b5640df853a0f0a6291f5
SHA512 3891b9abdfe93396d3bfb32042d28f1e844211d28e4eae221f5da452819ac25fc169386cadd11ec4e311df6b57580fbf5c9d96bf35beae0c87e88efd0ce17f9a
SSDEEP 3072:AQ0ek2bDazkZId5qT1tICeFV8thhAEPNOqy7H7SRd:AVrUa4c01tP4V8tPAEFOHH7Sz
TLSH
T1ABC312C09D065C453AA834CC9EFB754766FB1A377CB1A5C33694D09261AE238BB106BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 85KB
SHA256 02eaeeeba377b121ed58e72ef0e0fff9132ab76d47db8b430c4e806c0a712259
MD5 61bf424d4a34e96c039883d3cd29eb80
SHA1 4cef404ea407dadf5274e31484869024a2e6bf10
SHA512 02c008f42aad048ef6a8ad3b19f777092a59d9ad3688a3d632a1ba643f764dd4e0c9c3389f7c915e86cd083080b209984eba00ec7c8eac94b9f8d4a13d2d5b4e
SSDEEP 1536:FbwhYEzOPogNvqMGYoLb02jsbDtkm1kqiHFfePHZLB3sOW4dH+bYCfS:Fb+bidN1/orjsbJk5qQmf3g4dHEVfS
TLSH
T11A8312009582CD2557DB431F9A85B9DF11F66AD2C1F6503AC6A9D03B73929EB3A0C36C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 29KB
SHA256 bbd4320d303c18c2ce25a761bb68160f6f2757ab0fd8e92a8b1de7b553b77b77
MD5 ebd09022fc9ed68e471b6cea728fa8ce
SHA1 37cb28b1ec9c475252045afe2c6208004bbb5a1e
SHA512 ae995b1f3047b46e6114a17c719788c923dcf7b267de2447616539720b4ae0609b41d21ca09c675e480c4fe220fdc0b9de1a73f84dd3edd1623319b6b622820e
SSDEEP 768:i53d7sJBRZ2ZAjw8Vk+jVJdc+9ffKJgthSsV3fRFST:23OB7RrVzvdc27hSsVZFST
TLSH
T1EAD2F0EF21DD1544BD4220977B2913F512FC11B2CD6C06BB9EA5C0A59C7E7C2AE606CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 21KB
SHA256 28bd35ddea2396a7ce1980c5f9ccde690f5e2c3688e4c28f18b20d025236522f
MD5 77948b05945f1ce24a38d14047c5ea71
SHA1 9342683e5d6737badbdac80da97faf87027d7a83
SHA512 95c06b0dc94454bab267fc5e15e920ead5a1a96717b1c1a0050696778ba31c011c6a5df2a9af16627c1569d318372f3a3ad699377aa1a61baf7cd0c37fa1c02e
SSDEEP 384:OLEUW+WRGAtW9j9a5Jg4nqV2A1fvgvTr/xQpuICfhxTOvEci3PN875f/B3ful5+0:BnRGiW9ZanHnqV2AEZhI8TIEr3wZ3fuJ
TLSH
T1E4A2D196CC244FB7F4A0384BD232B1726EA3301BED64A55E113858B456F7F4B9B7E026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
Size 67KB
SHA256 fb2da67d933134dd101bae3c34ea28a04cf49604ee5af5bef233049d67bdef3f
MD5 04f716c704e22b84672138b4c896f798
SHA1 9536afc1806d5633599fc17bc401c839669e914a
SHA512 eb7e575b580db9d02fcaff76ee7e750ab29aea80a270242757aa940ac9330b6bf6acba5ea99e66999af5330c63db999e4f7eb830fc74646e5596fe0231e0638c
SSDEEP 1536:GqbC/Ca9PoaLmNC8HhEUhunXezAPRhzbw2nDa1PhXgIkCBOaTAzs:GEWLPjIC8HGYkRhnlnUhFkUDR
TLSH
T1A3630223A538C4A5E18F36BAEF89B1700B1FC52F2195D9D98433A09B66F055B1BC14FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
Size 23KB
SHA256 8480de2851d04814bbe9a4963f586b1e4bb482a6e50bd5dcde98bd70523d0aa7
MD5 ed257bfdfb41a50649b4ec43a749fae5
SHA1 19d9c8bdd086b4b4f20f544f9591c3755a4424a3
SHA512 8a778b099cedd6852e8e5f9c5c1566aa1c09a9eb76570a5730a26bae872f1077b2eb4138f2f07f5a1b7210f627b86f7ad13d7a23afca6aca1b0f299bbe593cba
SSDEEP 384:68v1TTXJ3LlHKV4XabXyj7I1Mq/FBPtlZrBNzu4Yxmp+6HMVVZOuhuamdP:N13XJbIbXZSQXPDZlaEp+YceuMP
TLSH
T194B2E108F5C2EA4563449D1174AC16899423797E8E0E83AC13F7B3179FDC5883AF5DA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005f
Size 136KB
SHA256 8708e8d7b16783872928aea4fb54fa492bc1fc0eda923b6ed3d02c952ad6fab8
MD5 f9bace6b003feb41327b16dc6314be4d
SHA1 fb00cebf518cfbb6d346e9bf9032457b0d45a473
SHA512 d45f624639111c581587f4f29b8b8177c9dfa9788ad95c1b7f98939c97b840c328e5a5ae42de41e93f625c21a09d93a8652764ab9482d4ef3a8bed8aa6d610ec
SSDEEP 3072:gz8D0acy8cGOnwVq6VkJPkSpcFgkZsYUhxU6qCiW09D:g4o2RZQDaJPkSpcFRZsYSxU6nK
TLSH
T17CD312B9F2AC891967393B0AE96C4587C30D9ED2E4BCA94790D133B7DC744775C8322A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000060
Size 177KB
SHA256 e28b0cc44f993df9ae0e60053c554baea14e31f5f076a1938281b84718ba2324
MD5 cae786a575a696f933c90bb2d458624b
SHA1 2fa2e4abf8f424d9a140c4832e57661ede722403
SHA512 d7a76b180f2855b10b527984d9eab0b21f7dc16b703a7c707bc6938a53b5509d63e7dfdfee378d9a81d35b89b946462a7ae928721430a2994d47bfe372a16ed0
SSDEEP 3072:pzjpKWIA1PQQG1h+YHCZES/PLgCmufv/78ditMPi/bdjcI5kf/M4im:pvp7xQQokb/UC9fv/7YEbHkHM4b
TLSH
T19D04137F5CC7400846E9F8E016BE42E78EE1A4C419D133FFF576A29646D20D458DF991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061
Size 173KB
SHA256 f9ee855d983c86ef8546cf2c3387af3a3dec66d96215e6a34f52b1cf1a826b46
MD5 0f78bd0483cb0426492f1a698e58a512
SHA1 8ae8c36daaef2967fcdfdc659fe0585b52c28029
SHA512 ff9365f3b8f4d36047d8dbee7084d88a65bcb6d59ed5cdb2125dc46286500d57492eee88d3a419ed4330cab12933e95c33273ce40058f4cfc40a42ae035b6aa3
SSDEEP 3072:pP7OCPwFjGQzwJoPxz0KC8+AIxstbFjo3FaBMv5FI51xcptz8rFgT7VmdDRFD/+z:xFoj9oTKC+IxstbF8pRFI51xcptzXmJc
TLSH
T1A40412124D849F10B7D4B71EA83FDEE08F05FA9A686D142F19D8FA270E15D7CA9A40F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f4d3fec20d2054eeea4aa33c9bb0ebb9e25c2714285dfd93083bfb0b36d7ad5f
MD5 87f0a5b1efc063bd5bcd824990a1182a
SHA1 5ea46ca11e256e6cce9eff8e7f6187e7faafdb89
SHA512 2ac42218cc09c29a5844b0d81e8f4e88646763ff3a6d763203cb23854ef1a8ba544bdf3cc24e3b40409874f76670871b4c03d29a46b6627c34fc5d2ff1db3f55
TLSH
T141512203BE700DDDCB5A4E7E59A38DA06612016F43039607C7F6B9647FA326E4D54264
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 12ed5dc7ed508075493e8585633b9a0f9a3fd2c0fb9c2c39afc0167109440fbb
MD5 79be1796a154478dbfbf0ad971041100
SHA1 ce280fccc9c44202139ca30dbc6f569051dc298d
SHA512 9b1c8bec6e2bcb574a3fead47276427db4def64fd98c3a422bd859ba6b31d5665acdf5ce3b26398d0c5a58a552df4df75ba7b74fb2f4a90b2547a94ef9e84bf7
TLSH
T14D31A967BF300DE0CB96473A09A3CDF02901025D8353370B8C364A597FC72BC1D98268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d8fe9840ac865c4bfd3c1e24e18f0de9a4d3138e0364fc7359c5d76d8a6fb580
MD5 244e5046065dee02dc087ba99d7b4498
SHA1 027cf24853894bbad98080518dbd66244007a349
SHA512 3d93be144acd1ee25e8a33e39bdace4b616a33b60039a28390fdfa604213a54830dd1e1bc5be8c88bb3ccaa672b231039eec2186305a0c49e304851a4c251228
TLSH
T11731FE137F720EE2CF5A473F8AA28DF4A5121A1D8353770798724A647FD726C0D94268
MD5 SHA1 SHA512 TLSH

