hxxps://ts[.]bzzhr[.]to/d/qg7frnyf68f5?v=VnDe1Dvy6-dcnd2Epk31z3lniw_DzTRjq--R_c0b9BW7q9y35jkGP8m4D6eGjiZty7efLJ8hSsMtCLv7Xh2hM1mbMisacxBV4mJ6XvNbsH7Q_HmNyUkrDsMg46tN7wzFLOp4mx9aG8FkM8gfUpruVZ4OxpCPPvTGO5xqcK28oxU327TJqg

Analysis

user interaction
yes
max time kernel
413s
max time network
399s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ts.bzzhr.to/d/qg7frnyf68f5?v=VnDe1Dvy6-dcnd2Epk31z3lniw_DzTRjq--R_c0b9BW7q9y35jkGP8m4D6eGjiZty7efLJ8hSsMtCLv7Xh2hM1mbMisacxBV4mJ6XvNbsH7Q_HmNyUkrDsMg46tN7wzFLOp4mx9aG8FkM8gfUpruVZ4OxpCPPvTGO5xqcK28oxU327TJqg
Sample261022-wy3sdset8z

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
155	4552	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	winrar-x64-723.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
4528	winrar-x64-723.exe
2464	winrar-x64-723.exe
2332	winrar-x64-723.exe
1736	winrar-x64-723.exe
5040	uninstall.exe
1732	WinRAR.exe
5772	Terraria.exe

Loads dropped DLL 2 IoCs

pid	Process
3268	Process not Found
3268	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240859468	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5140	5772	WerFault.exe	162

