hxxp://utorrent[.]com

Resubmissions

30/03/2025, 20:27 UTC

250330-y8lmzaylz6 6

30/03/2025, 17:58 UTC

250330-wj5y7sttds 10

Analysis

max time kernel
42s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 20:27 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://utorrent.com

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
111	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdiagnhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpshare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76A21CD1-0DA5-11F0-ACA8-72B5DC1A84E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{768A00F1-0DA5-11F0-ACA8-72B5DC1A84E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bcf5ce3de0ff614e8110c988818886b000000000020000000000106600000001000020000000caff513c0bcf770438adcd09c45a4f0e715f58c0dacd731382579d025b772f67000000000e80000000020000200000008ca06818a8b22ccfb04e5f03c2ec08eaa542aecebd75af4f08fea0df44a352869000000049c35b765558cdc8961f0011b2e3a62b6dade135983138316a6512a2a729b9ae21e9cc4fa4ef4823356453e1f937ff75d811daa4287d2fbf8594ab03a156ec2385eb19063078cdf650f1e36fcd8bddefd0304cd6c44b9b645a20f93d89b37e62bd4492efd0beebd37e698fb70c9ef307f47a7c71ef55b7c47769f6ba1c3c9035c9f0c39e99879b394bb05e15ba853ce940000000d84cb2c8cdeff6bc662fa8339824d59a5707faeca1fe71b651eb24398d4eaf8abaadb2514d449613b1b1e0baab32e03af2d54ea49e2685ac602730fc4886812d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 6051393eb2a1db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
896	chrome.exe
896	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2884	iexplore.exe
332	msdt.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
2620	wmplayer.exe
3056	iexplore.exe
396	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
3056	iexplore.exe
3056	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
396	iexplore.exe
396	iexplore.exe
1508	IEXPLORE.EXE
1508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2884	2808	explorer.exe	31
PID 2808 wrote to memory of 2884	2808	explorer.exe	31
PID 2808 wrote to memory of 2884	2808	explorer.exe	31
PID 2884 wrote to memory of 2960	2884	iexplore.exe	32
PID 2884 wrote to memory of 2960	2884	iexplore.exe	32
PID 2884 wrote to memory of 2960	2884	iexplore.exe	32
PID 2884 wrote to memory of 2960	2884	iexplore.exe	32
PID 2960 wrote to memory of 332	2960	IEXPLORE.EXE	34
PID 2960 wrote to memory of 332	2960	IEXPLORE.EXE	34
PID 2960 wrote to memory of 332	2960	IEXPLORE.EXE	34
PID 2960 wrote to memory of 332	2960	IEXPLORE.EXE	34
PID 896 wrote to memory of 2464	896	chrome.exe	39
PID 896 wrote to memory of 2464	896	chrome.exe	39
PID 896 wrote to memory of 2464	896	chrome.exe	39
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2288	896	chrome.exe	40
PID 896 wrote to memory of 2128	896	chrome.exe	41
PID 896 wrote to memory of 2128	896	chrome.exe	41
PID 896 wrote to memory of 2128	896	chrome.exe	41
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42
PID 896 wrote to memory of 1688	896	chrome.exe	42

C:\Windows\explorer.exe
explorer http://utorrent.com
1⤵
PID:2812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://utorrent.com/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\msdt.exe
      -modal 458976 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF5C91.tmp -ep NetworkDiagnosticsWeb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:332
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:668679 /prefetch:2
    3⤵
    PID:2332

C:\Windows\SysWOW64\sdiagnhost.exe
C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7619758,0x7fef7619768,0x7fef7619778
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1584 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1516 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:1
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3368 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3824 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3920 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3720 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1324,i,8741534310377756702,894652734520433915,131072 /prefetch:8
  2⤵
  PID:2768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2392

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2620
- C:\Program Files (x86)\Windows Media Player\wmpshare.exe
  "C:\Program Files (x86)\Windows Media Player\wmpshare.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:780

