7fcf2d908d3b168bdaf27ac21c66a1979289ee8cab076fd7e2c64a283f7217e5

Analysis

max time kernel
197s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aha! You idiot! You- You really thought that you could actually beat this_... (Null Voice Lines).mp3
Size

2.0MB
MD5

2c3d17b19373049b7a5d2c9989d87a9f
SHA1

35c5f9be255eca27556f33ff73844abb437fc153
SHA256

7fcf2d908d3b168bdaf27ac21c66a1979289ee8cab076fd7e2c64a283f7217e5
SHA512

7aae9d4632fe55c3111fb2c9536618134d96a0fa7f97ababc823d50ddd71942d8cdeb0736e2a0245086974140a96a64aace8a3ddba67d68bea6762705df10138
SSDEEP

24576:emWqZEFju9EnzY8wEwbmrhgFoDo3qcRP32lN8D+3cHw2kUii8h6aCJQUXUdsYAEN:LEF8G5jamr9+q4Uuw2R+dd7A0

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641274974209691"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{FDD72E5F-AD9F-4F77-A46B-F803E0694B26}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	452	unregmp2.exe
Token: SeCreatePagefilePrivilege	452	unregmp2.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	4376	wmplayer.exe
Token: SeCreatePagefilePrivilege	4376	wmplayer.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: 33	5092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5092	AUDIODG.EXE
Token: SeShutdownPrivilege	4376	wmplayer.exe
Token: SeCreatePagefilePrivilege	4376	wmplayer.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
4376	wmplayer.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 348	2952	wmplayer.exe	82
PID 2952 wrote to memory of 348	2952	wmplayer.exe	82
PID 2952 wrote to memory of 348	2952	wmplayer.exe	82
PID 2952 wrote to memory of 2808	2952	wmplayer.exe	83
PID 2952 wrote to memory of 2808	2952	wmplayer.exe	83
PID 2952 wrote to memory of 2808	2952	wmplayer.exe	83
PID 2808 wrote to memory of 452	2808	unregmp2.exe	84
PID 2808 wrote to memory of 452	2808	unregmp2.exe	84
PID 2100 wrote to memory of 1184	2100	chrome.exe	87
PID 2100 wrote to memory of 1184	2100	chrome.exe	87
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1468	2100	chrome.exe	88
PID 2100 wrote to memory of 1620	2100	chrome.exe	89
PID 2100 wrote to memory of 1620	2100	chrome.exe	89
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90
PID 2100 wrote to memory of 4872	2100	chrome.exe	90

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Aha! You idiot! You- You really thought that you could actually beat this_... (Null Voice Lines).mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Aha! You idiot! You- You really thought that you could actually beat this_... (Null Voice Lines).mp3"
  2⤵
  PID:348
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:2172
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:368
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Aha! You idiot! You- You really thought that you could actually beat this_... (Null Voice Lines).mp3"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4376
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb67f0ab58,0x7ffb67f0ab68,0x7ffb67f0ab78
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2044 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3524 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4364 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4436 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4748 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=2024,i,3671501106318321644,13920694027102884614,131072 /prefetch:8
  2⤵
  PID:2796

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
fbd20a6ca2308f8fed5875f7b37eae19

SHA1
1dea6266d28f22a2d080abd038abcc954fb6b893

SHA256
3556e3ef21ebc4a16599c39b49c5e9edf4ca66d30dff5458da892401bc83dfbb

SHA512
04e2393870baff26069fabdea27bd5e5a7818923ec544a9c294367835d04a9e406150bf33220488096f5412d69541b824abcfb9790fd3e8985625cca44ab2b4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
2580fa81f72fbb73dd267cceeda33427

SHA1
edce41d210d875826221f482b711533e3779d66f

SHA256
4e86eb3e1365432448710d664cece03c058bb48b1a0bb50a5fa2ab74ba12d98d

SHA512
f73505d60a0620f28f5ed86ab6ca6ad75612abe7241a3727e9b8be17a0d7c0d7a919e40dfd646ffdcbf1111e5095c4f60b7d5f9990d724e7a7fca78b086f1d88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_t-me-verifigirl.ru_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
687f8855fc3390a325af39734d0c6859

SHA1
911b3898aaa8e701f52b9f82e63cd4a9a879cc80

SHA256
6a619133f55681879288d5fbe5747535c41c76b84e81f2d59890cf3d3b52705e

SHA512
a46df537347bebcd114671d8696111b85c8d77fde228add6c1959c0877fcc3c4ca70a74e20910fab2bb126d5f04966c2257a94a39cf8731b05297e7e96c12a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2c785e3773e0f5f620b35506d37662fe

SHA1
837fddd67282a972d019f923e01387cba0d38312

SHA256
acb1ff90754bf2fc4f495abb8fa4c8aa0946a7119f9f705aa2184656f97602e7

SHA512
a9dc1a44b65349c9cc9b181b4108775b212a945c427f628824da169bcb6b7af91f3a39a90f97b510d63e1f63673669b8d45200834b56ad29e5d0736ba164dc44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
845341df4578d5d505f72da75a424462