Submit Download

1213fba3-9087-4cf4-a152-c7f8439b7cc7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1213fba3-9087-4cf4-a152-c7f8439b7cc7.tmp
Size 16KB
SHA256 9fc3562a1ce4ab585ab5587044cf140a90dbeb3e448e574f8efdc1186d5927cc
MD5 a08fed45ef7c1f16a4865185adf40ebb
SHA1 0a830dd10319f58681d86ed95f0dcabc5eb88992
SHA512 a6ac043dfeff0adeec1afc213fb9051d641313a35a7542d95b670fe321e1bc465fdfe53b36d1547df3b7d9ae42533003731f01d1be52379382e079084d7a2abd
SSDEEP 384:DkOh1HZqt/kGPkhH7eJJx5J3ceOjPCxjWEwCm01Vjb/IlIjjTImI2bMDrR1R0Zjy:+tUmMZ9G5Vx2Ug
TLSH
T17572CDF7C3E4862DC91156F49B25AF2FCE290528032C3C6689D8BE1BD3E2572E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a349a91b-4ada-4b3f-8453-0bab7f39aaa1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a349a91b-4ada-4b3f-8453-0bab7f39aaa1.tmp
Size 16KB
SHA256 16e6df9227574381f6e18a66b7287a73ad2ded5aec9bb5f40483d457a3897b3f
MD5 29039ee2054d334ee8304426c3f692fe
SHA1 132e071ee6befb2832b8905e66013716fbc2b110
SHA512 2736488cde6bf613440dfaea75a0471979014492ef67e9b76af2aa89be24ae1b395ee352e2f9a3848af93008325d895fe95820ca0d8efc03a16a1a850ff86064
SSDEEP 384:DkOh1Zqt/kGPkhH7eJJx5J3ceOjPCxjWENptq8ojHLxjb/IlIjjTImI2bMDrR1RJ:OtVmMZ9GIVx2eiC
TLSH
T18B72AAF7C3F4862DC91156F49B25AF2FCE290528032C3C7689D8AE1AD3E2572E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4ea10a1-86b1-438d-9e91-19d3543486a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d4ea10a1-86b1-438d-9e91-19d3543486a9.tmp
Size 1KB
SHA256 105a6b7ee806f78a1a7a9d63d0d9eb66fd4db606c1651c44d82d0e88ea100fae
MD5 f4f86b3c9c39fc2c45e76ee9a793a38d
SHA1 d2b373cb3f99a4a3d9186bbedafb6fce1cf18ead
SHA512 03fa7c533b92b014b9bcaa2f678eb8fc2c4c4ceaf1160888a7f223abab23bc7f01c28162e7ed707fefcf898be71b9868173802fc37ce0ba238bd38dabaf72cf5
TLSH
T1A231BEA3B57EB477247E4CAB0F6479051DB9F4360140A8F8EF57826CB0C19F71B16416
MD5 SHA1 SHA512 TLSH