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Terraria.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6100	vlc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	WinRAR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	WinRAR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5048	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6100	vlc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1828	OpenWith.exe
1732	WinRAR.exe
6100	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	taskmgr.exe
Token: SeSystemProfilePrivilege	5608	taskmgr.exe
Token: SeCreateGlobalPrivilege	5608	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
6100	vlc.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
1828	OpenWith.exe
2464	winrar-x64-723.exe
4528	winrar-x64-723.exe
2332	winrar-x64-723.exe
1736	winrar-x64-723.exe
4528	winrar-x64-723.exe
4528	winrar-x64-723.exe
2464	winrar-x64-723.exe
2464	winrar-x64-723.exe
1736	winrar-x64-723.exe
1736	winrar-x64-723.exe
2332	winrar-x64-723.exe
2332	winrar-x64-723.exe
5040	uninstall.exe
1732	WinRAR.exe
6100	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 5052	1664	msedge.exe	85
PID 1664 wrote to memory of 4552	1664	msedge.exe	86
PID 1664 wrote to memory of 1412	1664	msedge.exe	87
PID 1664 wrote to memory of 1412	1664	msedge.exe	87
PID 1664 wrote to memory of 1412	1664	msedge.exe	87
PID 1664 wrote to memory of 2876	1664	msedge.exe	88
PID 1664 wrote to memory of 2876	1664	msedge.exe	88
PID 1664 wrote to memory of 3836	1664	msedge.exe	89
PID 1664 wrote to memory of 3836	1664	msedge.exe	89
PID 1664 wrote to memory of 3836	1664	msedge.exe	89
PID 1664 wrote to memory of 2996	1664	msedge.exe	90
PID 1664 wrote to memory of 2996	1664	msedge.exe	90
PID 1664 wrote to memory of 2996	1664	msedge.exe	90
PID 1664 wrote to memory of 2060	1664	msedge.exe	92
PID 1664 wrote to memory of 2244	1664	msedge.exe	93
PID 1664 wrote to memory of 2060	1664	msedge.exe	92
PID 1664 wrote to memory of 2060	1664	msedge.exe	92
PID 1664 wrote to memory of 2244	1664	msedge.exe	93
PID 1664 wrote to memory of 2244	1664	msedge.exe	93
PID 1664 wrote to memory of 2320	1664	msedge.exe	97
PID 1664 wrote to memory of 3824	1664	msedge.exe	96
PID 1664 wrote to memory of 2320	1664	msedge.exe	97
PID 1664 wrote to memory of 3824	1664	msedge.exe	96
PID 1664 wrote to memory of 5016	1664	msedge.exe	98
PID 1664 wrote to memory of 5016	1664	msedge.exe	98
PID 1664 wrote to memory of 3288	1664	msedge.exe	99
PID 1664 wrote to memory of 3288	1664	msedge.exe	99
PID 1664 wrote to memory of 3288	1664	msedge.exe	99
PID 1664 wrote to memory of 4344	1664	msedge.exe	103
PID 1664 wrote to memory of 3452	1664	msedge.exe	107
PID 1664 wrote to memory of 2104	1664	msedge.exe	108
PID 1664 wrote to memory of 3872	1664	msedge.exe	109
PID 1664 wrote to memory of 4436	1664	msedge.exe	116
PID 1664 wrote to memory of 4436	1664	msedge.exe	116
PID 1664 wrote to memory of 2024	1664	msedge.exe	117
PID 1664 wrote to memory of 400	1664	msedge.exe	119
PID 1664 wrote to memory of 400	1664	msedge.exe	119
PID 1664 wrote to memory of 400	1664	msedge.exe	119
PID 1664 wrote to memory of 5116	1664	msedge.exe	121
PID 1664 wrote to memory of 5116	1664	msedge.exe	121
PID 1664 wrote to memory of 5116	1664	msedge.exe	121
PID 1664 wrote to memory of 2452	1664	msedge.exe	122
PID 1664 wrote to memory of 2452	1664	msedge.exe	122
PID 1664 wrote to memory of 2452	1664	msedge.exe	122
PID 1664 wrote to memory of 1764	1664	msedge.exe	123
PID 1664 wrote to memory of 4324	1664	msedge.exe	124
PID 1664 wrote to memory of 4324	1664	msedge.exe	124
PID 1664 wrote to memory of 4324	1664	msedge.exe	124
PID 1664 wrote to memory of 2660	1664	msedge.exe	125
PID 1664 wrote to memory of 2660	1664	msedge.exe	125
PID 1664 wrote to memory of 2660	1664	msedge.exe	125
PID 1664 wrote to memory of 2604	1664	msedge.exe	126
PID 1664 wrote to memory of 2604	1664	msedge.exe	126
PID 1664 wrote to memory of 2604	1664	msedge.exe	126
PID 1664 wrote to memory of 2376	1664	msedge.exe	127
PID 1664 wrote to memory of 2376	1664	msedge.exe	127
PID 1664 wrote to memory of 2376	1664	msedge.exe	127
PID 1664 wrote to memory of 4016	1664	msedge.exe	128
PID 1664 wrote to memory of 4016	1664	msedge.exe	128
PID 1664 wrote to memory of 4016	1664	msedge.exe	128
PID 1664 wrote to memory of 4728	1664	msedge.exe	129
PID 1664 wrote to memory of 4728	1664	msedge.exe	129
PID 1664 wrote to memory of 4728	1664	msedge.exe	129
PID 1664 wrote to memory of 1580	1664	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ts.bzzhr.to/d/qg7frnyf68f5?v=VnDe1Dvy6-dcnd2Epk31z3lniw_DzTRjq--R_c0b9BW7q9y35jkGP8m4D6eGjiZty7efLJ8hSsMtCLv7Xh2hM1mbMisacxBV4mJ6XvNbsH7Q_HmNyUkrDsMg46tN7wzFLOp4mx9aG8FkM8gfUpruVZ4OxpCPPvTGO5xqcK28oxU327TJqg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffb8ecdc188,0x7ffb8ecdc194,0x7ffb8ecdc1a0
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,1313887915663629796,10272309006237852017,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,5828160881111273350,12775810430001493796,262144 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,3776992520939180676,8904613560619191082,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,760479261097822952,4235562827121073755,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,8939041146303314719,8909715814749243770,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,7041934873275932955,2645424100032434835,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5601246459904589521,2646755382284427390,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5285533377491465438,5346136265215717071,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,530297297627916373,9721270288200406301,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9551464522975931917,14239866237829574496,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5756,i,17774908464598973767,7401295345980317931,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,16992246634312423616,6616320619316957208,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,16992246634312423616,6616320619316957208,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,18097336761081524790,2679786690193740650,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,9811858529441280578,7128132424148361355,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,4682738221958319320,15216696889659925105,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=116,i,14117091595668850509,553521162830541841,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,16627983792964180171,7046461878874264272,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4388,i,4523199519765504379,11170678402805779077,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4320,i,7823082030700824413,13690883489627323259,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3544,i,16830785327840861447,7400547082547780578,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,8757348565716308662,1176876349412184467,262144 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5260,i,1665490622757773381,117452668186223191,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5064,i,8967359191504895491,4339295290510446240,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4352,i,7565001511701739897,3265149183830396703,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4196,i,8377704138678374580,15215795035972837405,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5372,i,7146140863549187547,828948099003888106,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7332,i,14647020746256124684,6657919645448537975,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7452,i,16287775235990387628,4708093385978021652,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5520,i,15486777139515649912,16542441937194597046,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7424,i,13460011699383030852,5808560710887784937,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=1328,i,8513235253082865002,2976197381549326618,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7752,i,17170698456131793771,693372336148470127,2097152 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,12301477436906617712,80034713504376100,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:8
  2⤵
  PID:4008
- C:\Users\Admin\Downloads\winrar-x64-723.exe
  "C:\Users\Admin\Downloads\winrar-x64-723.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4528
- C:\Users\Admin\Downloads\winrar-x64-723.exe
  "C:\Users\Admin\Downloads\winrar-x64-723.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2464
- C:\Users\Admin\Downloads\winrar-x64-723.exe
  "C:\Users\Admin\Downloads\winrar-x64-723.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2332
- C:\Users\Admin\Downloads\winrar-x64-723.exe
  "C:\Users\Admin\Downloads\winrar-x64-723.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,1517857699912238915,9526929681645516080,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,13520574730158491976,13242325340093798985,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8084,i,18115237657881520873,7218291938746046258,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,5052042346704470194,14764075579399464205,524288 --field-trial-handle=2028,i,3943251490846761185,3612458101400513412,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5180

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SetPing.mp4"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FindMeasure.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5048