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:396 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1508

Network

DNS

utorrent.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

utorrent.com

IN A

Response

utorrent.com

IN A

34.201.157.226
GET

http://utorrent.com/

IEXPLORE.EXE

Remote address:

34.201.157.226:80

Request

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: utorrent.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 30 Mar 2025 20:27:31 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://www.utorrent.com/
DNS

www.utorrent.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.utorrent.com

IN A

Response

www.utorrent.com

IN CNAME

d37p7e9mldky5m.cloudfront.net

d37p7e9mldky5m.cloudfront.net

IN A

65.9.95.96

d37p7e9mldky5m.cloudfront.net

IN A

65.9.95.110

d37p7e9mldky5m.cloudfront.net

IN A

65.9.95.74

d37p7e9mldky5m.cloudfront.net

IN A

65.9.95.12
GET

http://www.utorrent.com/

IEXPLORE.EXE

Remote address:

65.9.95.96:80

Request

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.utorrent.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: CloudFront
Date: Sun, 30 Mar 2025 20:27:32 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://www.utorrent.com/
X-Cache: Redirect from cloudfront
Via: 1.1 79ba346413d83ce62db11c8d0b05c22c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: PRG50-C1
X-Amz-Cf-Id: ChWA8xJkGXLYs26XI1p4w4HXwB8BzjWcMsWEvrQHBJPFpF2YN3rXSA==
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
GET

https://www.google.com/async/ddljson?async=ntp:2

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/ddljson?async=ntp:2 HTTP/2.0
host: www.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2.0
host: www.google.com
x-client-data: CLLzygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_promos

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/newtab_promos HTTP/2.0
host: www.google.com
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

ogads-pa.clients6.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ogads-pa.clients6.google.com

IN A

Response

ogads-pa.clients6.google.com

IN A

142.250.187.202
DNS

apis.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

142.250.178.14
OPTIONS

https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

chrome.exe

Remote address:

142.250.187.202:443

Request

OPTIONS /$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData HTTP/2.0
host: ogads-pa.clients6.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: chrome-untrusted://new-tab-page
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlpzjkld-oO7BIFDdTB4P4=?alt=proto

chrome.exe

Remote address:

142.250.187.202:443

Request

GET /v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlpzjkld-oO7BIFDdTB4P4=?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CLLzygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0

chrome.exe

Remote address:

142.250.178.14:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0 HTTP/2.0
host: apis.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: __Secure-ENID=22.SE=iiVRS5Dj0SuZrLpEMbMEoeHUWyAZzjxyrFkBRCCL1T_YGjVu9L7TXyTiXMK--UeEnhxhqT5zv460BPYPUBfK05_Up5VtO-bFEa_0MO_gHZPMjme37F4xY477uq_-KqNWvrc_KcOMxx1NFIpB0bRklG6dXj7c340oWdBxUeBYiKUVbTsTra_hOYd-MzPbQ66OLw
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.179.238
OPTIONS

https://play.google.com/log?format=json&hasfast=true

chrome.exe

Remote address:

142.250.179.238:443

Request

OPTIONS /log?format=json&hasfast=true HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-encoding,content-type
origin: chrome-untrusted://new-tab-page
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

redir.metaservices.microsoft.com

wmplayer.exe

Remote address:

8.8.8.8:53

Request

redir.metaservices.microsoft.com

IN A

Response

redir.metaservices.microsoft.com

IN CNAME

redir.metaservices.microsoft.com.edgesuite.net

redir.metaservices.microsoft.com.edgesuite.net

IN CNAME

a1095.g2.akamai.net

a1095.g2.akamai.net

IN A

2.19.252.157

a1095.g2.akamai.net

IN A

2.19.252.160
GET

http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

2.19.252.157:80

Request

GET /redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: redir.metaservices.microsoft.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost
Content-Length: 0
Location: http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409
Date: Sun, 30 Mar 2025 20:27:57 GMT
Connection: keep-alive
GET

http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

wmplayer.exe

Remote address:

2.19.252.157:80

Request

GET /redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: redir.metaservices.microsoft.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost
Content-Length: 0
Location: http://toc.music.metaservices.microsoft.com/cdinfo/GetMDRCD.aspx?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16
Date: Sun, 30 Mar 2025 20:28:22 GMT
Connection: keep-alive
DNS

onlinestores.metaservices.microsoft.com

wmplayer.exe

Remote address:

8.8.8.8:53

Request

onlinestores.metaservices.microsoft.com

IN A

Response

onlinestores.metaservices.microsoft.com

IN CNAME

serviceswitching.metaservices.microsoft.com.edgesuite.net

serviceswitching.metaservices.microsoft.com.edgesuite.net

IN CNAME

a177.g.akamai.net

a177.g.akamai.net

IN A

2.19.252.153

a177.g.akamai.net

IN A

2.19.252.157
GET

http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

2.19.252.153:80

Request

GET /serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: onlinestores.metaservices.microsoft.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: application/xml
ETag: "df03e65b8e082f24dab09c57bc9c6241:1507068277"
Last-Modified: Tue, 03 Oct 2017 22:04:36 GMT
Server: AkamaiNetStorage
Content-Length: 546
Date: Sun, 30 Mar 2025 20:27:57 GMT
Connection: keep-alive
GET

http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

2.19.252.153:80

Request

GET /bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: onlinestores.metaservices.microsoft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: application/xml
ETag: "d58da90d6dc51f97cb84dfbffe2b2300:1507068209"
Last-Modified: Tue, 03 Oct 2017 22:03:27 GMT
Server: AkamaiNetStorage
Content-Length: 523
Date: Sun, 30 Mar 2025 20:27:57 GMT
Connection: keep-alive
DNS

images.windowsmedia.com

wmplayer.exe

Remote address:

8.8.8.8:53

Request

images.windowsmedia.com

IN A

Response

images.windowsmedia.com

IN CNAME

images.windowsmedia.com.akadns.net

images.windowsmedia.com.akadns.net

IN CNAME

images.windowsmedia.com.edgesuite.net

images.windowsmedia.com.edgesuite.net

IN CNAME

a1076.g.akamai.net

a1076.g.akamai.net

IN A

2.19.252.159

a1076.g.akamai.net

IN A

2.19.252.133
GET

http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

wmplayer.exe

Remote address:

2.19.252.159:80

Request

GET /svcswitch/mg4_wmp12_30x30_2.png HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: images.windowsmedia.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: image/png
Last-Modified: Mon, 10 Nov 2008 23:46:38 GMT
Accept-Ranges: bytes
ETag: "a09cf928e43c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 2043
Cache-Control: max-age=450605
Date: Sun, 30 Mar 2025 20:27:58 GMT
Connection: keep-alive
GET

http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

wmplayer.exe

Remote address:

2.19.252.159:80

Request

GET /svcswitch/media_guide_16x16.png HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: images.windowsmedia.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: image/png
Last-Modified: Tue, 28 Oct 2008 21:02:20 GMT
Accept-Ranges: bytes
ETag: "db34ed774039c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 897
Cache-Control: max-age=1183272
Date: Sun, 30 Mar 2025 20:27:58 GMT
Connection: keep-alive
DNS

api.bing.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

api.bing.com

IN A

Response

api.bing.com

IN CNAME

api-bing-com.e-0001.e-msedge.net

api-bing-com.e-0001.e-msedge.net

IN CNAME

e-0001.e-msedge.net

e-0001.e-msedge.net

IN A

13.107.5.80
DNS

consent.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

consent.google.com

IN A

Response

consent.google.com

IN A

216.58.212.206
POST

https://consent.google.com/save?continue=https://www.google.com/search?q%3Dmalware%2Bdownload%26oq%3Dmalware%2Bdownload%26aqs%3Dchrome..69i57.1299j0j7%26sourceid%3Dchrome%26ie%3DUTF-8%26sei%3DVanpZ9OUBdGzhbIPzN3Y-QM&gl=UK&m=0&pc=srp&x=5&src=2&hl=en&bl=gws_20250325-0_RC1&uxe=none&cm=2&set_eom=true

chrome.exe

Remote address:

216.58.212.206:443

Request

POST /save?continue=https://www.google.com/search?q%3Dmalware%2Bdownload%26oq%3Dmalware%2Bdownload%26aqs%3Dchrome..69i57.1299j0j7%26sourceid%3Dchrome%26ie%3DUTF-8%26sei%3DVanpZ9OUBdGzhbIPzN3Y-QM&gl=UK&m=0&pc=srp&x=5&src=2&hl=en&bl=gws_20250325-0_RC1&uxe=none&cm=2&set_eom=true HTTP/2.0
host: consent.google.com
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://www.google.com
x-client-data: CLLzygE=
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: AEC=AVcja2cu_s7UBkgY0fGXET3WF9sZZHUyXsI33Q3TTsTydSYoKxQIJrHE3w
cookie: __Secure-ENID=26.SE=KHIbuggtJP8NAphmUjHGkZHVVTm-m7b3YgT7BnN2aUY2bCjASNHNkERwfc4b_UCJ7351Rk8H8gJkwcFlRRlychQrmP7yb3gECP1Etpm5lJLGS8hK76yk66ntPHbq0mGPia8Y8LEB9OsW3W5e61daMEKtucSMVmgON9bYnqV4098YE27FkTXl6DCHlHTjWkPllHDsIeK2zaIJSYCculGgnRL5i7hY3u7s5g1E1pitIarNsLgVDra-vH1lPRFcmoxHTbSK3LDXvfCt
cookie: SOCS=CAESHAgCEhJnd3NfMjAyNTAzMjUtMF9SQzEaAmVuIAEaBgiAk6K_Bg
DNS

encrypted-tbn0.gstatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

encrypted-tbn0.gstatic.com

IN A

Response

encrypted-tbn0.gstatic.com

IN A

172.217.169.78
GET

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQngpwgoHT5rIYxLXDtCMTn-VjkwkF363AUhCyPPHY&s=10

chrome.exe

Remote address:

172.217.169.78:443

Request

GET /images?q=tbn:ANd9GcQngpwgoHT5rIYxLXDtCMTn-VjkwkF363AUhCyPPHY&s=10 HTTP/2.0
host: encrypted-tbn0.gstatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
x-client-data: CLLzygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

lh5.googleusercontent.com

chrome.exe

Remote address:

8.8.8.8:53

Request

lh5.googleusercontent.com

IN A

Response

lh5.googleusercontent.com

IN CNAME

googlehosted.l.googleusercontent.com

googlehosted.l.googleusercontent.com

IN A

142.250.200.33
GET

https://lh5.googleusercontent.com/p/AF1QipPQ8tz86udx7X-rT7Ekf3ENXgkZ4heAzg3B2mVh=w92-h92-n-k-no

chrome.exe

Remote address:

142.250.200.33:443

Request

GET /p/AF1QipPQ8tz86udx7X-rT7Ekf3ENXgkZ4heAzg3B2mVh=w92-h92-n-k-no HTTP/2.0
host: lh5.googleusercontent.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
x-client-data: CLLzygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

github.githubassets.com

Remote address:

8.8.8.8:53

Request

github.githubassets.com

IN A

Response

github.githubassets.com

IN A

185.199.109.154

github.githubassets.com

IN A

185.199.111.154

github.githubassets.com

IN A

185.199.108.154

github.githubassets.com

IN A

185.199.110.154
DNS

avatars.githubusercontent.com

Remote address:

8.8.8.8:53

Request

avatars.githubusercontent.com

IN A

Response

avatars.githubusercontent.com

IN A

185.199.108.133

avatars.githubusercontent.com

IN A

185.199.109.133

avatars.githubusercontent.com

IN A

185.199.110.133

avatars.githubusercontent.com

IN A

185.199.111.133
DNS

github-cloud.s3.amazonaws.com

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN A

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com

s3-w.us-east-1.amazonaws.com

IN A

52.216.33.49

s3-w.us-east-1.amazonaws.com

IN A

16.15.192.152

s3-w.us-east-1.amazonaws.com

IN A

54.231.204.97

s3-w.us-east-1.amazonaws.com

IN A

52.217.11.188

s3-w.us-east-1.amazonaws.com

IN A

54.231.161.89

s3-w.us-east-1.amazonaws.com

IN A

3.5.20.46

s3-w.us-east-1.amazonaws.com

IN A

3.5.30.85

s3-w.us-east-1.amazonaws.com

IN A

3.5.29.45
DNS

user-images.githubusercontent.com

Remote address:

8.8.8.8:53

Request

user-images.githubusercontent.com

IN A

Response

user-images.githubusercontent.com

IN A

185.199.109.133

user-images.githubusercontent.com

IN A

185.199.108.133

user-images.githubusercontent.com

IN A

185.199.111.133

user-images.githubusercontent.com

IN A

185.199.110.133
DNS

repository-images.githubusercontent.com

Remote address:

8.8.8.8:53

Request

repository-images.githubusercontent.com

IN A

Response

repository-images.githubusercontent.com

IN A

185.199.111.133

repository-images.githubusercontent.com

IN A

185.199.109.133

repository-images.githubusercontent.com

IN A

185.199.108.133

repository-images.githubusercontent.com

IN A

185.199.110.133
DNS

content-autofill.googleapis.com

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

216.58.204.74

content-autofill.googleapis.com

IN A

216.58.201.106

content-autofill.googleapis.com

IN A

142.250.200.10

content-autofill.googleapis.com

IN A

172.217.169.42

content-autofill.googleapis.com

IN A

216.58.212.234

content-autofill.googleapis.com

IN A

172.217.169.10

content-autofill.googleapis.com

IN A

142.250.187.202

content-autofill.googleapis.com

IN A

142.250.187.234

content-autofill.googleapis.com

IN A

172.217.16.234

content-autofill.googleapis.com

IN A

216.58.212.202

content-autofill.googleapis.com

IN A

142.250.178.10

content-autofill.googleapis.com

IN A

172.217.169.74

content-autofill.googleapis.com

IN A

142.250.180.10

content-autofill.googleapis.com

IN A

142.250.179.234

content-autofill.googleapis.com

IN A

142.250.200.42
DNS

collector.github.com

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com

glb-db52c2cf8be544.github.com

IN A

140.82.113.22
DNS

api.github.com

Remote address:

8.8.8.8:53

Request

api.github.com

IN A

Response

api.github.com

IN A

20.26.156.210
DNS

toc.music.metaservices.microsoft.com

Remote address:

8.8.8.8:53

Request

toc.music.metaservices.microsoft.com

IN A

Response
DNS

camo.githubusercontent.com

Remote address:

8.8.8.8:53

Request

camo.githubusercontent.com

IN A

Response

camo.githubusercontent.com

IN A

185.199.111.133

camo.githubusercontent.com

IN A

185.199.109.133

camo.githubusercontent.com

IN A

185.199.110.133

camo.githubusercontent.com

IN A

185.199.108.133
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

collector.github.com

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com

glb-db52c2cf8be544.github.com

IN A

140.82.112.21
DNS

github-cloud.s3.amazonaws.com

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN A

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com

s3-w.us-east-1.amazonaws.com

IN A

54.231.232.201

s3-w.us-east-1.amazonaws.com

IN A

52.216.218.153

s3-w.us-east-1.amazonaws.com

IN A

16.182.97.113

s3-w.us-east-1.amazonaws.com

IN A

16.15.216.91

s3-w.us-east-1.amazonaws.com

IN A

52.217.201.121

s3-w.us-east-1.amazonaws.com

IN A

3.5.30.24

s3-w.us-east-1.amazonaws.com

IN A

3.5.29.55

s3-w.us-east-1.amazonaws.com

IN A

3.5.10.180
DNS

beacons.gcp.gvt2.com

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

172.217.16.227
DNS

api.github.com

Remote address:

8.8.8.8:53

Request

api.github.com

IN A

Response

api.github.com

IN A

20.26.156.210

34.201.157.226:80

http://utorrent.com/

http

IEXPLORE.EXE

764 B
518 B
6
3

HTTP Request

GET http://utorrent.com/

HTTP Response

301
34.201.157.226:80

utorrent.com

IEXPLORE.EXE

196 B
104 B
4
2
65.9.95.96:80

www.utorrent.com

IEXPLORE.EXE

144 B
52 B
3
1
65.9.95.96:80

http://www.utorrent.com/

http

IEXPLORE.EXE

533 B
1.3kB
6
4

HTTP Request

GET http://www.utorrent.com/

HTTP Response

301
65.9.95.96:443

www.utorrent.com

tls

IEXPLORE.EXE

397 B
219 B
5
5
65.9.95.96:443

www.utorrent.com

tls

IEXPLORE.EXE

359 B
219 B
5
5
65.9.95.96:443

www.utorrent.com

tls

IEXPLORE.EXE

288 B
219 B
5
5
65.9.95.96:443

www.utorrent.com

IEXPLORE.EXE

190 B
92 B
4
2
65.9.95.96:443

www.utorrent.com

tls

IEXPLORE.EXE

489 B
259 B
7
6
65.9.95.96:443

www.utorrent.com

IEXPLORE.EXE

52 B
1
142.250.178.4:443

https://www.google.com/async/newtab_promos

tls, http2

chrome.exe

3.2kB
75.0kB
45
67

HTTP Request

GET https://www.google.com/async/ddljson?async=ntp:2

HTTP Request

GET https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

HTTP Request

GET https://www.google.com/async/newtab_promos
142.250.187.202:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlpzjkld-oO7BIFDdTB4P4=?alt=proto

tls, http2

chrome.exe

2.5kB
12.7kB
22
27

HTTP Request

OPTIONS https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlpzjkld-oO7BIFDdTB4P4=?alt=proto
142.250.178.14:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0

tls, http2

chrome.exe

2.7kB
47.5kB
29
43

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0
142.250.179.238:443

https://play.google.com/log?format=json&hasfast=true

tls, http2

chrome.exe

1.8kB
8.3kB
15
16

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true
2.19.252.157:80

http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

http

wmplayer.exe

1.0kB
1.6kB
10
9

HTTP Request

GET http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

302

HTTP Request

GET http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

HTTP Response

302
2.19.252.153:80

http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

http

wmplayer.exe

905 B
2.7kB
8
7

HTTP Request

GET http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

200

HTTP Request

GET http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

200
2.19.252.159:80

http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

http

wmplayer.exe

475 B
2.6kB
6
5

HTTP Request

GET http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

HTTP Response

200
2.19.252.159:80

http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

http

wmplayer.exe

527 B
2.6kB
7
5

HTTP Request

GET http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

HTTP Response

200
216.58.212.206:443

https://consent.google.com/save?continue=https://www.google.com/search?q%3Dmalware%2Bdownload%26oq%3Dmalware%2Bdownload%26aqs%3Dchrome..69i57.1299j0j7%26sourceid%3Dchrome%26ie%3DUTF-8%26sei%3DVanpZ9OUBdGzhbIPzN3Y-QM&gl=UK&m=0&pc=srp&x=5&src=2&hl=en&bl=gws_20250325-0_RC1&uxe=none&cm=2&set_eom=true

tls, http2

chrome.exe

2.4kB
10.0kB
15
17

HTTP Request

POST https://consent.google.com/save?continue=https://www.google.com/search?q%3Dmalware%2Bdownload%26oq%3Dmalware%2Bdownload%26aqs%3Dchrome..69i57.1299j0j7%26sourceid%3Dchrome%26ie%3DUTF-8%26sei%3DVanpZ9OUBdGzhbIPzN3Y-QM&gl=UK&m=0&pc=srp&x=5&src=2&hl=en&bl=gws_20250325-0_RC1&uxe=none&cm=2&set_eom=true
172.217.169.78:443

