4dc035f50f92864061dea695a0fd0de4b7b6475f103dbfa90326d2b30dbd1ab5

Analysis

max time kernel
1049s
max time network
971s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sword Battles Beta - Roblox Studio 2024-05-06 16-54-38.mp4
Size 10.1MB
Sample240512-c849esfh48
SHA256 4dc035f50f92864061dea695a0fd0de4b7b6475f103dbfa90326d2b30dbd1ab5
MD5 7e0e8d2f638de9d2d826b216adb6f19f
SHA1 e038edfcec280c571788cd72dea8bccbdd7842bc
SHA512 680232adb8da13fee1d2e9b6f3c084876041d4accd290c2cef1e51a6ff70ec72f0b14912866ea5187fb00a4efd21a3ffb8ffa655f753168c79ec173d2d7e5cbc
SSDEEP 196608:4zCCQOoC3Y1trT0m+y18NISZh69brCwH63xOcop7UyEiOXYI:45CC3Y15TD+y18NISZh693CwH63xOco2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	setup48205721.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Netflix-CE V5.1_48205721.exe

Executes dropped EXE 4 IoCs

pid	Process
3008	Netflix-CE V5.1_48205721.exe
4372	setup48205721.exe
1384	setup48205721.exe
5636	OfferInstaller.exe

Loads dropped DLL 64 IoCs

pid	Process
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe
1384	setup48205721.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	setup48205721.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	setup48205721.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5864	timeout.exe
3104	timeout.exe
5132	timeout.exe
4576	timeout.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
1112	tasklist.exe
6084	tasklist.exe
4432	tasklist.exe
2040	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133599555652379967"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{FF51A9D2-72C5-4745-8411-81DBC9352E56}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Opera GXStable	Netflix-CE V5.1_48205721.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable	Netflix-CE V5.1_48205721.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Netflix-CE V5.1_48205721.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	setup48205721.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup48205721.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup48205721.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5192	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
228	chrome.exe
228	chrome.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
4372	setup48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4520	unregmp2.exe
Token: SeCreatePagefilePrivilege	4520	unregmp2.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: 33	3320	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3320	AUDIODG.EXE
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3008	Netflix-CE V5.1_48205721.exe
3008	Netflix-CE V5.1_48205721.exe
4372	setup48205721.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1756	2044	wmplayer.exe	83
PID 2044 wrote to memory of 1756	2044	wmplayer.exe	83
PID 2044 wrote to memory of 1756	2044	wmplayer.exe	83
PID 2044 wrote to memory of 3192	2044	wmplayer.exe	84
PID 2044 wrote to memory of 3192	2044	wmplayer.exe	84
PID 2044 wrote to memory of 3192	2044	wmplayer.exe	84
PID 3192 wrote to memory of 4520	3192	unregmp2.exe	85
PID 3192 wrote to memory of 4520	3192	unregmp2.exe	85
PID 3260 wrote to memory of 4516	3260	chrome.exe	95
PID 3260 wrote to memory of 4516	3260	chrome.exe	95
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 4728	3260	chrome.exe	96
PID 3260 wrote to memory of 3120	3260	chrome.exe	97
PID 3260 wrote to memory of 3120	3260	chrome.exe	97
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98
PID 3260 wrote to memory of 1120	3260	chrome.exe	98

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Sword Battles Beta - Roblox Studio 2024-05-06 16-54-38.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Sword Battles Beta - Roblox Studio 2024-05-06 16-54-38.mp4"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecbfaab58,0x7ffecbfaab68,0x7ffecbfaab78
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4832 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4452 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5196 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5444 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5636 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5980 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6024 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5628 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5760 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3292 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4488 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4648 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5968 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3360 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3148 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4384 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4528 --field-trial-handle=2032,i,11528259678226940731,11043964082913284910,131072 /prefetch:8
  2⤵
  PID:1912
- C:\Users\Admin\Downloads\Netflix-CE V5.1_48205721.exe
  "C:\Users\Admin\Downloads\Netflix-CE V5.1_48205721.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3008
- - C:\Users\Admin\AppData\Local\setup48205721.exe
    C:\Users\Admin\AppData\Local\setup48205721.exe hhwnd=590304 hreturntoinstaller hextras=id:d8d090d10951db6-AU-PiJMZ
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
      4⤵
      Executes dropped EXE
      PID:5636
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
        5⤵
        
        PID:2636
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5636" /fo csv
        6⤵
        Enumerates processes with tasklist
        
        PID:4432
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5636"
        6⤵
        
        PID:2412
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5864
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5636" /fo csv
        6⤵
        Enumerates processes with tasklist
        
        PID:2040
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5636"
        6⤵
        
        PID:1516
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3104
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5636" /fo csv
        6⤵
        Enumerates processes with tasklist
        
        PID:1112
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5636"
        6⤵
        
        PID:216
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:5132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
      4⤵
      PID:6068
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 4372" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:6084
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "4372"
        5⤵
        
        PID:4624
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:4576
- - C:\Users\Admin\AppData\Local\setup48205721.exe
    C:\Users\Admin\AppData\Local\setup48205721.exe hready
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1384
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5192