SHA1
fd9c12a867224677fc674be79d719ceb25253704

SHA256
43f32c2cb53df95e6405b553451dd5ab893d9387c0b19ea8a1354d72d913616e

SHA512
a6956174d06db78f3864bfb3389df467fe52f3d84207640343316456cc08f26526983c20683fea471472013ba4b2e64964e9d68acca5e0fcd0eae0f0456694c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
8d30b139d158d3b4f67ef5268d8a409a

SHA1
5089d016cad77401935a98cc18e9c695bf8db0b0

SHA256
2777350273ec2eeb26c97bc90560574a3eddea9fe6a796d3b18bb05eb7a3dff2

SHA512
f8afb1c0c90061091e4a083afca0230f139280b3a20ace3457ec8883b2d0862601334056a58bbb78a34dc1d7a64ea7ac649311bbd42bafed073dbaca3fed29c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
a81281a65de430fe3a0337281c32e796

SHA1
7049344663957b1d08e15a86091ef7168b775b7b

SHA256
4eefd674ee8ee12fab7c9b06c5ea2e70c7e3f586a2c407dc6a411d8eeb462d9a

SHA512
cb95b569a64701fcb7ba8319dd12c3b4c775c642538df57797ea5ff5a28fa430aecc3375832aefeee01eec01f53cb90e0ae244eb199e58f345caf7b7588692b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
84eb4bd2da80602c044cb9af99173401

SHA1
7ea29bb25e94432d968e217e0548f602bb73450d

SHA256
598a5a8f3c63ad42d94cb7507ea58e85d31fbf1b7efbc5f80640cf1cc4968967

SHA512
6503f9a473531b356b4b7693e0691664c00f84833b78098a2ff5dcfdd1616f3bbd59cc3b15bc502c08cd5a4bd713c5a6198126ee4b4e0ff42e9cdbe07b69e9f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
321d36949ca0419c8c47b31ef62b36c4

SHA1
205ff112068bfcd67b88de45d3c7ef9f154b8432

SHA256
d1556d72d54904260e5adbcfeb563aa2840b2a0529b1c20d09fe9b48a0120d03

SHA512
e972113b8f9a6fdb83fc8493ad9157f70157cce648beb22e5ccb64d9f1fd699a8c8c47d9d0154de15e12cbf7d48e6754691240dd3f470690e24fd133b725383f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
50e9b9b3274ff8e90eb2f78beba130d0

SHA1
d0aa0f4864bd58512e8117a4eeb8eb2ebde87263

SHA256
1874a0ec7666e9385c88658140df0cc555275ef1b9b2ec8006d2960af9a75118

SHA512
795e6304812128fff83c791fa6075a008d57996d9d4af368d1916832919cb56c2c505ef21cb641873cd499df541d99793b8e29ee7da6fc9baf5806b0ff483247

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0f92d430abd0dc4d111a29c9d854837f

SHA1
aff2ebeb54a08c73b203bc799ee4b43761b5ebcd

SHA256
77b6e1d85dc91c81334932705f6bc48cfeb09a1b26a008c55a5f03171d8549b7

SHA512
b67a5fae4b89ff6e6344b6b97328df340489bdb8610970aef588fb3e6808147ad8959dead50a329b884e79a15bc456781f272f1b72ca5fb4941480447c18b9b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\10c80ef954c22323571ebdabf142129f4e1362f7\index.txt

Filesize
121B

MD5
40a7942c52e463628a491258d4e1a0b0

SHA1
8c3c96212cdb7b958ea13b4d8c8a5a46662eaf28

SHA256
41156215527e7bc00f5fbaf57959029a9d719c65978ceb44aa67740874e10cbe

SHA512
b285dc6e0ef7f80d08cb66c0bd934f5310390183ed080af1a0152c1f7d2ea45ca31b83292b0b51e89cebf61379e52b8788f17696a1887d4c589e10815fd158c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\10c80ef954c22323571ebdabf142129f4e1362f7\index.txt~RFe58cc63.TMP

Filesize
128B

MD5
35949d2fb07230d1146b6c6a3f8d43b3

SHA1
19d6c98fd052ff9629c3b929f05d0cde2b8aa488

SHA256
ab28bad6212d1ff52706ffec668b32861554786beb9823795e6a8dc52825e2d6

SHA512
12079341ea48a4beebf8b95b511cdd46c88bd2e8fa6de1519921c0812872eb2b470b1b7e8a9cd2b90d7fac850972603336387a0b12146191bcd424a0c33078b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ffdabf25-7bc7-414f-91cb-833b6ab44535.tmp

Filesize
16KB

MD5
6a1c12abdacf754c7f73ba81aade1d5d

SHA1
a8c01402809fbbab68275842a66c8b1dd575e4cb

SHA256
c5f4e61d0c2c1277f72129e83cb63df249b26c9b0315b5bacecfe28d0db8c496

SHA512
dd12e249f490bd7fae6f566237ab824031ee64923b511d09690254c0e101fb5ebdb08c79d732ad2ebcbc93941ee6f37670e737a7f3efb9a8b8e5f487ece82000