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQngpwgoHT5rIYxLXDtCMTn-VjkwkF363AUhCyPPHY&s=10

tls, http2

chrome.exe

1.9kB
7.4kB
14
15

HTTP Request

GET https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQngpwgoHT5rIYxLXDtCMTn-VjkwkF363AUhCyPPHY&s=10
142.250.200.33:443

https://lh5.googleusercontent.com/p/AF1QipPQ8tz86udx7X-rT7Ekf3ENXgkZ4heAzg3B2mVh=w92-h92-n-k-no

tls, http2

chrome.exe

2.0kB
18.2kB
17
21

HTTP Request

GET https://lh5.googleusercontent.com/p/AF1QipPQ8tz86udx7X-rT7Ekf3ENXgkZ4heAzg3B2mVh=w92-h92-n-k-no
20.26.156.215:443

github.com

tls

7.0kB
174.4kB
95
156
20.26.156.215:443

github.com

tls

1.1kB
4.8kB
12
9
185.199.109.154:443

github.githubassets.com

tls

34.6kB
1.1MB
520
897
185.199.109.154:443

github.githubassets.com

tls

989 B
6.3kB
9
11
185.199.109.154:443

github.githubassets.com

tls

989 B
6.3kB
9
11
185.199.109.154:443

github.githubassets.com

tls

989 B
6.3kB
9
11
185.199.109.154:443

github.githubassets.com

tls

989 B
6.3kB
9
11
185.199.109.154:443

github.githubassets.com

tls

989 B
6.3kB
9
11
185.199.108.133:443

avatars.githubusercontent.com

tls

2.3kB
20.2kB
22
30
185.199.109.154:443

github.githubassets.com

tls

924 B
769 B
7
7
185.199.111.133:443

repository-images.githubusercontent.com

tls

989 B
6.4kB
9
11
185.199.111.133:443

repository-images.githubusercontent.com

tls

6.8kB
238.5kB
110
194
185.199.109.154:443

github.githubassets.com

tls

2.2kB
24.6kB
21
31
140.82.113.22:443

collector.github.com

tls

909 B
4.3kB
8
5
140.82.113.22:443

collector.github.com

tls

909 B
4.3kB
8
5
20.26.156.210:443

api.github.com

tls

5.8kB
9.0kB
28
30
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
5
20.26.156.210:443

api.github.com

tls

2.2kB
5.3kB
15
13
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
204.79.197.200:443

ieonline.microsoft.com

tls

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

831 B
7.9kB
10
13
20.26.156.210:443

api.github.com

tls

2.2kB
5.3kB
15
14
20.26.156.210:443

api.github.com

tls

4.5kB
9.0kB
27
30
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
6
185.199.109.154:443

github.githubassets.com

tls

924 B
769 B
7
7
20.26.156.215:443

github.com

tls

943 B
4.0kB
8
9
185.199.109.154:443

github.githubassets.com

tls

924 B
769 B
7
7
185.199.108.133:443

avatars.githubusercontent.com

tls

926 B
765 B
7
7
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.113.22:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
20.26.156.215:443

github.com

tls

8.0kB
171.1kB
100
163
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
172.217.16.227:443

beacons.gcp.gvt2.com

tls

2.8kB
6.5kB
16
14
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
185.199.108.133:443

avatars.githubusercontent.com

tls

1.7kB
3.0kB
11
13
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
185.199.109.154:443