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x424
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

157e0c60-3773-4f93-a7b7-dfa6471211cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\157e0c60-3773-4f93-a7b7-dfa6471211cc.tmp
Size 16KB
SHA256 5e2cbd727ca865fca18589dee6e49e06bb24a063d49313ff43bb20b60103b85b
MD5 5fdaadc07ceb43cbe209325501b9a934
SHA1 4e43f3ada142665af9eb50f978eb4a7d1cce5732
SHA512 1b88a17670146fe1460e0e687370de6662a5092c71fd6bb61dd266bbadccd9a225180349a8d9a94e8cebb1960242e52364a30fd04e1a47dd1d3dee056e8634eb
SSDEEP 384:O2T1LPLeR/X9f1kXqKf/pUZNCgVLH2Hf9kFrUiwHGiJL8yS:O01LPLIv9f1kXqKf/pUZNCgVLH2HfqFL
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 9ca42c3e9e79003e9ea32f34e303ece8f0852adbb3c426b8bb8fdf078961f3cc
MD5 18114c323d4ec4bc08c7f44f4d1d4eaa
SHA1 b2ea5055f12299d121554ceaf437e9ed25a2fd91
SHA512 5a0fa7e0d7ae34fa45ec952c61820960ccd693ac5a1cfe81999eac05871f67c9ad4a2ab8af8ff6c03caf17695d58b786e68affc4e62f6756f4c78478b676656e
SSDEEP 48:93lz8zNspgRzudmBIPo54aIc9nBWkzFZzW5f+okmgj2+bX1g41D8:JN8zNsp2udzo5zN730+jmgC+b1B14
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 5371ab615decd335e65e20f03b65382f9d749fbd4da454f85ed02acebc084873
MD5 63fb6048187316b8f50caf89045cdb77
SHA1 f650d00a9db9d49240bdebe86f1ee05e77a453d6
SHA512 8090069690c9264ae274f6dc20e9e98ec450496e5b783f555c2d31811fd8baa234bc59322a9be6e42fe30a7f724cb8eecc2b0ba38847042db70af224b3bfb599
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a2d405d264c60a2bc3b485c793bca4c7a277a307d0e4220417fe938476acb254
MD5 71f1dbbc80defcfea0453286acccf865
SHA1 2b90cf2cf1b3d408231ee6c715484d2d5309a642
SHA512 4cf024b853935299c494a073aae4c56dce322de7b29e40458c19fce6712df2d58b290e285e93eaaeac22b5b298e6c1b2a0865bb36b1463c402ee893e25e8dd3a
SSDEEP 48:Lm3lz8zNspgRzudmtIPo5SaIc9nBWkzFZzW5f+okmgj2+bX1g41DR:LEN8zNsp2ud3o59N730+jmgC+b1B1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 bcfa957bf7d8e903393d4d688da579c30d6ec6825f82a1af5f24574af61c459f
MD5 a87d4154f5b8615f4eedee0d4f068d28
SHA1 ea31c6ff7b39dd6e7bbe0f912fe70fae30a1974e
SHA512 4e00589e2e018dd5329503c44b96e2efd02a4066947ccbcfda5496eefd9a95c4941ff4f02f34b971f6c3c60be6a554038b5bdf573ed9ed65e2873f05828959ec
SSDEEP 96:eH9HeHTHwHJH3MvHGBHGsHGoHAfHGqHG6UHGpOH6bHG6HgHSH9H3HDHwHmHVMHXw:eH9HeHTHwHJH8vHQHBH7HiHTHtUHIOHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ed0aa0f7372a58adccdd83d755f4815eb41379232be195684195e9b39402977c
MD5 14472ef4b0fa35eb60fa2efc3d4608bd
SHA1 c10394978d23bd89e4ab7709c7148b996900169f
SHA512 a05e894b37f227cf9ae42859929ce5ef1d67b7250f2d7ecfd55808b5d5434bea0cc88e32c6ddc6f0cfa9e276b20acbccb14bd8badd026e6e4613f0ad601b72fb
SSDEEP 192:DHeH9HeHTHYvHyH0HI2HKHeHjH6aHBHdHDH/HoHIjHIfH3HeHHHgHpH9HWHIFHb2:DHeH9HeHTHYvHyH0HI2HKHeHjH6aHBH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 f37e9beefbfa6a4b910c2f6ae0b0f813fa296ff454ed4cf4b4f15f0c050b667c
MD5 980b49e4cba28f959ffe7ee6fc06cbac
SHA1 71df8ddbe17c31ef020df2b6cf1092255fd7efcf
SHA512 07bdf3cd9a271fa1d4f370bd8694788cb14cb8ccc8b63b636fbdcaa3dafb562c2559b1f386086e0fb82cfd35f73e5335cc3d8c13c75b3457e9f5e87bb6c4776e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 3d0acdb36b32afe9fcb47934e0f20542c27d572356c3193dd12420889e7c7766
MD5 5e8db4d84368483b9805aa88d3483573
SHA1 f1b6213b63efd90dd56df1b125e48b445bb24e29
SHA512 ec65ce0a91413c9cd3de269ac5d56a2ecd03964169375820b57f0f39344c41c43dc6dc338cefa8802655a40ab4b6b015804b12b076d22558c052660d1c33e11d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 de84174028b8c1242dc1997fa7556c258dd2b913252b808156205acfc4e34390