C:\Users\Admin\Downloads\Terraria-SteamRIP.com\Terraria\Terraria.exe
"C:\Users\Admin\Downloads\Terraria-SteamRIP.com\Terraria\Terraria.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 832
  2⤵
  - Program crash
  PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5772 -ip 5772
1⤵
PID:4100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
MD5 af2f59a1c3b3589c2e1506ab00b6148b
SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 dcb5761b0d33645b9565fd6b5e022b15db0082062c0fed22202a9e6bebc86ed5
MD5 4467fa6a971f8954cf726c1f186cec05
SHA1 b905566456a46b7f645501ac2ae54c39ab8d7cc3
SHA512 86cab3d393b4f4fbc8f4a23f13dfd700f6805b7a0dac9bf3c9a8195d5aeaeddbbbba5ebd571cdf74c03fb8bd7ae5b0b1c5f83ddb7b9c6af3fe5527abe8e5239b
SSDEEP 12288:OyrI1lJlLZHJndEB7UFJtdqri2+arBQKuk9ltyiq:OyrIHJxHdEB2JbqzrBQKdltyiq
TLSH
T149E48D09A69853BAD47FD07CCA83461FEAB278558372C7CB03A116AA1F177E1573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 403KB
SHA256 b2c9507de96f47f81a183985c2c1e350ee68fead1da3d91b90e5cfdb2dd46a56
MD5 0a62132d9d3bc70d0e7647985070fee4
SHA1 17900e092aad22a4e37c9b5d07a59a89ce53abce
SHA512 a2f6e5cae58280e8a05971d2b35e29a962096ce213df7a8896be1ce6b376dd0feac0de236aad5fb614095851b464da2235fad45771930fcb2722624e4dfd021b
SSDEEP 6144:K1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLRMIII+Sn5HBK7jc8b:OM1m5Pwtq9VSrJFgaIIvS5ejc8
TLSH
T1EC949C1EE3A455F9E5B7D13CC8924607E6727C558BB1C38F07910A5A2E237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 64KB
SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
MD5 a1bee36438565456368f497fb69195d7
SHA1 83940cda35e775151197f08531bd445556185889
SHA512 35db801d5194fd21481203235c3a00adb60cac8c8e359c3ec06d75d8c50ab23d5cc4d4f1d55286ac9f90d1997729d3e0398994ef38714e69935c9391d055aeee
SSDEEP 768:sMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:sJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T1015394237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A6D2F72FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
MD5 b2edb6e0812a75b601019485047a17a0
SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
TLSH
T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 130d6b728ba6f4b129c84cd3a6ee0b71a11219f813c4df181fb6823ffba7f484
MD5 f4078930cf6dd7db9bee2aef685eea0a
SHA1 dcc5d395a4af31ad30372321dd86cdc78e498bb7
SHA512 dfec77167f701b6880e3a20c11c991de044c424bbbc145aca563b043a94ece974813a6212d58719715a1840ebd6e5200905c57bf080cb1d648aaf6bbea1cf2b0
SSDEEP 49152:a7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgUUejuOXk0jdEKBH4S+:NsoEC9SKuO00j9BH4S+
TLSH
T107F59E1AA3E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0299ffd9-ae03-4f5f-a1a1-e1a81caefb26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0299ffd9-ae03-4f5f-a1a1-e1a81caefb26.tmp
Size 8KB
SHA256 a8f33cbf1c79cbf112bbfa7fc6eb5697224288181602831dc999a1e223f21b7b
MD5 636d465c0f6c94e11d51531cd3d3c83a
SHA1 dfa78ca45b662fcdf75b7cbeafa6d27c2bce3aa3
SHA512 c4e34e3bcf33175fe6d5948a70967117fdc7b60b2b1d0cb4c79d3deb8ddee46b53898b09e8a65a743c2c490f748190178ecd0c96d186be4f90b5aaa05a6158d4
SSDEEP 96:3qONk2Qsjpfe/tyng7X5ih/cIPURHl8h4otop5oYDaNBnP9ZvEI0IG2jbZ0rLYyI:aONC6IE7QmiUy5aTPuIGmSrLRC7sp6U6
TLSH
T13C02F935EC787CBB9EF3AD48F4873B236EA5112BA5952F84D9D85A1D00D724C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26b2e2b1-bffd-4658-bb90-85324229717e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26b2e2b1-bffd-4658-bb90-85324229717e.tmp
Size 21KB
SHA256 7a3c5dd759e7a7d3590ab76a7c3dc6c3e87bc4c7d7eaaefa5193366f83e3e1cf
MD5 27d396dbb05541031acc97b4c20426a6
SHA1 f7f33e96c8d5e09427bd58466d227501b58e4820
SHA512 46ac9f4d17597339cb65b168f2fc40ef796aa720ddfe776bab7d35205654e31842af0a13fd93651480d760c32d7ec0a30a5404d988369291c802b1b932fe38d1
SSDEEP 384:WiFOQkUSvQesN98TUNTUlIRViK1fx/zIGmS/IIC9icvwQT49IIlO:9F+Zkwg+KrL1gticvmL0
TLSH
T17FA25D739CA89C7BAEB39E54F58A3603DEB0816BC6C46FA4E6CC5A1C01DB19C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d453a34-a064-4c39-8e3c-25e222f9d9e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d453a34-a064-4c39-8e3c-25e222f9d9e0.tmp
Size 18KB
SHA256 03a560af7e874f848308cc7af4a51b6648b21553f7af9911e93fe8ae4216148b
MD5 f7c5efb6af13d8c50e46736120e0adf9
SHA1 20c1616def7fdb39d77b3452ea82ef0f93a3dcb5
SHA512 cffd828a6d53e5aaa8992dcbcec1d60691411a8e2b983dc0e25b4f9b6092f272823766a7845243681c04ae79e2f072d70537429309700b7b24957cb0d1b69343
SSDEEP 384:SQkUSv0sNx4hK1xqDzIGmS/IICKicvwQT49IIlO:K0DKe31g6icvmL0
TLSH
T1CE827D36ACB96C775E73A954F58B3A03EEB4821BD6C82F94D5DD5B1C01CF298130BA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b952b8f-a313-40c2-a97b-8c7f383b738a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b952b8f-a313-40c2-a97b-8c7f383b738a.tmp
Size 12KB
SHA256 d56f75db2a989e3ed2fada45739d52ac5e059e71b9987da058c61b337561a072
MD5 a6f4f70bf8db93f54f49213856c47a55
SHA1 d4fbb907fb321a9a4ade671f1cd5bae975fb52a2
SHA512 7162826aa666aa244148d1db7bc333e32d82f3bcdc6b82959318f69cc1a8650045fe0fa7c14d06286aa0a042575dbb18ea3dc4872ef3742c2eec1ba268b00dd3
SSDEEP 192:u7LsNx4Q6mcE1CgQmiU1WhM4zIGmSrLIICi97iSqaLLgBpG:YsNx4hK1xqDzIGmS/IICKicUB4
TLSH
T17A424C37AC75AC77AEA3A944F4873A139EB4416797C82F94D5EC5B0C01DF2AC130AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72cff53e-0570-4460-b59a-df87aed55e7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72cff53e-0570-4460-b59a-df87aed55e7b.tmp
Size 21KB
SHA256 a23c6a6f6d0956dbd83a6f9c8b5cb29e641d6713890c57b676e06311cc747ce8
MD5 b9a51f7a107fb6fdf29159c668249323
SHA1 a6e34d0d06e3125dfcf51f81de9bf3d9363b8385
SHA512 355080fb4947a19803f0b5050ea308f6449a45634869a6a608da2d12efc730d01a68996ac1cf5e8493e257b3ace53cc90a2c60e9445568b38152513b96294a29
SSDEEP 384:WiFzQkUSvQzsND8TUNTUlIlxhK1xiDzIGmS/IICeicvwQT49IIlO:9FdMWwgJKW31gOicvmL0
TLSH
T1A3A26D739CA49C7BAEB39E54F58A3603DEB08167C6C46FA4E6CD9A1C00DB19C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