Submit Download

d9b5cd92-3912-48bd-adb3-d61d258b5044.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d9b5cd92-3912-48bd-adb3-d61d258b5044.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d9d1dfe6-8742-4a82-9c7a-ba7e4dd6d25d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d9d1dfe6-8742-4a82-9c7a-ba7e4dd6d25d.tmp
Size 15KB
SHA256 c30541865398633a7cf7042af1dbdf7a6034879d880812b78b930f32d96977e7
MD5 c76281a76347fb282265db903d0931e8
SHA1 82196ab5630769c5a09601d23375f3073452d7c9
SHA512 13979addd98ed33011da414dd516e493227fc372fe9b149bd6b963440a66bae19fb110a579c7c1dcd44286e093170cab8cf5a68d25a6e1eb0dcd7b086bc58683
SSDEEP 384:D21AxI9zS68+CH6ZVe/JdRJlZe/j9jbX8FjOVvIz/I9aYWD6XIfIiIgLbMDrU1tV:39nsgJQd/w5nDj
TLSH
T19A72ADF7C3E8862DC9111AF49B256F2FCE190919432C3C2689E8EF5BA3E1871D35564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 120B
SHA256 af2057b7af4565320b4b89e2877f07e849ff97413b28e236301073d5e4bd45e4
MD5 41d35680fa8223413ab1d0374375fd3b
SHA1 c3f611a75ba45c740c09cefd027fdeb1199e1ae2
SHA512 84622c6b3548926d9ef3cfd0a04f4050693868e61ce158c64e02ce07d1fbfa535f438a4a2b77c8e40182aea90a8306c240e43106a0e5544e031517781ebfee98
TLSH
T1F6B0122516F00F44DE51437172E040822310B531470FC68320603050A8330418550111
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 1bf4ab945f2c25522c7b509642f41dddc9cf7b86e6cb936ca2b461ffb5247f60
MD5 3e28ceb29499bfbe0b9254e0204a17e1
SHA1 28ca2dc74247e223822e57125e3334fed63eb799
SHA512 3d770b84f579aa2d2dcd9f282edcfe7d8f739f5ddb55cbb8ea696b8fe0368de163cd526a495de2450c8c7b156634b4866d9414107f110c58ce9beba011a7eb0e
TLSH
T1A5C02BE31930C787873095C8202CF53CC8274D0C4CC4CCF8944930077438A378801D78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 150B
SHA256 6cbb317dc3a8df22ab42b8aa9f3ca79bb7029aa8cdb22b2c04379fb7019335ef
MD5 063628aa2978870392bf4752ccdc4a7c
SHA1 26bd93c8de2c9bc13bd5c0e917bf084e8774f647
SHA512 f0c1424473b3cbbe3d70810b3e4a5329d548c2323055e783987d72d98bfc44d580fab8adfc312aa7b0d104cbb55958c0d6bb37288fa1c8e368407bde413b6d8f
TLSH
T1A5C02BE31920C38B8634DACC211CB53CC417420C4CC4CCF8948400073838B374402E78
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\d88280b3-76cd-47f3-a2a4-319d4879a9bc\index-dir\temp-index
Size 72B
SHA256 69e169b0ca99e45286064b6b37cd656cf0f4369ae9f7a10d2832c913d4f0b6aa
MD5 528e050c9c01eaddfba5e45d4a071289
SHA1 872243c402b8b2b7f520144fa37e393544fed4be
SHA512 cd32f06583a11cedb14a188bbf74876b99199e59715f4a7d79326b13e7f449166fa7e72bdd6b709e994b97a7d8c738bcedca823fb4d6cfd5631139661e591240
TLSH
T153A0023802600341C6110370A487197936358D10FA09C60391F031D4F8D91AE490B17C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\d88280b3-76cd-47f3-a2a4-319d4879a9bc\index-dir\the-real-index
Size 48B
SHA256 92711cb5009c1bb1270ac37660ab88a7daa93bcc71876864f2f48e49d53c25cd
MD5 576d647d2aaee812e8988e2a4bdea048
SHA1 c67a3a3ad3badeb76d517beb6132d5ffaa2e0a91
SHA512 1003aee58f3c9a638165ea21a72b4bad4552f1a35d72479e7ab6110288826ed7bf517d02645e8a599e328646ae1f4754cd8200913e65f73a50ee9276a2d14ad2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 157B
SHA256 dce84fb9b047f21b0c1ef7c507b1d8ffe9af12eb5cfe193222640b29e293505f
MD5 70400f675bab9b7cae51faf6a450ed18
SHA1 35bc63d40c4564ce2c0477c75470580738920d3a
SHA512 ab94d40ca431b68dc2aaf8fda42e61eb0975cca8dbec6714a443811130e064b1d26f4ec07eb8c16e2a73ee921dc7c859e961338e3cab9df9832d861681b06b5d
TLSH
T1F2C08CA71470490A2721A8D4A539268CD0239C9C6CC4C8E4890AF05221B82629005664
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 73B
SHA256 16f2e733956a69caf3cba9a7984df8a9072d616051880ec52649d5a25de0b733
MD5 eabef125304ed56696f07d27dc0a4760
SHA1 f7b1959eaad9661d26183f0a39602128c7770501
SHA512 39ec79f7f17cc61719521fc98f8b1f25f58c611763ee56fad334f92f8d372156a636f7630dd049e7c55894d8952af5e7888725220d46d382715c693ce7c9e896
TLSH
T109A002F71804808E0F30B8E8353ABB5DE00B91DC8CC4CEF4C419B0422138AF70402994
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 154B
SHA256 88470a7577b4def02c1d48b53635de4a41b7877eb25f954576645e3b6974477f
MD5 0f769c7c0f95e5eeb9c6f626877e696d
SHA1 635de06079ca61c06949ec821b73d384052a6864
SHA512 d74e7c8223cd2d2f76a096ffb9d64d7c78b3a8e196647afe94eab36f25aeb3a7409d288456668e4ae4a1ff6f338fb499ec878ade57fda7a7ee32fe8f59f98242
TLSH
T15BC02BF3202080864B70E4F830387F4DD00B9C4C4CC4CCF8881EB0432038AA34A81B6D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 148B
SHA256 351bdaa1b7f3b2e96abb24fa9c807fad0a23fc248b3a85a12991ec6837727706
MD5 88ed1955734563a0e2894fe0b584dd21
SHA1 86f0a301ce725fdeeedf523c61955b97be3202b0
SHA512 be14941cdad13b6e93d67bda9b0c4ca9642a36833fa6e97f2e85ae6910abde0d44eb04469ceaa3bdbf3fd565fda0b9b17a587adaafea8f0e7f2bc054ed079d0f
TLSH
T153C08CA32010808A4A70E5E820387F4DD00B918C5CC4CCE88018A0421038AA20A92A6E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\LOG
Size 329B
SHA256 ff2add499aa0d4d702738646cfc8bf4aa2e01eed5c237b0045613c1dce7612da
MD5 3c5125114a768e9285d2aee3fc68c581
SHA1 5861401b1127798436382244acf2d0eb72f3fbfb
SHA512 28210990ccbe7d2a6d5f0d6d3f306992b70724695a55abab98971b21043dbddc8f04cf3fbdf5ba8a77ff74481d5f6fb607043ee3c64b840be2139c0cb49be7bc
TLSH
T195E0209565C7C15F511C80A65538734DBFF79408DBC82D065F44E27C79CE40C54A92F5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