MD5 72c83deba995f3046e17a5aa43c9022b
SHA1 e63f515fda4496d4db7e323a3439b02c43b3f815
SHA512 07fe402dd7d00b72162a83382b7c07d61bd967d4cc19d58d52585ca7c2acda69e6f674d5c05c4fcd84acf0cbf9e4bfb2a4b8b59e29fbe81738339bff887b9cbc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 29555984c3553d5694bcadc8c0ed5806e26729596930ac6cce0615a15c21bba5
MD5 e2e69520b16a4137df1b2ce675f1f893
SHA1 8fc928c8cd042d53ec1229b326ffa3b128d13b4d
SHA512 53964f7c1fe17b8a17f37c6786818ac5d4b1526c97b042eb7e2606486fb7050dec7c84a9bfb553f585369e4d9d1da64f4229d72fbfbf4476e5541711494d387c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 ff55a3cfd3111372546516721cbc621018624f0241a2ddb41943f41e26b96792
MD5 7b1b9590872fde83931c4f91e9bd8f50
SHA1 7d8d32565be0ac67eac12a539a02e022bde5286f
SHA512 17b6c58866f52fc7a7770d48ba80e0a3fb7d2c34992a8ab50bf23aa4a39eddf503eaa6b9d1576f309d62404854bd08b8429d3680abee1cab09c3fdda53fadcd2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 d3aebdac4e10084f8c38c21181e007f671831514558630bc444785618614ce43
MD5 100011f5a1126ebd8a6189734b1aafc2
SHA1 153936392ba6765ae52ce457c9e24320b4128bb8
SHA512 d1b4961be7b00c14c9863202279728787dec05bd63ac09bc5f299d992aa58c96e04a9dfa736fc158799345d13b320355014c22e62b993456c82830f2ebded201
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 c8f6ae19c48c9496eef0be1133faf5f43081c96ef15e05e51a0e55680112d419
MD5 123df06c2830c27b0c9af9ea95294e8d
SHA1 29865d6542db30caba9c3690b2a0623f8af98755
SHA512 db5afe35d432f44daf8126aae3edd8b900fdb4d9ea06dc75d29f4036aa94c823ab1de43487d51356f4660503afa1a9933613a87b1afa34f599beac1dda999183
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 7568263282cd7ba0722545f1784fe22208cca20e1eb8d8a69ea9418eed4745ae
MD5 fd66c3588e178dd7843b9a37a481cc97
SHA1 dcab0234eac12c48e5fc2cd0af64ceae736b244d
SHA512 a2ffc19ac7240926df479fb09120ff2a217f5e37e7dcb89f0f967a4ab8f1fc89baf24a21e07f0ed69f906f069ebd3df173b3f9b164eabaaa47b3f20a0627a17e
SSDEEP 192:ya/TXrh4aJRo8+6yh+Fqoj4JnP5tjEsXtScR:ya/T7DRA6yqqU4JxtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 5b905e5d907ac929df7f39082d20283828f542ffbe209991780e6d6003fd7fc7
MD5 0af952a502c4ab5cacbd53c4ffae0d6e
SHA1 d811e1cbe7dde2ada01336461dc382c2a3d8734a
SHA512 f1fb1595357c07c85f0f3dc8e8b21784ea68f915ed04d58d2a06229b54941823f13f2cf50a9b985b9349f3cdff82fffa70259ec5f8580ad8497c6e35ae08cb29
SSDEEP 192:ya/MXrh4aJRo8+6yh+Ff5Qr0IDeojcnP5tjEsXtScR:ya/M7DRA6yqeAYeUcxtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 0eb4f514828f3cee58af130f002af28340688e29256387ee689cf93f47924d32
MD5 cbdf91c7ec5aee49fe1ad2777d6331a7
SHA1 f7d5774b09c17db02946f696b78f64d3a6f2cf75
SHA512 71677e54f29c3778c1f5d8286ef20e81635f7e5922f21b45dcb49bcae594a8d975748b1e7136d83b457cef6f3cf18be346315929c58f85d516a458abef123a1c
SSDEEP 96:4yV/DHXXbEyZ4KIkJOOo8iZRy7Dx+6MSmueqIO3ZkJ+d2MEVhYtjEsXt0/cgVup:4a/TXrh4aJRo8syh+F6XnP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 ec5f282a3dea154b0a9a41fdeaf7b2fa752d0bf4ee756baab3d0348c661d826c
MD5 c5aca80ac9952d0c6a2def5458460d86
SHA1 a02a71360eec02b60f79a30e4389597257eef9d7
SHA512 93cb4bc9db196dfd22558e050ae75a7cdf9d6335bc0df0070c76014257fcc1a238707c49d174da2d0034d365a19b153fd2a2c93d7fa481d4e6bf4979920097b8
SSDEEP 192:ya/TXrh4aJRo8+6yh+F7DeojVnP5tjEsXtScR:ya/T7DRA6yqveUVxtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ff212cb6-0b82-4577-9529-36ab420c2cad\index-dir\the-real-index