0a1a2120-05a5-4c51-bef0-a2a07222f306.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a1a2120-05a5-4c51-bef0-a2a07222f306.tmp
Size 14KB
SHA256 7847c0053804c1ab2fe991e299b214be0ee4e3050c0821f76f36b8bb48aabf54
MD5 629197184751230a28f08b7dd8971504
SHA1 fc5462864e601a3d3746118c4e720f303a35b988
SHA512 6ca97cd675b96ab07ac0eec59f6092d7167d987d5310577cd690c830cc63f9c1430357d9b115b5d259ce72de29b95f9aac7a7f50f7759f608de33a02d213bef3
SSDEEP 192:sxZ1qRi2cBWQ/faslKWdp2vMtaf5YHW6+WNL8FHKkXYapNo374Ig5kHXlHmtG8H6:sxZ1qRmWQ/fasl7jHbAjXrXE8wJ
TLSH
T17762B5536A24D977CCC6D519BE757F22D6F500329C921E8CAAFCC91C04EA6FD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3af74f33-7612-4d21-8409-8bc0b2ceb41c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3af74f33-7612-4d21-8409-8bc0b2ceb41c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

48d9170c-9d07-4577-ba0a-a92d54dc8ab1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48d9170c-9d07-4577-ba0a-a92d54dc8ab1.tmp
Size 9KB
SHA256 7feb140ea7e5058f61de9af5bc79b02e0accf5b7352b25c75974d31ca76d1d60
MD5 89a53e8302fc7db6edd0a871cdc4f9c9
SHA1 43cdd58fa08cec7b9317a6ce22e499805ae68bbc
SHA512 debbb78f272c906868349527657dd3c24d7dbe2ab4d29e05048677ecf2e689cfe8b053e8cfbe6ae50213d07eaaaf371778a80be58138e10beb19eadc79a64a62
SSDEEP 192:sxZ1KRinQ/fasMjwEdpJHW6+WNGYapJvU4IgrJ:sxZ1K2Q/fasM7JHbGr9
TLSH
T15912C4126E28A53B8CC7E21DBB65BF53D6F91032A1D01E58EAFC861C04E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d27dd24-c410-4861-8a39-937ee46e60f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d27dd24-c410-4861-8a39-937ee46e60f7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c70ecdc-679b-472f-94dc-7b4c640685cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c70ecdc-679b-472f-94dc-7b4c640685cf.tmp
Size 13KB
SHA256 2496e2b8ada57cf173a9e9c4dad2edb7b113935a76e56a3e55f4f436966bf814
MD5 4e0b7a38e639ce35f940062de2ee7e56
SHA1 f317b165a459baa884a54510050263734992e8eb
SHA512 c8d5cd70152c26211563fef12d40f0eeaabe7b3447736c2cff61f8a2bb71a88a76e9acf4692989dca26546c788227846130a53a850f42c7020156216daef3540
SSDEEP 192:sxZ1KRiucBWQ/fasl8Wdp9keHW6+WNiof/YapJo374Ig5WXlHmtG8H0y8:sxZ1KPmWQ/faslRVHbR/DXe8wJ
TLSH
T16452B4536A24D977CCC6D619BE357F62E6F500329C921E9CAAFCC51C04EA6FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61beffc8-69cc-4ea9-977f-32896f5f8a2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61beffc8-69cc-4ea9-977f-32896f5f8a2d.tmp
Size 10KB
SHA256 fd47ae2c22f758cbd12f542972f3987fa41127ce17e366cce5cfad2553feb4ef
MD5 2998d3e172978acf3f97f7e1ee1fba3a
SHA1 381f1a34a2cf44a65cfc2cabe74fba11310c8006
SHA512 79a08e5747eae7c050ce25ca8412f50bd0e22707adb721904d44ee24bcb91c88bde916e93f5f380bfcd44005a93ca1be3af123e109b6570de5df220decc93e40
SSDEEP 192:sxZ1KRinQ/fasljwIdpLHW6+WNGYapdoSH4Ig5WJ:sxZ1K2Q/fasldLHbGHSE
TLSH
T15622B7526E28A97B8CC7E21DBB55BF53D6F9503251911E48EAFC861C04E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