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
33c9dc2a2f960b2f12bbf071a89db447

SHA1
1f423a7d587bb97fefdb8741767b1932076342bd

SHA256
6638804fff7f069304bcd21b73c5baca7b16d6d159dc1af2f73739e6da03a317

SHA512
e804cb6e7b053fad2e27a8713734454ee7fd33e676cbc407f62cc5fc7fcd9f7b8dbba23413bae7bba91c0711ba2ba4a041308fd6503827a75305bebedf7b6573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
0a4b60b4931d0f2c3d3d56086de08600

SHA1
073dd082a918bfb5d04c7f692bb2230a396a8ac6

SHA256
54c68ffcfd67e4819a55dfac5ceaf293ab4d62cab0630af826e52f4654d50eeb

SHA512
ec88fe8c7ef4c6eb0dd039faf57f1d9fdf0421936646e7b9c10129cf46967512a1bad79e3642437a2d264a46461aa1ac4bc15bc9d9886fd8ce4200d187999c91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
88KB

MD5
37cb2e5e08baa668be8aa4eba0199c54

SHA1
8b5d413d8582cd0bd0486a133f2f7399251ecf6a

SHA256
ab9f5cd97bfbe23484636cc0f6ed84384e23880105bb4912799dd0c0df5fc3a4

SHA512
8c382865b420a26e59401dbfcc07e24dbf21f9cf243243b4c568e739df9ca5a1873059aad6f05a16831910a1cf7a9639d43916c44cf1dd5ed06c04bb3a1b4afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585faf.TMP

Filesize
88KB

MD5
a28cc8c4bc27f697598af2b85e1dfc3f

SHA1
07544be8c3b22d62a486069c0d86dcaeb08d3a1b

SHA256
da49681612a6f4e09daf8f5d1b5e130cc73cea863d3462e0a995bd38dd7c4677

SHA512
86007184628372b145ad003322cbf332c18396f89c612137547ea6a0f1c6eb3de7884ce2e81bd91a2205c3e978a2660ddfe867d911b89dc30e307462973da3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
b28b98ddf6b06eb11acaa3848363dcef

SHA1
f3cf15267401b58adad910bd275c023f042a5f13

SHA256
eaa0bbcb505f2bd1714183261040b4c4bdaf765bb4456a9d510362fffb82e2af

SHA512
de4a9a3e90207543c7e3a2ecb1eace22ce2c8c9a426deffb01aced93250d21b43b382f84d0beb6feaa83b7f679e3bec529e865c1342d1aa566ad9128eb80ed6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
0660b455d048d124f1ad3ce1bffc82e2

SHA1
1aff31c02b60958b6e2466ef8118932ab20e766f

SHA256
961207c7d84128245ac24eeed3c77789cf0f354027780bd79afdce34db98a4d8

SHA512
e7a7f77d41c9a3e59693ea9edc6167ca1d3c78375d7fc8821b6a4c993a869b3c1c276d850948aaf6bea003a36ef6b60fca41427b94c8ee14028abead264318ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
f8150179aa6e6d447c9adbd47c475304

SHA1
20b686267ee6ad922655923caef8f55b61e506b3

SHA256
998a83aba7cf09858e5c20365a27093424acfe278f84792a04e026eea478122c

SHA512
ff046b05176886421501e402b2483d501332125d394dd587ef63b6f496ba0ab813ef3a3765aef619d81ef0e2086f9abc49afad5506b007dd409beb8a0b0db512

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
47a53bc86f6dc236b07053658e358cfb

SHA1
c0f356f7717584650e93eecc677cd2915f8416d6

SHA256
222e4ccdea3b996162d787b360db190d91d36957ed6c986148f31d6fd0358e92

SHA512
59a310b34f2ff8d6882f65900be382f6b988359547b75e147ebfbb2f85d84683051523c37b0f75517e0be048b572fd6b37ff0ed84493684755dbc9e0136557b5

Download Submit
memory/4376-149-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-166-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-130-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-134-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-136-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-135-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-139-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-138-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-137-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-141-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-143-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-144-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-142-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-147-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-146-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-148-0x0000000009120000-0x0000000009130000-memory.dmp

Filesize
64KB

Download
memory/4376-145-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-132-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-150-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-151-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-152-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-153-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-154-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-156-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-155-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-158-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-159-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-157-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-161-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-162-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-163-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-131-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-165-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-164-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-167-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-169-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-168-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-170-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-172-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-173-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-174-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-175-0x0000000009120000-0x0000000009130000-memory.dmp

Filesize
64KB

Download
memory/4376-176-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-177-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-178-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-179-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-180-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-181-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-182-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-128-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-129-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-127-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-126-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-124-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-123-0x0000000009260000-0x0000000009270000-memory.dmp

Filesize
64KB

Download
memory/4376-121-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-120-0x0000000009250000-0x0000000009260000-memory.dmp

Filesize
64KB

Download
memory/4376-118-0x0000000009120000-0x0000000009130000-memory.dmp

Filesize
64KB

Download
memory/4376-96-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4376-97-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4376-93-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4376-94-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4376-95-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4376-92-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download