Size 2KB
SHA256 2fd69f618c37edada829c7ac57491c7dde00278a3d0d9b5886f23760b9272f68
MD5 d64ed3328b2b1915232fc62c1f4be64f
SHA1 ba462e4a68cdc30a454be69d74269f9fa63e96c8
SHA512 8520fb27cdc872c85fe9cde0459ceed9e20376ca6f4ffbb35b5afe096b5306f5b5a2144277f98253fc3cbb6efb5942f2b3b9569267ab3e14861adcf8b8ccf46c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe581e8f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ff212cb6-0b82-4577-9529-36ab420c2cad\index-dir\the-real-index~RFe581e8f.TMP
Size 48B
SHA256 79db73eb99f21b7a637467dae6e9cfb4858e9ee0e60dee0b6d3cbf16ce0ff1ae
MD5 4ed7836d5fe7741f399f9c45f7181faf
SHA1 b611777c06a2fb407ff03004a0998e1fc1f38546
SHA512 cacac2e8d5437c66071cc79ada0bd1f7055df44be8cf916fa4851d02c26bd7f68fe84a1fabe97188ecdcb313ed99e05874643f5cc592a0a88966502a5b2fbed8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 176B
SHA256 84a871a1ad8c81404d3b49205aaea6439b24b7c81e93024cac09b3c12078e457
MD5 89536fe0bf7752823956c4aa10293a30
SHA1 f85507ec1832817e956e5602959a2ee0dbf969ef
SHA512 a8361e9da57da17ff0291313747bc602cc0d01cd1e0a5bb3c46ce0baf305a4683da06095b767b44b1849cebed407131b13ac166d4f52491630655f18d6b40148
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 114B
SHA256 5a6820e3e6431e15707a4cb09b05329e05de134c81a0121d2b0c0668e095081d
MD5 0d0683578ee9b8fe9e3d2beb9e2eb783
SHA1 cd71a6b413b3018d5fb7e5e6a39e4b6148db5825
SHA512 148a008ae5f01ba9372efe08060af29270bc01c9832562fc7eb940960e984f4520fd4e6a55b0c398e2853c6d1745d4d9dbab87b4d5cbea52e47e70bf4d74f107
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 112B
SHA256 e861c0bcaad51557b0897d36aeb4bf5ed8b42d0eb69f42a2309ae780e7744b9d
MD5 e33f6ed6cdc1f12c8090c2a684634f7b
SHA1 970cabb772abf943b6d83b93d11113ba00943772
SHA512 011f1021ee92d288751363d07c8e9de7d42083fb60c0fc4000e9a38a01b9160c19e642a60149e3b7d1c693525f4a072a7f3faafe35f1d5acd37cff53eb9c4a7f
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57c8de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57c8de.TMP
Size 119B
SHA256 83fff04a9b2c17b55101de77c28a01d7578d572d8bb1184c007a8e561d853641
MD5 bf21bf147cdaee96111ecfc26a2ec87b
SHA1 c0c07aee9373a8869672ab48c93fda2feceaad5a
SHA512 cd86f94b95f7d84b9bb6f50c0ac103edab17c10620e9ce288a497383a6be7e121667e2ee2ed20165b6abc7c46f793ff1e2ccf6acd8882b37b73389d86f12f92e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 c41e03e9f9563da69c0b72062e69158100a66b0cab9b72d3681781808c0bc585
MD5 3a05a857f039f3c181761f4a73c04023
SHA1 93da62787b7c43ffdd5a5c8f43ef4b714da5b0b3
SHA512 ed44cfce210642ab77f8f9d285feba431aab6f4c82957d003c5f73195aedbf33842089a858165bef34f99c58ed93157f829c85b2f323632e601d76c9d3c09fa5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0bc0ba3603dc67915800bad7b358522325a4357bbb25c7026cf5f218dedc3d41
MD5 eb1e118cdb70cf21f44e42d24677555b
SHA1 b17f54f51e0a1ff8920c073bd0186088929bdc80
SHA512 70f8603aa2ec0f94fe833df7bb26f11c040801dca9aa92a0d86dd25253971723ec149a954209d4b1171fa4a9b612373c92e1e3dd1ceb27bbc268f378b3481225
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58176b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58176b.TMP
Size 48B
SHA256 b2fda4fe2d7a556643446061ddcda4952b07c8390798feec2d697507993d7423
MD5 b4e0f1526f69dd85c243d9f395823dbc
SHA1 3433e2243bd6341aa2a9f21212ce1925b8c1dcc4
SHA512 1d3446697dc9462c74176c74bb65f9c9cc38cffbc1e3daa073e8b2dcb8ca48bbd13b04aefab395008eff27ce0373e212dffbe69efa51801d4f6d14dec63833db
MD5 SHA1 SHA512