632c116e-30aa-4c36-a14f-a32d32e6586f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\632c116e-30aa-4c36-a14f-a32d32e6586f.tmp
Size 13KB
SHA256 47ce5240df994c739f20d778783cfb8f79e878f9d687e6fd605b9bc0e09d3113
MD5 a8443befe3ce27cc4a6513dc294218e4
SHA1 5414bab35743ff4326625792817a7c69705ec5fb
SHA512 585eb0665c4180d13b2e0c1e0adf30011a5706b84e812fa2ed43599570800354a1f15289d22983c6fdafeec53d12b6ec57b50f8321655b3c322d8057d534dc84
SSDEEP 192:sxZ1KRiucBWQ/fasl8Wdp9kTuHW6+WNiof/YapJo374Ig5WXlHmtG8H0y8:sxZ1KBmWQ/faslRfHbR/DXe8wJ
TLSH
T1F552B5536A24D977CCC6D619BE357F62E6F500329C921E9CAAFCC51C04EA6FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73e65cbd-24bc-4fed-b206-4e11e4404fb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73e65cbd-24bc-4fed-b206-4e11e4404fb1.tmp
Size 27KB
SHA256 33235ad22d4245118928a5d7dc44dca59938070e456f4657c84fbb193ff6185e
MD5 5055d425743c924ee9d44fa8579b16ae
SHA1 365f3bfa617c71f781a05ee2a1bf60dd8b7aac9f
SHA512 32e6d3638e1032f139557ee5d4554a0e2f34911e163dca27eee356e2d417f24c88bd016e06fa3422afc164473f9d663f28b0d3e736bfa81261cbb27ed6abbfb9
SSDEEP 768:1/WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Sro4ifedmRX:1/WPcLKWvKeEeu1jaClLiF7J4iWdmRX
TLSH
T193C2EA3B644CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f4a1081-df9e-4ad8-b63a-be2cf00945ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f4a1081-df9e-4ad8-b63a-be2cf00945ad.tmp
Size 9KB
SHA256 2618269ee4f9f57c857bf3b186477439e8b680a303daf6e10c8f2e2e82967f27
MD5 62f1c09653e29d2ae80177561ecc89be
SHA1 2c0b0b7a755ec8b68699e98f9c0a3277bb84f4eb
SHA512 9d3fd0bd5a165679ba675f805e6e74e8e51e46301d24343592420424d2c13f608dcd07e49949e502564fec6e5a92428128f189eb131c988d65783eef8bd07771
SSDEEP 192:sxZ1KRinQ/fasCjwIdpJHW6+WNGYapJvH4Ig50J:sxZ1K2Q/fasCdJHbGUG
TLSH
T14122B5126F28A57B8CC6D21DBB65BF53D6F95032A1D01E58EAFC861C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 921d837889004db2a3130e66419c96d0021a7fe1d40e50038ef1913ce652fda1
MD5 9089ecd727ed9fb0215b1baee6179473
SHA1 1655f1529892c530a404ff0724b6f823f7a054f5
SHA512 b50fd732bbea0017038ea54b3ed7fd48fef5b01a0326a0982ed0ed0365f83a6acc77be929921b5108cc101896c1209665976a30f6e38e6c72dac1e47cffbfee2
TLSH
T156E086D805C9D63FA31C7847026C974D8BD5662FB6C4AA9E2704D5CC7647544B2A37D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 85fc0d2d04226e5589386e4aa69e37d061b99253a9590bde8634b1ea6343ec59
MD5 60102b328fb1f20a5a0ccc913ad25d23
SHA1 0602566524ea6d970dd98758f71c1209c7e1b363
SHA512 c85876f0047362151ee774427721c1800917aaf1302c7cbc0f4a9e9c3c5a5246773043f1e9da208e439e9caa6de000117fa94a3558f41a6297f3db8c63950ef0
TLSH
T10CE02CC404CCC23FA33CA48702BCA30C9389261F92C06DAE6B00CA8476068A0AAC2792
MD5 SHA1 SHA512 TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000045
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 45KB
SHA256 940e937d624dff1d92f851eb934d25d8f553b21ece4ea0cd28ce09a9c26d42a3
MD5 44e017eb03ad119606b480cec663fa30
SHA1 9241911887c38c5465f7c2e52241aa36cef8fe71
SHA512 fa9327022c36d67b6a43370f035d1e7817e65e0a8260a14084dff52665372fafa909c2b1e41e7590aca67086c84f975093ceeb0c2169afad18f7dd066ea3bbe8
SSDEEP 768:n5tNF8slLi+NBxYf86HMA0PF8/3SDtPoHMzqQqZKq1r/sFD5f0tjlLILDkF1OYh0:5tNHxNBx286HaGfSDtPo0q5rwDetRwDH
TLSH
T17523F10BD1C595933AE03B3E3ECE143C80846699A757B2E2F12A350AC6E4F59C50F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 cebf0ac36ede1975cc3edebcc6b6845bddc77ba725d7c13e2218c63a0abe283c
MD5 33605711cf139ad1e038ddf3a19d11dc
SHA1 d5689ece8fa56019d31aa92eec1bad6e8a353b29
SHA512 9e883c3d1972118335e44886153dea7f7dd0c9d3875eaee05717efb6681cb9b074608a455d16c802ff94fe9c10dd2fe547fb59dbbdd2d86eba5dd916189ed274
TLSH
T19851DB91CEED8468FB9C45BFA9D37E873EF05A40795F6FD524E4E3B85B063418100855
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 b5299c5e77cfc5bf6a4d850df1c0fdd586bab0438f4587cdb81b7c989fc36bc0
MD5 2852db211a52bd8c82325d550b078090
SHA1 940ce3cee4d69b2ef55bb78ed929fe3604e34a61
SHA512 1143801d675b4a36c8a7880310a821e22b447094b63d7cefca0adc158c0638093e3cfea18594c3c3ded7b1b7f295201d89b79dc218cbda0a915a9dc3dcbbd045
SSDEEP 48:83AUtzI1X5jsrejR9jRkVwygQK7T3Elrr1mnFbaS6v98UpfCww1cSl4:izSX5jFjr9XyZKH3E1rE5U9VOu
TLSH
T1AE91B8C1CDDC8058FB6CED7B65D27E8BBAB15941AA4F1FC622F0E7794B463814948423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 3d836bdec7ea0ba0a9d8bf535e83ce6596c08ec898d9bcfc0b494739429f913d
MD5 9bd2220409d33218ef085ed902bfa22d
SHA1 fe483fdb61f6cbbd689f7d70ae62b5702f34b3ed
SHA512 9dbc92e1b460b77561dc9122e5b29fb5d936777d24124c01bfd95bbc995da4e01d27c2854a0b76527924e2da54c3b65b9774f6edccbedb8941f439ad7efc3bfe
SSDEEP 48:sAUtzI1X5jsrejR9jv2kVwygQK7T3Elrr1mnFbaS6v98UpfCww1cSD:uzSX5jFjrz2XyZKH3E1rE5U9VOD
TLSH
T15491D9C1CDDC8058FB6CED7B65D27E8BBAB15942AA4F1FC622F0E7794B463814948423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b7ee75d-f6bb-42da-83e0-4ef3bad14114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2b7ee75d-f6bb-42da-83e0-4ef3bad14114.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