de028058-298b-43c8-9bda-e59ad0ad56d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\de028058-298b-43c8-9bda-e59ad0ad56d8.tmp
Size 14KB
SHA256 78f24319fb0d3918ea426c8f0cf3bc106d24f8aa5ff29bc73268f0502e8d8e0e
MD5 3a4a0b6c304a8e0f69781e619d6f2260
SHA1 06a238fe47fec97888e920a0a46ba869df1ed74b
SHA512 a97cb3d5e0303beea5efec0a5fe0d48ad159fea97f847d758b9d35e866720e4fd35e0a6750c71ff95633e3a79199c0a0f1990cb13dd490425c3f4683bad924c8
SSDEEP 192:QRYcB4voLb5QBv7/ApCPRpcKLDFlZ+i9vHsb+WNbIcxm8D4L1lvZpeZJYt9ewB+M:QRYm4vyiLAGX5hwb5xJUjXyYl2e
TLSH
T1D262C82AA92076BB5CEBC62AF921BB57D3F5102264D45D88EAFCC93C14D76CD3217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e68cff7e-171c-4d76-a97b-cd972e14adcb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e68cff7e-171c-4d76-a97b-cd972e14adcb.tmp
Size 12KB
SHA256 c977eb67970873fb1707904134adac9bb9c4386a777b5518c97f92747b61a629
MD5 7c90114231768db5ba7d61e1c9cc8a23
SHA1 1c093c3e9b1a38549eb3f371fc0f8dd76d5b4f3c
SHA512 0a1ced1a47214e3f56033cf313e1176251d08f5a64a5a2ee1169646202792d145067e749540f9f1a54a1de2d61ef1f78c627a88f330feadd6491c3b105777edb
SSDEEP 192:LRYcBzqb8b5QBv73pAPRp23CP9vHsb+WNn5+41y2F9ew5+VyIsnAUgtaJ:LRYmzqAibUXhhwQP2N28
TLSH
T1D942842AAD2075BB5CDBD22AFA227B53D7F1102274942E84EAFC893C14E75CC7217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5a660f6-272f-4f0d-a1f8-bd351046d1aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5a660f6-272f-4f0d-a1f8-bd351046d1aa.tmp
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc5d696b-7453-424b-9734-30a18dc7d988.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc5d696b-7453-424b-9734-30a18dc7d988.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fcd272eb-168a-4614-8b5f-b81fdb07c7e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fcd272eb-168a-4614-8b5f-b81fdb07c7e3.tmp
Size 265KB
SHA256 05e60667c9696f628bdfafb0a6545bb234cad18cacf6a57f5ecd649e700df054
MD5 1f62c0bd61af783655fdfb0ef3df1e4a
SHA1 7461edd1863fdb92182fd6905d30622c8e943875
SHA512 5574d144850ee507c66db20df5f554fb23db88348aa1bdfd7d051e93f02b0ec2c97db3c2a374012e40d682d57346126e3a2cfa05542b653fc1d3acae22d1f208
SSDEEP 6144:cS+id6Azh7sdkdAHyNpq34QxhNHU+hFD+7t56OD9ZfSAppr1:QlAJUSLyFSXD9ZfS43
TLSH
T1DF4423727CEA9C77C9ADD481F157D314CEF366EE408A9B09888A5F4691FD80C0E93972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 2929e0034137a84c1f9b39fef92399d1fef4e2718ebc5be4b11406cd15bab7d7
MD5 d1c23efabea5d3f31b3e908fce08632c
SHA1 1a107703eb4c05c1027292174a2410517dc3423e
SHA512 716cc8be01e3040da729cc4728dc554d63ba7d5ca2c0495be26cfd6d5393a4fd172346798d3c06e05958ce4484b3c3b36638c8ec8610897becb74d9e1b35a88f
SSDEEP 768:v7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjP5:59tQeoVYocxYCutFCJGAKt2/oGX
TLSH
T1A4E4FC3BA470A098DF3C35B2E2BD6B8DBD71241A12E006411F60B57F76337D8DA4A9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 1d4bb9113ccac18c7d365553a3467c8afa9a2a834f619cea434a0724bd88e132
MD5 cfebbddc15d7de6901a805804ec5b36f
SHA1 2e91726010582f682cced5f1e4243c0f229f3dbf
SHA512 33895adb9a38b6a6b47b0188bd03f8047e58af7d073952dbc1c4f57664f484dfeba7bd73f2451b757e8663a5053e42883ebb5d5a48a908cbb64a4dccb67093e8
SSDEEP 768:x0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaz:XZP2tFP3vqY8nqEMzTaBacg0sY
TLSH
T1C7257437D150B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 27b5460f3e358d683bdb52484c20477972527bc2d82d48c65c45bcbb854044d5
MD5 37784e8dd058cd08f90ce122d362961c
SHA1 e7251bb3830adf08e53d17ea511e538be9a90df8
SHA512 f3a5141669b7ec5e9f91cb54aebade1ca794e9c1e712747fae913d904ec91695d11371e16cd3867def986ddebacd418cb18163b9f9840b2c974c57d69c43a920
SSDEEP 384:Qrf+Jt9p+JJE0/Bie4kABovTM6seYR02/993rowlo3l0kEWUvZ:KfBJEaoKMovTT32vrZQBEWq
TLSH
T13272A4AE610F26D3C4C21378D11B095FE4F2DE8D031A07D9BB6A9F3B4EACA5E502D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 07a0fe5aab08a455eab1f944851bbfc1fc3d600dd80b85e3fc2a06c4b25c8c8f
MD5 5c762fd01df467acf6928c265ff7efb4
SHA1 f6e6ea8b476da7f64f78bb85247a58714ca7d8ec
SHA512 8042fd83c537759eadf45f566423f96f08eb704ab272b5eb19438dac4b342dbfcc077c41b5e2a22928ac144cd8636e80fbafb83118a630ecc0f4facabaca74d2
SSDEEP 384:Zrf+JTk1LXY9xxam2OHxo9o5SY1CZoW2287mTL36ydgl/TcoOg:xfBkJnio5SLoWImTxdGt
TLSH
T13A722A9E221F26E7C0D213F4D427079FE9F18DCE434407ED6B88593F06D936A50AA2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kbsguhds.4of.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbsguhds.4of.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\Banner.dll
Size 4KB
SHA256 ae716cc92296d7777773f39ac0f1dd1009b75b9e2b2698f4cb63cb2e83e0aad8
MD5 33608fbca02f4569e8eab600000669d3
SHA1 725ece3e2feacd76552ffd71f3915da1601ddf11
SHA512 c8a0eeeb0b46d4357d7dc0a52d612715ca035f89d483c17fb83ac7bb1f65e8b6a4a8702ca8f5cebc95dd8d608925424384da7f4dc80abb24c70aea53ba9a23d8
TLSH
T1CD81633BB2F04EF7E563023300830BD325ABE9546728471A496791ED7A4A9D7D57DB02
MD5 SHA1 SHA512 TLSH