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3260_159891391\Icons Monochrome\16.png
Size 216B
SHA256 c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3
MD5 a4fd4f5953721f7f3a5b4bfd58922efe
SHA1 f3abed41d764efbd26bacf84c42bd8098a14c5cb
SHA512 7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3260_429741134\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37
MD5 12a429f9782bcff446dc1089b68d44ee
SHA1 e41e5a1a4f2950a7f2da8be77ca26a66da7093b9
SHA512 1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3260_429741134\Shortcuts Menu Icons\Monochrome\1\512.png
Size 10KB
SHA256 1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f
MD5 7f57c509f12aaae2c269646db7fde6e8
SHA1 969d8c0e3d9140f843f36ccf2974b112ad7afc07
SHA512 3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18
SSDEEP 192:CLLLRuqiztNFVh7D6ov5Zos7amFoMkFVwJOYSAxxqm3wk6E:CvLcbBNFvRh17amFvSwJCAxQmAkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 278KB
SHA256 9d6793b32980f38adfbf4542b2d9cf7c4eb3ab701bbffcaeb97ab5765bab27f2
MD5 9a983b52ec561998da9abc98e3e4f04e
SHA1 662073da335d6fff130b483d77def2ca866554a1
SHA512 e1beee66318444b384ee38bba17bc7d2d081acc7fe1d9b57b6cdabc5844333fb1991514ff43aa1e4b41692d07f3b29ee1019bc5e2281fd7f93e9363fce9da116
SSDEEP 6144:M8Sds5T3OsewH7NwbuwW72t3aSQrI1Qo5yzkpeXjnJFzXsWk:MaB3OmbNMm72tNQEjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 b59ef1d04e18bbd4796664d3c940515d8c4bc3221719bcc67f37c06512ce45af
MD5 1ced5096068599a57ad9975d43269402
SHA1 ce300287544b1d42559c9bfe0bc7169076809049
SHA512 ae7fe5450a138ee30da74e6a4939091128560ee0bad69a4a90cae0320a101de051e1b939ae9f8a5799f541a49b20c1c47fee96e5ae4fc6f3a89e36728e6d4025
SSDEEP 6144:25T3OsewH7NwbuwW72t3aSQrI1Qo5yzkpeXjnJFzXsWk:2B3OmbNMm72tNQEjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 9734032951f0a14259fe2573ff200b350e4ca1aed2849a5af2e3037892263bd7
MD5 34478f4f1e2c5d3c616e94d591093e0a
SHA1 e1712e92e1c558146902b4f3ebdcf4cd335b2c09
SHA512 ee07e1efb37efe2a6500c21b68da785134a3c689025edaf504c4a84c6a32cd08134536bca4b44fa4220347ae0418756a351e6fbe45afa81a179449233f9e5605
SSDEEP 6144:srI1Qo5yzkpeXjnJFzXsWHQYRPILxZnhLMJjX0EeGzY2rL7:sEjCkpeXtFbDQ5fnReEFsLL7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 4fbc86e461e958d2186871326efae2a7a226ee863ecbab8ce008ca45582392a9
MD5 bd7598b234c27695a2d96cf5ffe9ad44
SHA1 7927a307f79fa3508c682566ac16e2805e91eed0
SHA512 f8a9c0b7da804ccfdcad63cb0f83aa22a489142d6aec1f3dcfe24cb8579be2d824b9a7341394f0ba0b1407776d9afb75e998f8f3ab59150b749a3aab246f4959
SSDEEP 6144:F5T3OsewH7NwbuwW72t3aSQrI1Qo5yzkpeXjnJFzXsWk:FB3OmbNMm72tNQEjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 0fba3869cb31503b4b778fefd491e5636c3ee93a09f48c610b32f968c3233910
MD5 d5af9cf615f7f7349dc4c17e4ccce471
SHA1 62e09e41131c029a8ab4a4a94809d2360ad33365
SHA512 0014fc0db65483fa50511bbc1f96ce8a123cad6048c0601f54fba079b5cd861166c3ebd66837144786c7ad6f8855c44fb3b61392deb89171d6e8c0c083d1c264
SSDEEP 6144:ydO5T3OsewH7NwbuwW72t3aSQrI1Qo5yzkpeXjnJFzXsWk:5B3OmbNMm72tNQEjCkpeXtFbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 105KB
SHA256 c6fb23f9e33b11465092eb953d90ad37a1d6e75d15b5ac4e96d391397e1c717d
MD5 fd06ea76aef80aa75b8d431f4f416e39
SHA1 565e8dba0111efe689d09cd54c3babd959ce3350
SHA512 0264515593ebf306875246ce6962420357406a0fa16e8292400046794c42683d63fec1b8a44eb16b8c6a5b107dffee134496f22c2d9a0a2c9c15ff7085535794
SSDEEP 384:9mdaxEQv+ouIOGghrLxzcHwyVpmuPxGEz1cAVwPQp66YgvTXbChIOruj4MC3+5sI:NiQ1lXeoSf7f8ceJ6BqKDOJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 173d49f61fc3bf7525d0976c2e1ef6fbfd6bf30096f3cf343f8150d7ec899d82
MD5 af475e8e7a703ddfd8f788f60aa30a09
SHA1 9b62599b037a2788db2b7dd535ac46aba92ca89f
SHA512 ac15bc1e34675031b12d4324bd748b714fb57aa7f3b902825ff05046fec6d2f0503158bb16b35ba75158aa805ebaee7024c9869028edaa4fb013283cef6a0d54
SSDEEP 384:+mdaxEQv+ouIOBrLxzcHwyVpmuPxGEEcAVwPQg6YZTXbfOru4MCx5smuswGzLLXP:WiQfXejfWIcX06BqKZOJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 c3b74ccac56b9855f152f2a0bfb98720832d02aafbf19a679221af0f1a4ba8c4
MD5 3046e62b9e56c3798fa45b505637ee31
SHA1 ab49899d5f9253299b1c8df5f10db5574edabadc
SHA512 20704466c8faafd78e91926054a2d32d8f462fe7189119a046340a4c46dea3ec237b34a6e8e640e50af6de97c058384a7241ae7cb9f8e42573bdeea5b598ee10
SSDEEP 384:2mdaxEQv+ouIOBrLxzcHwyVpmuPxGEEcAVwPQg6YZTXbfOru4MCx5/uswGzLLXcD:OiQfXe1fWIcX06BqKZOJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe58001a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58001a.TMP
Size 88KB
SHA256 d86373859e43715859b7dfe2cfb90f12572bd1e74173b2471501c75c915756f5