43659182-39b8-4b5c-92be-a1263605edb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43659182-39b8-4b5c-92be-a1263605edb0.tmp
Size 2KB
SHA256 977f31ac4f249bd2825bb2d3b1413916b949524a5f58323932a6b7a2e0ad1036
MD5 70b3eeb804842688f12f0afbcdc2e566
SHA1 f8087691bc023a1152ca40e4cbc51d6574cf9987
SHA512 8aa8e7b14951b37991c7d710f873fab14e3ea01f86f16eb5aba6897c58c6acc2757c6f8ac4d00b5d4f508bf731b4b7abf2f3bf4ad6a3b652a28663a48f2e3f32
TLSH
T1F351ACF7C3E9826EC92156F09A18BE1BCE1D0946832C3D5AC4D4DF1B93E2471E241E9E
MD5 SHA1 SHA512 TLSH

Submit Download

7a9c93df-69cc-4f9b-9693-31ff7ad2c8ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7a9c93df-69cc-4f9b-9693-31ff7ad2c8ce.tmp
Size 1KB
SHA256 2a43d9509762e497a8b63f024c0f9b6de3102766b00fea02a8ae590fd65e6b52
MD5 c24bfe929992a41df8ea317bf3f0e58a
SHA1 23b27eb3c26825de522aaca0099ae8925cb61aa4
SHA512 a059b3154daa407f9597b32ae26e8a14d760a2a4375eb02944c943e7c730f6868866d7535f4e7ecf20701d3f1e0c10573a2a23c452e4a7c1af40f1539a34d8b3
TLSH
T1A7219CB7C3D5857EC91557F09A18AE2BCE1D0945822C3C1AC9D4EF1BD3E2471E10294B
MD5 SHA1 SHA512 TLSH

Submit Download

890c9a95-c944-4f18-8a19-468c37bd74d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\890c9a95-c944-4f18-8a19-468c37bd74d1.tmp
Size 209B
SHA256 e99f25e04537163f1e714d9ea6a3dcb1efb4b1b9339cecf3fc1284b640cf4f4e
MD5 1197d81bfaf3780dcde2224c60d5888b
SHA1 28af25eafbdab79d3ba88c3fe0c0b7274cb8b960
SHA512 059824c4b2def749a612b4452e327c7ee0f9215e6fadd5d508805aaf2d9bd222a2c64ce832cda3d1963f8cbeb3f19d508aeaa21c9809d0fd43a36cc807b632be
TLSH
T1B3D022237280B1F1826C3D946029EC6BC372002A4893D6DC94D0DA5C79BEC2F074B0C8
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

abfe7534-0867-4220-b80c-6a4e92b93fac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abfe7534-0867-4220-b80c-6a4e92b93fac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