Submit Download

Header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\Header.bmp
Size 174KB
SHA256 30b2605b256df27baa509ee27209cec3f28ee1fcfe721484bc63dbe644b961bd
MD5 6107dcfb93cad5b9ea18a60c37e3c837
SHA1 a4d8207b7ecd28e4d04ba2ec3735e174ede9f307
SHA512 54154f5da1fd737c341579607a7a278e26abab5531ef93486d518a8bad24d1d4bbaee8b4fc431ade1af7d55964715d75bb7ff0a96c32be24a41a3f8655996d82
SSDEEP 1536:RTL1VM9PTqDF7ZB29FdtXqFZOHJa/Oz8pazH3:NLkTcn0R0Ia/OgqX
TLSH
T181041848F153C90729D2CF3536AEC97A49E278504B9A64F817EA007DB0FE9F046EE572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptionsEx.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\InstallOptionsEx.dll
Size 119KB
SHA256 b03cedb899c8737fabb3efb1d02bb8330ee73ce667aa406a5e52a10aff180db7
MD5 b8c7fda6ec3c8a8ead7d7eccae0b17f7
SHA1 bb1444aa3300e9ab4a7a10c7913ae5e4320b953d
SHA512 52d3ce369418c9fbc7645e8ab272199dd836ebf13fe5019694f01f1686e0708853188b5a2ba8241739620dce98765bdb4fee488189d40c37222a0230b79e6e91
SSDEEP 1536:yU+yEIWirTd+OY4M8D1fb8Li7c3bSC2RVNCSivZYrgr+9MmHZ+WIwvtu1/5bCl:b+y5TlhR8DL2d14MMmHZvtq/5bw
TLSH
T19BC38D403AD1D073D1EA647C9559F37187BF7971AC6688477FA02B7B5F202809E2A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MINIMAL.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\MINIMAL.bmp
Size 3KB
SHA256 65754b587a6bc8e2b415f93f03997311577394558020798fe63fed2d505a953d
MD5 6444555530eefc9ddcf6ead1b8e2029e
SHA1 c33053aa24823d7e8ce98dc6c2cdbabef30b32ad
SHA512 410c1446f6f4aa179f9e29b0090b4d98f58792ffee5ac1859657a2dd7c58b688174ca9a2d31ac6b579057d4bdf6b9babd02780a0e6cc0b1fd21df2f24a36daef
TLSH
T171510C973A8546E8F55A78E4088F2D5E325E3FBF118433056183CF1A7CF024974676A9
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\MultiLanguage.ini
Size 344B
SHA256 28bb063cbd9d8eec0dad21e815091c9a176f15035d5af2d41db4ea6a1f9ff3c7
MD5 55680fc0cd3ba2f74f5eebb05839203c
SHA1 302995226fce4f7025274c3817fdd2e2b5e0941c
SHA512 dc7c53a627ff278fa8961f71d955454253623a4fc176b1c0ae929db1b83d521550a27490e2e9cf1a3a27f98b0e83d8a8088b2292b9b1e96809ec215d8e2c0f5b
TLSH
T147E0E24B25E89415E09AE11CFBF98076D3387408480EC90EC2E34A4F88ECA40102BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\MultiLanguage.ini
Size 2KB
SHA256 af1e3a3f5c834ffdb193b66f210ae2ebd1c35226784b8c05c96a9f5415a3033c
MD5 52ecb771682d7cc8ac11486d6ced4947
SHA1 e57c90364e82e220a973fe3c37477ed1d9603372
SHA512 481439d4b99477e04f229ea6f4994a46f12b472be393dd8ca351edb7b722cd575263b8a655eab17864925f08c7c71cb65970cca98939be8099e38060e0b073da
TLSH
T1C4419D5756E95208F2F7BB08FEB04071DB36BD626C3CD54E82D0090E45E4A50C9B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\MultiLanguage.ini
Size 2KB
SHA256 85bdf6565e780cf24f16894ba8b11713d6bc50395b77f524fe32f5e34a21bb50
MD5 a247cbbdb63133e9ebc07594f75a3eac
SHA1 c653f6434a4e82e60bcba125db11138aa1aac89a
SHA512 b0c17789c45030cce200463c07e66a0302ac711e3c1a60324bc4ac56f946818c5c813976055abc41a2aded6255fc562a676c985dbd95c2a7dd5deb4ae72c7280
TLSH
T1EB419D575AE94618F2F7BB08FEB04031DB26BC626C3CD54E81D10A0E45E5A50C9B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\MultiLanguage.ini
Size 2KB
SHA256 32b820879d4c602a475a05c945301da02cf3bf6f5cd45beb2d021dd3098186d1
MD5 b526807bf1d84410a300e0587089efab
SHA1 ee66a7ba3d819ebc9bf31cf637e2845e3629048f
SHA512 f9852fd73db4a10cdabe678e4100521a1de4976bb4477c05722347df369cfb858e3c2975b35c39b03af425d1809ccffaacc20addecd82c99885f561ca8afc634
TLSH
T14C419D535AE94608F2F7BB08FEB04035DB26BD626C3CD54E81D00A0E45E5A5089B6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\SetupType.ini
Size 2KB
SHA256 4151a8c33d282bc7ee5af44bdd0f635a335510727f2007d2cd7a8f76c667f365
MD5 79cab5ce332d20b5cb73b32b4c276832
SHA1 ea94998073eeef1b821d0ffd64aa6c8b42e9e28d
SHA512 c3bbd8e54899ab08b123aa797812b06a7ac4c62da4faaec6d696f5da7972debdc9bfacad9742ac7442e49b4773ee74a5b3990f4a832711f4d8006abad5dcb79c
TLSH
T1C65159233EFC5124E5AAF248EBF68174A7387445181DC91ED1E11E0F49E6B80466BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\SetupType.ini
Size 3KB
SHA256 4e5e3f8b99b8b30fde3c675ed3452dc30fbe0b4ca429778b6bd9bdec4ec942bf