MD5 4bd8cbf57dab3666f51488d72e705247
SHA1 a99354642613bcc6d2474935341e9b0b99ffe726
SHA512 6518f229d952b2360dd5440477d82d3693637085b6d052c080039799a662110cf02fb9a6b54d6e7287e370b80c6eaf9b478fbe5c5d10a0f494318fde4eeb5d66
SSDEEP 384:YmdaxEQv+ouIOBrLxzcHwyVpmuPxGEE9VwPQg6YZTXbfOru4MCxFuswGzLLXc2+2:oiQfXeffWIcX06BqKZOJj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 256KB
SHA256 96e4988e130af6bc90ff8ee44ac63fb5bc3b3626c286178349f2092295918d66
MD5 2e21e9e2bcb0dcd6f5ea1c5a9e47e8e1
SHA1 c2721e0be249f86e0ded8981781cd79c6436f4d5
SHA512 9b3d212af7e522e17384c86d4c72728439be9e1879e9ba8caa0d9e5e7c941eac05b641525781157308c0aa4600eae2be36d74f0587ea14e6dbfa1be94081aabf
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdb:569t
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.LastScreen.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll
Size 57KB
SHA256 6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859
MD5 6e001f8d0ee4f09a6673a9e8168836b6
SHA1 334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38
SHA512 0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6
SSDEEP 768:k8t5gUVtf7/T5dMexK2fWpFFhjtUPF01VDT8o1mL+BgXOll4Lckw:kZMtfT6VPFpti6N65+luLckw
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll
Size 117KB
SHA256 11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa
MD5 08112f27dcd8f1d779231a7a3e944cb1
SHA1 39a98a95feb1b6295ad762e22aa47854f57c226f
SHA512 afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb
SSDEEP 3072:bBr1fWCKRGKbV9EWmZJj+5T+o98VjrIe:FsZGKbTEWSji4V3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OCommonResources.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll
Size 5.7MB
SHA256 c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2
MD5 38cc1b5c2a4c510b8d4930a3821d7e0b
SHA1 f06d1d695012ace0aef7a45e340b70981ca023ba
SHA512 99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298
SSDEEP 98304:+0lVqJZXNOujZWBh1jwJb9QpFiCjzMIPYxY9HjmgMDZZbyHwazLDrqNPVIG:LzqJnZE1j3pFiCp0Y9yZOvrqNPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2ODAL.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll
Size 15KB
SHA256 723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528
MD5 422be1a0c08185b107050fcf32f8fa40
SHA1 c8746a8dad7b4bf18380207b0c7c848362567a92
SHA512 dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599
SSDEEP 192:hxEWqWuIWL9WYLtsWHSH/DC0xGQlFEC7dePuUi64TehnoLu9wrmx983RucgvPSYW:zN85PuZ64TeloLV3gcYB6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OModels.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll
Size 75KB
SHA256 b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d
MD5 c06ac6dcfa7780cd781fc9af269e33c0
SHA1 f6b69337b369df50427f6d5968eb75b6283c199d
SHA512 ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3
SSDEEP 1536:LurrKmsdGw8grHnm9pBWiV2FzLhqDuA89vNV+c1eiC:ArKmcnbHnm6L689vNV+c1a
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OResources.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll
Size 19KB
SHA256 1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e
MD5 554c3e1d68c8b5d04ca7a2264ca44e71
SHA1 ef749e325f52179e6875e9b2dd397bee2ca41bb4
SHA512 58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6
SSDEEP 384:+iAlp0fEyEyKkb95kXl0gCHlIp52zwYHIvhp5uwbjF:r5EuLkXl0ZFIp5pY0GcF
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OServices.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll
Size 160KB
SHA256 17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc
MD5 6df226bda27d26ce4523b80dbf57a9ea
SHA1 615f9aba84856026460dc54b581711dad63da469
SHA512 988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5
SSDEEP 3072:2UwQywSSWVdEewN5AzfVZyTb4lxdfyaRZ4wXBSotB11U:2hQywSJEeubU5WwLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OUtilities.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll
Size 119KB
SHA256 669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89
MD5 9d2c520bfa294a6aa0c5cbc6d87caeec
SHA1 20b390db533153e4bf84f3d17225384b924b391f
SHA512 7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15
SSDEEP 3072:SBDoDKD1FvykNUEhRCFioK0ED7bsvcvNq1vR:sNykFhNH0kb
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OViewModels.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll
Size 8KB
SHA256 c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a
MD5 be4c2b0862d2fc399c393fca163094df
SHA1 7c03c84b2871c27fa0f1914825e504a090c2a550
SHA512 d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799
SSDEEP 192:q/01Uf9NxodqfZP2yuF2InQGWEOSZlrvuWWEmMF4T3k8VQWA:yqY9KqfZP2zQInQGWEOSZlrvfnXeT3z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