add11154-fdb8-43f6-aed6-476de9126653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\add11154-fdb8-43f6-aed6-476de9126653.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f698ddf5-e33a-48e4-933b-1a774fa46c42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f698ddf5-e33a-48e4-933b-1a774fa46c42.tmp
Size 1KB
SHA256 d96285ee15f0c0956c83a9d7ded66368f51c73b47f2d9baa029df78dd9e50288
MD5 364a61f7192ced54d52291d2f23fb226
SHA1 cdb7283147de2068a9846d8c9284ac2be355ea37
SHA512 d198b877543a5d66ca8fec90e4031b2b2d84d962090aa1641510bac09ccd20a15b90fccebfea488282609405be4082dd4260ae07ebb184b01d00f2b8ffc5be0d
TLSH
T1ED219CB7C3D5857EC91557F09A18AE2BCE1D0945822C3C1AC9D4EF1BD3E2471E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 52424a19591310e833815be7b5e025ef8e55f538e1b6934dff87fa0bd4a0b293
MD5 3c7c5b94794842a3735ba4512d44ff53
SHA1 8829082658dc4c6543ef1bdce3518eb3b7bf14ba
SHA512 6c5faad86dec058a159f14d0ddf6907294dd71a4cb06e81b42eeeff8f6a7b0fab5144a65aa620f6350bbddf1785eb0d55d0cf87a380e3ffa7f3b806cb076c387
SSDEEP 96:KyFkBFnvvu1/21HluKfbHjuLtluzVvYtMpNv3H213+9HN2KfTHb2LltWrxioKnqu:5FkBFnvvq/2VlFbHjmtluzVvYtMpNv3u
TLSH
T14E914D04357F1260387E2B4850A4CA6B42623172306CEE6F7FBC61B64E6EE561DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c09f7b54-60b7-4619-b21a-6968338e8723.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c09f7b54-60b7-4619-b21a-6968338e8723.tmp
Size 10KB
SHA256 f45d4986e24165d5e1d04b0d7cc8cbe21654168dca5b90579618c40720131302
MD5 bd6a82cd95beef883418343243959c77
SHA1 c45dee882b2eac48e0a6ecf3de02ceb1b5113cd9
SHA512 0b5e0a970e8da36b4ade5226d06c1aa59d3af43f5e4ae0bd33526cd5b7b388b115223131671dc56f9ce075aff1371b813d71d743cfc59344e0202d0e1ab80d94
SSDEEP 192:sxZ1KRinQ/fasljwIdpJHW6+WNGYapURH4Ig5WJ:sxZ1K2Q/fasldJHbGtE
TLSH
T1DC22C6526E28A97B8CC7E21DBB55BF53E6F9503291D11E48EAFC861C04E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fed01a13-f8fc-4630-bee9-f9df3ef9f938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fed01a13-f8fc-4630-bee9-f9df3ef9f938.tmp
Size 13KB
SHA256 38baf84dc8174fb7841041f3098a66114f06641f7ea186396372646740b95196
MD5 60cbfef3d3a3a92ee784740e2583ede0
SHA1 27bdad4c5fbb7b036d2f917ce73e888f05253ed6
SHA512 9655cfd4ab841476b16e220c35066e80d67cd4937def57ead29ad1f200a4be20e382dc64b5457de63ebd6766ed72246ff4dc73f6339f300a0c4884fe02c7ce34
SSDEEP 192:sxZ1KRi2cBWQ/fasl8Wdp9kTuHW6+WNiKkXYapTo374Ig5WXlHmtG8H0y8:sxZ1KRmWQ/faslRfHbwXhXe8wJ
TLSH
T14752C5536A24D977CCC6D619BE357F12E6F500329C921E9CAAFCC51C04EA6FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5fa38d3-bd7f-4fe3-9656-cefc79bdb315.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5fa38d3-bd7f-4fe3-9656-cefc79bdb315.tmp
Size 8KB
SHA256 adbab71683d83a0b1626d28e734fbfc193d2710f1212ef14518608626673cac2
MD5 5d61dac0d6e30fe936ee7d84a8fdbfd6
SHA1 2df3a82d3bdae6495cebd163d353420feef29b2d
SHA512 49018c059e57dac760d482d4fc1e1d3c2897ad7bae22962bf9d8a2a9e258874276bc3136cd42363fd0b812253a750bd186f08088c481572c0f4e6c4165b5c5ed
SSDEEP 192:4ONE6IEIQmiUy1aTRuIGmSrLIICL27HSqaLU6:4ONE6DoNRuIGmS/IIC4HcU6
TLSH
T14B121B36AC78BC6B9EA3A954F4873A139DB5422BE6887F90D5DC1A0C01EF25C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee0464b5-2174-487c-a81b-b5cc507f0781.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee0464b5-2174-487c-a81b-b5cc507f0781.tmp
Size 21KB
SHA256 1fbfac6407f6384d1b21519e0d599365561b69082171ee44c64e970fc3388f37
MD5 34d0210443b415507b5c132b1830149d
SHA1 912a6cdd58b11a4b9a6d9c7164ca9ecea83a552c
SHA512 f95b9aa93ec25566ce78338a5d98702765f777b69d236a8a7936d23ec729a1f4a8dd676a6b45f5df662b63abbc607ef15dc86b12e09dc4b6a2dfc71484f4ebb3
SSDEEP 384:WiFgQkUSvQ5sNo8TUNTUlIlVhK1CMk2zIGmS/IIC5icvwQT49IIlO:9FIWrwgZKbkA1gpicvmL0
TLSH
T19FA26D739CA89C7BAEB39E54F58A3603DEB08167D6C46FA4E6CC5A1C01DB19C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb490fe6-0084-4838-a950-443f4f76786b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb490fe6-0084-4838-a950-443f4f76786b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f036a69d-10bb-4bc9-88fe-edf672b538ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f036a69d-10bb-4bc9-88fe-edf672b538ee.tmp
Size 18KB
SHA256 82d85efdeb586737f29532851a06c2bbd91aa459cbc0d35e52eecf0b6080e084
MD5 96760538210fc4ccd1eccf412f2fcf87
SHA1 1d95e1a0247acb04861593de41ced715d8130e62
SHA512 f7d8336556fa8dfc62ef2e3d232d3351d1f67ec5de2deaba9ef528dac5911d087ae88331dfffb54650757746f6921915d10c26ff1bf81c3f70daddcead5f6d09
SSDEEP 384:nQkUSv0sNxxhK1xiDzIGmS/IICKicvwQT49IIlO:506KW31g6icvmL0
TLSH
T18F828E72AC756C779EA3A954F58B3A03EEB4821BD7C82F94D5DC5B1C01CF2982307A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c62d91498a81132ad24f90610688a8f2cc8247cb1fa5ea60d3c985fe2b0f42d3
MD5 8d31c999173233e4b68558a7d2deefd9
SHA1 5c9759eacf997de767f8e2c0328323933451316d
SHA512 e2e45e959276f2ae703beca809e699f0189b7e4f03451824c99062650aef8e71f19ae11d9af206ac0540fafdeb3f6802b3dccc8c6de38dc007cb9660530bed70
TLSH
T16041FA58A6EA1148B7B37F5A9FF6A8AD487F78332E06949D00110D4F4A62A44CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 e6360e5638df05499bf58da0311283e3126ce2449339285085e8ac299c2ddc0d
MD5 222c730b30c6fa6ce51f5adc324f1636
SHA1 97fbfbb6cebb55869f3efe8325a8f6768b6fa01e
SHA512 c3bd5773069a73b28a5464170b7da9fb79d52079d93006919572f12c97e48e9182f97f2c1a76a837a20d802b060bd97e4e31fbf23a9e8b33e2f3031b7c0d4777
TLSH
T17F5160587AF91118B3B3AF5A9BF679AE447FB8773F07949D00110D4F0A22A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 73B
SHA256 d32318e14ea767959e9687f644672efbb7baaa93b8c21b79e059a389557c47d1
MD5 497611b53385f1be80ab63015e91f625
SHA1 087a76cf1aaa4d8566b3e916eedea47aaff6f71f
SHA512 ca5ed496744d03c63e52594ceb6b8b96a806d65ad128253a07cbdf2aea4858cf9b1eb0cab5905fc49210e624ec30c95c776b872ec8f544f16196965ab8712b52
TLSH
T1C9A0244100440517C1C001C3411C514F0131FC04DC443070F7C15041104CD77D1C5CF0
MD5 SHA1 SHA512 TLSH