MD5 86d89e561a2b5f1f5cf6a43d71929cce
SHA1 864375794b5f16e88592b3fa815233b6519c973a
SHA512 15f59f3a9a29820896bfae451d7c8849eeb7d1605ecfcaaead6f6ae70c2f45f7bbb6ee9a6033dd259c866dcd294d705d6c3e697e68a33abc2601ac419833cc32
TLSH
T1CE618D233EFC5124E1BAB648EBF68135A7397845581DC81ED1E10A0F49F5A808677BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\SetupType.ini
Size 3KB
SHA256 d193330d9cf3ba02888b56a46949898dd5f973c551a0ed24f5f1ca4311fed560
MD5 91561fe49573b6011b93a7bb938e08b1
SHA1 6a6e13a8b76a501997a785a1331aed1aa3135378
SHA512 3ba320d766ee07ada48f56b9b3d204d7b0ab599445ce3c2e3c3e71984547104d97884ca111a39deeb448833bd2d104d0aac57add3dee715d2b56ebd463ba060c
TLSH
T121619D233EFC5124E1BAB248EBF58135A7397845581DC81ED1D10A0F49F6E804667BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\SetupType.ini
Size 3KB
SHA256 1d4b840843e2c963c6606ccbbe7e7cded9a41cf733e8b60eae3a3d3fd1f5a7a2
MD5 a7966fcaa7174a69580acf268c17390f
SHA1 9352a275918566e7316a3fc873dd1856ba0e0997
SHA512 aca8466d843869de82cd0c9be989f560cb2989926900d4c79331d6aaf6ee8ad2af806b912ce22dad28250e06c12856b6404f77a54bf85282cecb03938f805a91
TLSH
T1C8619C233EFC5128E1BAB248EBF58135A7397845581DC81ED1D10A0F49F6E808667BEF
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\ioSpecial.ini
Size 1KB
SHA256 84d7edadb217569149ba9a101dd700d462b2f695ba56497ce850e5dc112ebb57
MD5 0cc83a6d3a6235c5e8ead7b05c36a10e
SHA1 273f3bee99a7c8378ed9d64225a8406d32d919a5
SHA512 413f17f2367320d5b634cf0591702f2ebc74787729f3b9bf34655176ed30dc8f3cb97095813ff826ffa389bf2d20228340a351e437f1005ceb4281ceb58f67d8
TLSH
T1DA214F432EF94014E2AAF648EBF581319B3A7859582DC51E81D10E0F45F9BC08437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\ioSpecial.ini
Size 1KB
SHA256 9778f731a9b17370c4f6faf3ce95e5ada5f95a4d2a927be83639dca794a83281
MD5 f5f8e792db5a015291d5956bd4d459de
SHA1 aeb53b0cfe6485038371b5f42a811563eb1caa01
SHA512 41f312ee2aabe6ee6bd000f24724381ffb799b01efb63b2dcbcf79e3b02b6914ebd6075720afe7cfdace2355c886c2cba26c2f2b3b4d1b9170637c2aac639072
TLSH
T1222160032EF90429E2BBF648EBF5413597393856642CC91E90D10B0F45F9A808827BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\ioSpecial.ini
Size 1KB
SHA256 a9c82012eb01d7957f2f7ce92d8ff5a42249754da7ac0b364456e038a0abcd28
MD5 2533f16ea626ab194ad5d0ba9ea2a6cc
SHA1 3b7269be82079ffec7310ebdceee9df39431331f
SHA512 324923b7e01f0c34f828e9354807a456eb3da68c728e9edc1e306ca85b051a2ad02e34dbbe2de60c95c353dd670f421e817fdcd0870a2a592d3d19982b9d8d97
TLSH
T1063162032EFD4429E2BBF648EBF5813597393856642CC91E91D10B0F45F9A808927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\nsArray.dll
Size 12KB
SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
MD5 da4bc09439ed21faf7620a53433aac92
SHA1 94e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA512 920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
SSDEEP 192:LULA8tZt1pehCUVFpZ/XXz5F8qioPYtS/Z8i4NVhWp1h2ph30R:gLAe1peEUD/X1F8qiAFLhOh
TLSH
T14142F8429F9142F2F9F74276B9BD1930292DAD01AB2ABDDB032750582D20DE33E35753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcessW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\nsProcessW.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz53C6.tmp\nsisXML.dll
Size 12KB
SHA256 35e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
MD5 c5285d861243f3b41648af5c0ffd5678
SHA1 50012e20b898e2f1abad27a4bdca12033e618add
SHA512 92c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
SSDEEP 192:3/ufSdX+LHASTxwSODR2bzdA74gB0jpYEfb:3mfSEL9lwpRv50FXj
TLSH
T1D542B5033FB6D9F7C84A1275BF8AA796D6F4630524800C06D3560E1E6F318AAFD7DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 73fbb136a09bc7d8ed7cfbcbc3adf6b4c3222e2e777581350c4a7f74ddd7998b
MD5 f9f03e23e902771ef016a03668169772
SHA1 cf890a718ef55c64a7ea20d14e4b8489588e1bd9
SHA512 e667e95c0ca9bb9797ccf00c4e8ed6ec0f72199c7a357b87eb7fb14e1ac9a20de2662bb5bbdef36b9eb6d9a60570de81c8d3b7c4700dd13a8909fc1189cfacf2
TLSH
T180216E571B8ED47189E01BA71CEC8E2573B7C7CA87A0D0A5738DA0394C0316D5B3E15D
MD5 SHA1 SHA512 TLSH