HtmlAgilityPack.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll
Size 154KB
SHA256 23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
MD5 17220f65bd242b6a491423d5bb7940c1
SHA1 a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA512 bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
SSDEEP 1536:Iuvsy1RTMOgbULSmwAh+NwPyT71hjo6/bKYKeHDYwlELbUGjUin7K5YOEZJ5u6Dw:VvsmRYOgbUvUlr/njY0FEZeE0BL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyDownloader.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll
Size 56KB
SHA256 1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
MD5 f931e960cc4ed0d2f392376525ff44db
SHA1 1895aaa8f5b8314d8a4c5938d1405775d3837109
SHA512 7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
SSDEEP 768:a/nineequbTcsaB8+bfAvCIlATfL99Vi2oc4w:yineezcsaBbfCCRTfL/V5Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyDownloader.Extension.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll
Size 168KB
SHA256 c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
MD5 28f1996059e79df241388bd9f89cf0b1
SHA1 6ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA512 9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
SSDEEP 3072:uuAjNMSC7Mdlszb/0DfV9H8I++Wy/6EAwZZIm11ufs48TVB2:b7rzb/0DfDH8I++Wy/6EAwTIm1gfa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll
Size 541KB
SHA256 56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
MD5 9de86cdf74a30602d6baa7affc8c4a0f
SHA1 9c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA512 dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
SSDEEP 6144:+lLkxTZNddfQr7w9Tckw+CQuahz0PQ78X/Wva/KFWi9Mb5hijnFrBV9r3iCGH5jY:+ybNxFxhPRGeLByjfjuGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ninject.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll
Size 133KB
SHA256 3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
MD5 8db691813a26e7d0f1db5e2f4d0d05e3
SHA1 7c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA512 d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
SSDEEP 3072:4n+0ukQ9BqyPqwtE6qqfupoLUq7SK+giWqRHqoq7fUgWjwwJkvX5r+5MfkHaO1/X:s+0ukQ9BqyPqwtE6qqfupoLUq7SK+gig
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
Size 26KB
SHA256 e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7
MD5 cef027c3341afbcdb83c72080df7f002
SHA1 e538f1dd4aee8544d888a616a6ebe4aeecaf1661
SHA512 71ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf
SSDEEP 384:uhdv/Tmq72sMexepvr9p32fW/5bFGm62lrx2ZcPas70w0vWkwyyBmwj+MrJy+u4U:u7/T5dMexK2fWpFFhjtUPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferSDK.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll
Size 172KB
SHA256 9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4
MD5 b199dcd6824a02522a4d29a69ab65058
SHA1 f9c7f8c5c6543b80fa6f1940402430b37fa8dce4
SHA512 1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1
SSDEEP 3072:JUPwHSHREG35tieWYoxp9SrWK9tN2f7fRG5Ts4BKZePfOy:JUPwHSxEG4IN/NwfRG5TzBRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferPage.html