Submit Download

60828cee-48f9-45c9-b5e2-f005933cb06f.tmp

Path C:\Users\Admin\Downloads\60828cee-48f9-45c9-b5e2-f005933cb06f.tmp
Size 15KB
SHA256 f3f1789e8d6654edbc30c65f51dfb17cb2043b7c60163f3cf07ac25fb801c9d5
MD5 0d9a4ccf4ecf0aeec62779f4c441a0f6
SHA1 bbff98dec71875c8a7c77cef31bcd0509040d5c1
SHA512 e48907f66ce847c5b9a5dd99e33dfd6ea36d0d13b95c6d77ba3598fb5dbcaa22cbb9ed69f76319bdcadbc99f5b7ca0be38006582ce66fde00d94a12abec4d82f
SSDEEP 384:MNlnddRmnawath9uMfiCGFTtgMlXX6XK6mL5zC:MNltxzcHX6UlO
TLSH
T1BE62850A16A9A0B9E17FF03AC5C7460FE5B2747D6771828F07B6579D1E236A0023E772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Terraria.exe

Path C:\Users\Admin\Downloads\Terraria-SteamRIP.com\Terraria\Terraria.exe
Size 25.4MB
SHA256 960a03bff6050cf7be16dfc1a7b19e10fc2c4f8f835a6a3b135a50dd9e6ba2f3
MD5 890f5654041f09607d74596d46249000
SHA1 3ff75e4f7bed01731643def81147f8dfa90b06dd
SHA512 ac3571cea1310f58ba2f65726834cfa59f99ad79c65d8e62bbb4c5920168edfdcba8209251908196a32ff0b0542e9e03b9de89a4673552f18986bab9e7aade8f
SSDEEP 196608:nVZxA9/aDOdyr0hqCZjwTaVYrd5P3+OXdb:nVZ0dyr0A
TLSH
T120479E3767C40AF3C1DE1BBEA41E2DC2B2680496C355A7DA5DAEB4BD20D8721C40D7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbdb507b-05b3-44f5-9239-c69c386cb51e.tmp

Path C:\Users\Admin\Downloads\bbdb507b-05b3-44f5-9239-c69c386cb51e.tmp
Size 16KB
SHA256 fc5fdc244d302ef427a84611dfa13f23228c078a9bca456f8b98af077597f848
MD5 6c8f4ed7e3c7c4a424f65928754c7992
SHA1 f8ddc82ad09b5d16c8dd013c78b33daa684bcd66
SHA512 ca4cb73c93adee4f7a9876fff7bf04e1ba5af0ee0266a4e0cf727e586d3fd412a7dd5983880ee9202e81b6136161c52d68ab653fa4a5b07087f340daaf66f993
SSDEEP 192:oNo8V57U050tyCyrJe4GSv+Oefst7hP9iIhzjAWWGJS/bYkCxtwcYFM62uFB3RGn:oZG0HGS6c97PDWYS/DUa77RafDDGG
TLSH
T1A572B0BF07CDC09A556D53225C826CCB2CA5828127D9FF3A7F255792218852B237C4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-723.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-723.exe.crdownload
Size 3.6MB
SHA256 8ff0daf3ed564cc743c0e23ff2e253997ffc74460f9673f0b6dd037b2db4ce7b
MD5 8f2f0ea48372956b5e817ff11155bf13
SHA1 3e82a931aba4824e390923369fa300d989f2ebe6
SHA512 edd9d1f3fdba826f87cf2337ad914e8d3c8faddbf91aa1727ae7c2a4c5e1a202d767658df16f25df6826c8b62a28473b10ff8166a5fda0195210d8e31baac423
SSDEEP 49152:oWyy3UuXBPUVABbHUeLc8nzOBj3BE43EhR6PIgg3fXIOJjIPiXUDYufHesv1tM9k:0qBAGnaF3BEwOR6gggvXIOCXe/s8HZ
TLSH
T15E06231AEB9414F5E177E134C9634507D6B23C9987B0978F23D9268A2F333A09E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-696-0x0000018EB45B0000-0x0000018EB5C27000-memory.dmp

Download

memory/2332-714-0x000002043DD20000-0x000002043F397000-memory.dmp

Download

memory/2332-713-0x000002043DD20000-0x000002043F397000-memory.dmp

Download

memory/2464-752-0x00000249BBC60000-0x00000249BD2D7000-memory.dmp

Download

memory/2464-712-0x00000249BBC60000-0x00000249BD2D7000-memory.dmp

Download

memory/4528-711-0x000002045B3C0000-0x000002045CA37000-memory.dmp

Download

memory/4528-753-0x000002045B3C0000-0x000002045CA37000-memory.dmp

Download

memory/4528-755-0x000002045B3C0000-0x000002045CA37000-memory.dmp

Download

memory/5608-32875-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32885-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32882-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32876-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32874-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32884-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32880-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32881-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32883-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5608-32886-0x00000155FEDC0000-0x00000155FEDC1000-memory.dmp

Download

memory/5772-32855-0x00000000006F0000-0x0000000002052000-memory.dmp

Download

memory/5772-32856-0x0000000006A20000-0x0000000006A52000-memory.dmp

Download

memory/6100-29909-0x00007FFB7CF90000-0x00007FFB7D246000-memory.dmp

Download

memory/6100-29906-0x00007FFB8C5D0000-0x00007FFB8C604000-memory.dmp

Download

memory/6100-29897-0x00007FF753090000-0x00007FF753188000-memory.dmp

Download