Submit Download

downloadedCertificate.txt

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt
Size 476B
SHA256 4c36de43aede9c106d04c24d8f2bcbe7e74cb92b42fd88177c6ed932812bf9d9
MD5 e360e7700227921533270fa0ba500cdd
SHA1 ca21c2d3940d5543d4403e8b03a9563c2f375933
SHA512 456c20e23b4fa7a72ee32044d86f581a46fcd5b55c562085fb94dd6a00d823338bda9e313e936f6e5d0898905e3e97b3581532bb601e667cd9054d9913da1d46
TLSH
T150F097787314D9AAEA3D3CE5CC040BA1C709155A83D4E8A0A23D88173997023EF2B3D5
MD5 SHA1 SHA512 TLSH

Submit Download

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\script.ps1
Size 656B
SHA256 1a569fbaca7103ba08baa6c817826fbb907772bb46c6c836999ca956819269e4
MD5 17444f73a11cd36991f6a7416a0ccc21
SHA1 d9e162bc3df5220403078756b41d49eebf56af57
SHA512 355091a8bf0b77d904944a2d59913941114fe2bc57b64ab97a75224668771b86d879cb580248474edb37102f6132a5bb513c31b2eccb931ea81d5bc20fba533e
TLSH
T13BF04E18DC457D13A95297B8DB1378ED8D4D81FF41825841B0F29A897299531DBFC2CB
MD5 SHA1 SHA512 TLSH

Submit Download

versions.xml

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml
Size 5KB
SHA256 d29decac3f8540e370f6a8557a8ec48c2da1871e48add765567a75cc4f92a079
MD5 452264f31c5dfd2e8272d365665eae9a
SHA1 f9c16711794b40e850161816fc15c000f76c2b47
SHA512 2952508ed576cadb22bfa3ec4bdb8531d99db05d7384d5d87f57f8319dd3035400dee006937ddb4cb6c88c2a12a4404d26c7e11bac25da30419dd7a1a5cee99c
SSDEEP 48:cfZxoDACYSgxm3qeDBztfxNz/W9V5kbGzMfcxO3KR5lzOOz42GsKJzDwGYNHz2XI:8IsC1xuPvlL8wnP
TLSH
T180C1CC3B4942EFB32F5C7BAC51D669DDF2336038BCAA40CE9CAD8E414E9B156347114A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrarinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
Size 3.7MB
SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
TLSH
T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Copirigh for Nate asset.pdf

Path C:\Users\Admin\Downloads\Nate Steam donation release\Copirigh for Nate asset.pdf
Size 49KB
SHA256 17ee27ea0ac6eaaff438365e1636f1213dda0d2a8ce3e50a4b615b2a154e172d
MD5 8abb8c36c490c96a6a3dc20afb35d0a0
SHA1 9a8baea8f477d7349f88b7658366b9f6332f256e
SHA512 41f4f92f294f2e399f6db8795b4326afd002e3f5cbcecefdb37839b5dbd22be629defd0ec0084c0b1808ce78958170ae9b1bd8f91d695cff55736f6283a5b8b8
SSDEEP 768:IpKaUuz1DhI1j6+UpPueb7Vs07utWKNYaCS76NwoXFi0xMvs3m+j5tljzv1Tz:WN1z1DaSuenVXON/CShoVME5tl3Rz
TLSH
T1CC33E1779A03200CDECC5A53DB2D30C89FD5F157A6D92C6500BC3BA7BCC16986EA6593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR-723.exe