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html
Size 1KB
SHA256 2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941
MD5 9ba0a91b564e22c876e58a8a5921b528
SHA1 8eb23cab5effc0d0df63120a4dbad3cffcac6f1e
SHA512 38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9
MD5 SHA1 SHA512

Submit Download

Config.tis

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis
Size 291B
SHA256 98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
MD5 bf5328e51e8ab1211c509b5a65ab9972
SHA1 480dfb920e926d81bce67113576781815fbd1ea4
SHA512 92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
MD5 SHA1 SHA512

Submit Download

SciterWrapper.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll
Size 134KB
SHA256 69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b
MD5 105a9e404f7ac841c46380063cc27f50
SHA1 ec27d9e1c3b546848324096283797a8644516ee3
SHA512 6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940
SSDEEP 1536:BDJBzf3eLqghm5g9B8Iz+PIeW5xAaIWjOLBJZR9WRGkdS1vuhperfKj+Igvz:hG+PcOgOL9RkML1vw9Lgvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServiceHide.Net.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll
Size 101KB
SHA256 56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020
MD5 83d37fb4f754c7f4e41605ec3c8608ea
SHA1 70401de8ce89f809c6e601834d48768c0d65159f
SHA512 f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f
SSDEEP 3072:SdJa6NzjjRkH7JoqI36Ow6l7BZNQxyey:SdvNzj1kH7Ja36OwO7Bzff
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServiceHide.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll
Size 151KB
SHA256 e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3
MD5 72990c7e32ee6c811ea3d2ea64523234
SHA1 a7fcbf83ec6eefb2235d40f51d0d6172d364b822
SHA512 2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682
SSDEEP 3072:RzKO9JfnxZiVutA6dQHpLXNBDP6U2Q8sqNFNCFQ:hKO9xnymdQHdsNCFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\app.ico
Size 766B
SHA256 effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
MD5 4003efa6e7d44e2cbd3d7486e2e0451a
SHA1 a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA512 86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
MD5 SHA1 SHA512

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll
Size 426KB
SHA256 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
MD5 8ff1898897f3f4391803c7253366a87b
SHA1 9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA512 cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
SSDEEP 12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll
Size 74KB
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 050f35811f7749cb00f3f4c09f7af3cd7156364e09e9e25040e726c60a0ab133
MD5 70842d1e2fdb0a1b4233ffe941a596d0
SHA1 31aa7d21bc774a10535866429db6fa82ea22e365
SHA512 7b7917bade9bfa3de9b014afe364a5686cf74cc43b0bd742d4d87de8f18a00afd31071b6739bf7a67d75dc0cf421850728714b692d0adec20cb91b1c4e6386df
MD5 SHA1 SHA512

Submit Download

setup48205721.exe

Path C:\Users\Admin\AppData\Local\setup48205721.exe
Size 3.8MB
SHA256 cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72
MD5 29d3a70cec060614e1691e64162a6c1e
SHA1 ce4daf2b1d39a1a881635b393450e435bfb7f7d1
SHA512 69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b
SSDEEP 98304:AmnQ3MQK3vIiCOEHxPPP6k9QiNmNR5gsiK9nOG:AmQ3bKfIiaNPFHNRsiK/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Netflix-CE V5.1_48205721.exe

Path C:\Users\Admin\Downloads\Netflix-CE V5.1_48205721.exe
Size 9.5MB
SHA256 25c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600
MD5 1198daaa23f0af650c7cd4555fbef9e8
SHA1 783f86460785027a41a84e41b42a05b4d4a1a462
SHA512 1a67d52794c2047936fc4814b70dd6474837b90df7a8b5653eb8a09cf98d4df2c93fb07451a29254e2e161e9e3f0c3f87e9f5e1252a2c89f2b7f95537e80227d
SSDEEP 196608:+5DcteeKaKIZJjwrqN/RFmQ3bKfIiaNPFHNRsiK1:8ctVtKckrqNnL3bIIiEHMn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4372-1085-0x0000000005460000-0x000000000548E000-memory.dmp

Download

memory/4372-1203-0x0000000007DA0000-0x0000000008354000-memory.dmp

Download

memory/4372-1176-0x0000000006370000-0x00000000063FC000-memory.dmp

Download

memory/4372-1093-0x0000000005490000-0x00000000054B8000-memory.dmp

Download

memory/4372-1181-0x00000000062F0000-0x00000000062FA000-memory.dmp

Download

memory/4372-1182-0x0000000006560000-0x0000000006582000-memory.dmp

Download

memory/4372-1183-0x0000000006590000-0x00000000068E4000-memory.dmp

Download

memory/4372-1077-0x0000000005430000-0x0000000005458000-memory.dmp

Download

memory/4372-1196-0x0000000006C50000-0x0000000006C5C000-memory.dmp

Download

memory/4372-1069-0x00000000053D0000-0x00000000053F4000-memory.dmp

Download

memory/4372-1199-0x0000000007230000-0x00000000077D4000-memory.dmp

Download

memory/4372-1159-0x0000000005C80000-0x0000000005C92000-memory.dmp

Download

memory/4372-1061-0x0000000002D00000-0x0000000002D14000-memory.dmp

Download

memory/4372-1214-0x0000000006EA0000-0x0000000006F32000-memory.dmp

Download

memory/4372-1231-0x0000000005980000-0x00000000059AE000-memory.dmp

Download

memory/4372-1117-0x0000000005570000-0x0000000005594000-memory.dmp

Download

memory/4372-1146-0x00000000055A0000-0x00000000055BD000-memory.dmp

Download

memory/4372-1109-0x00000000054C0000-0x00000000054DA000-memory.dmp

Download

memory/4372-1042-0x0000000000630000-0x0000000000A08000-memory.dmp

Download

memory/4372-1138-0x0000000005610000-0x000000000563C000-memory.dmp

Download

memory/4372-1132-0x00000000055C0000-0x00000000055C8000-memory.dmp

Download

memory/4372-1101-0x0000000005500000-0x0000000005532000-memory.dmp

Download

memory/4372-1125-0x00000000054F0000-0x00000000054FA000-memory.dmp

Download

memory/5636-1302-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Download