Path C:\Users\Admin\Downloads\WinRAR-723.exe
Size 560KB
SHA256 44d2d9bdb8e208d580d92837cfc44ba5256bb9568c46de1519c466f1596a3598
MD5 6c9713fcaeee6d62726578e0ab2ab46c
SHA1 b73e2c55e03b60a7de6073a1a24eb3c335a55040
SHA512 7f7d4a7291c9661ee81be288546d5726284aa0244b7fec2404787b5196ccf47cf66775592b078e00353650396e24a3fce1b9ab818ffee5501fb55a4dc1bcde74
SSDEEP 12288:UyWZj3X3usBEVStra3oJrmg0w3iB+fcH+NTeYthvzZQ+Q4wRm:UyWZj3X3/BEVneyg73rxNTeArwRm
TLSH
T11DC41220DB91CA16D5BB9A705BF2D7778732F8614564820373C02B4E7932B826F1FEA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca889e1a-10ee-4228-9d2e-dab1dc0ca6d1.tmp

Path C:\Users\Admin\Downloads\ca889e1a-10ee-4228-9d2e-dab1dc0ca6d1.tmp
Size 4.6MB
SHA256 d8405e57f354b94bbdc7e13d7a6957b3b2b92e7eacfdb8d07e6798712088746c
MD5 287087a6681de0d5b712e10ee7b3b022
SHA1 ccf235d3fdff220e617e14fb1e526dd99ad23231
SHA512 aee4b5918cd91ec626e8bc3c1a67afea3b70eae0e47950a3acc01d5c90162834c76e15f285975a78d80665d939e75d144aa3a7e2a3f530c25be1c52fe3dfee8b
SSDEEP 98304:otY2F9cJh7punadZ7df10TlH5idBUyZOSdmuXM2wEDaLajtxG:eY20np4arN2KdSyASxI04ajt0
TLSH
T1B62633CF742C073D5C238E1B9507FCAF98E1A3DB141C99BF8154E4DBA0AA9DE971085A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9e8c86a-58dd-4d43-815e-92d8705c3419.tmp

Path C:\Users\Admin\Downloads\f9e8c86a-58dd-4d43-815e-92d8705c3419.tmp
Size 32KB
SHA256 5c015746c647aadc098c55e66636a43dc08833e23ffd8f6d2fe3e3b6606622df
MD5 30c256c3b0f2e9c53579bd23669065ec
SHA1 7634bae7e791b7369c2e5fe62c81f7e8d29ae2ae
SHA512 135a4cca4156426f1267a1044fcc0eb8864d5546f8a87e253b3614298494775adea02905aea77b54f1f078a03ccfd7387f71f83b10753785d8b2bc52f9f94050
SSDEEP 768:Oa2Ds2NyFZ/RREHXfi25rvilCZs6qYw7jFVryYLYMubM:O5DswYZ/RREHbRtZsPYwlV+YLsM
TLSH
T1CFE2F1D701C46C883C72718F8E88746E1B87DD650A936690667BCFAD385FE39A604C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-2212-0x000000006F7A0000-0x000000006F7EC000-memory.dmp

Download

memory/672-2223-0x0000000007080000-0x000000000708A000-memory.dmp

Download

memory/672-2229-0x00000000082C0000-0x0000000008864000-memory.dmp

Download

memory/672-2208-0x0000000005770000-0x0000000005AC4000-memory.dmp

Download

memory/672-2228-0x0000000007360000-0x0000000007382000-memory.dmp

Download

memory/672-2225-0x0000000005730000-0x0000000005741000-memory.dmp

Download

memory/672-2213-0x000000006F920000-0x000000006FC74000-memory.dmp

Download

memory/672-2224-0x00000000072C0000-0x0000000007356000-memory.dmp

Download

memory/672-2221-0x0000000006E50000-0x0000000006E6E000-memory.dmp

Download

memory/672-2211-0x0000000006E70000-0x0000000006EA2000-memory.dmp

Download

memory/672-2222-0x0000000006F60000-0x0000000007003000-memory.dmp

Download

memory/1940-2337-0x00000000083B0000-0x00000000088DC000-memory.dmp

Download

memory/1940-2336-0x0000000007550000-0x0000000007712000-memory.dmp

Download

memory/1940-2328-0x0000000005B60000-0x0000000005EB4000-memory.dmp

Download

memory/3436-1320-0x00000000039B0000-0x00000000039D3000-memory.dmp

Download

memory/3436-1251-0x0000000002A10000-0x0000000002A33000-memory.dmp

Download

memory/4804-32-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/4804-30-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/4804-29-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/4804-28-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/4804-31-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/4804-33-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/5020-2192-0x0000000005A90000-0x0000000005DE4000-memory.dmp

Download

memory/5020-2194-0x0000000006030000-0x000000000607C000-memory.dmp

Download

memory/6096-1208-0x0000000005CE0000-0x0000000005D02000-memory.dmp

Download

memory/6096-1206-0x0000000004FF0000-0x0000000005026000-memory.dmp

Download

memory/6096-1209-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/6096-1220-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/6096-1207-0x0000000005660000-0x0000000005C88000-memory.dmp

Download

memory/6096-1221-0x0000000007D90000-0x000000000840A000-memory.dmp

Download

memory/6096-1210-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/6096-1219-0x0000000006550000-0x000000000656E000-memory.dmp

Download

memory/6096-1218-0x0000000006060000-0x00000000063B4000-memory.dmp

Download

memory/6096-1222-0x0000000006AA0000-0x0000000006ABA000-memory.dmp

Download