github.githubassets.com

tls

4.7kB
113.3kB
60
100
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

985 B
5.7kB
9
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

915 B
4.3kB
8
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
20.26.156.215:443

github.com

tls

5.4kB
62.5kB
50
71
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

915 B
4.3kB
8
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
20.26.156.215:443

github.com

tls

7.5kB
94.8kB
72
85
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

909 B
4.4kB
8
7
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
20.26.156.215:443

github.com

tls

5.9kB
90.5kB
56
91
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
6
20.26.156.210:443

api.github.com

tls

12.6kB
7.7kB
26
24
185.199.109.154:443

github.githubassets.com

tls

786 B
625 B
4
4
185.199.109.154:443

github.githubassets.com

52 B
1
185.199.108.133:443

avatars.githubusercontent.com

tls

788 B
621 B
4
4
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5
140.82.112.21:443

collector.github.com

tls

863 B
4.3kB
7
5

8.8.8.8:53

utorrent.com

dns

IEXPLORE.EXE

58 B
74 B
1
1

DNS Request

utorrent.com

DNS Response

34.201.157.226
8.8.8.8:53

www.utorrent.com

dns

IEXPLORE.EXE

62 B
169 B
1
1

DNS Request

www.utorrent.com

DNS Response

65.9.95.96

65.9.95.110

65.9.95.74

65.9.95.12
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
8.8.8.8:53

ogads-pa.clients6.google.com

dns

chrome.exe

74 B
90 B
1
1

DNS Request

ogads-pa.clients6.google.com

DNS Response

142.250.187.202
8.8.8.8:53

apis.google.com

dns

chrome.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

142.250.178.14
142.250.187.202:443

ogads-pa.clients6.google.com

https

chrome.exe

5.1kB
8.3kB
14
17
8.8.8.8:53

play.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.179.238
142.250.179.238:443

play.google.com

https

chrome.exe

4.5kB
8.3kB
13
17
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

redir.metaservices.microsoft.com

dns

wmplayer.exe

78 B
200 B
1
1

DNS Request

redir.metaservices.microsoft.com

DNS Response

2.19.252.157

2.19.252.160
8.8.8.8:53

onlinestores.metaservices.microsoft.com

dns

wmplayer.exe

85 B
216 B
1
1

DNS Request

onlinestores.metaservices.microsoft.com

DNS Response

2.19.252.153

2.19.252.157
8.8.8.8:53

images.windowsmedia.com

dns

wmplayer.exe

69 B
226 B
1
1

DNS Request

images.windowsmedia.com

DNS Response

2.19.252.159

2.19.252.133
8.8.8.8:53

api.bing.com

dns

iexplore.exe

58 B
134 B
1
1

DNS Request

api.bing.com

DNS Response

13.107.5.80
142.250.178.4:443

www.google.com

https

chrome.exe

64.6kB
1.8MB
388
1640
142.250.187.202:443

ogads-pa.clients6.google.com

https

chrome.exe

3.5kB
7.4kB
9
11
142.250.179.238:443

play.google.com

https

chrome.exe

3.3kB
7.0kB
7
10
8.8.8.8:53

consent.google.com

dns

chrome.exe

64 B
80 B
1
1

DNS Request

consent.google.com

DNS Response

216.58.212.206
8.8.8.8:53

encrypted-tbn0.gstatic.com

dns

chrome.exe

72 B
88 B
1
1

DNS Request

encrypted-tbn0.gstatic.com

DNS Response

172.217.169.78
8.8.8.8:53

lh5.googleusercontent.com

dns

chrome.exe

71 B
116 B
1
1

DNS Request

lh5.googleusercontent.com

DNS Response

142.250.200.33
8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

github.githubassets.com

dns

69 B
133 B
1
1

DNS Request

github.githubassets.com

DNS Response

185.199.109.154

185.199.111.154

185.199.108.154

185.199.110.154
8.8.8.8:53

avatars.githubusercontent.com

dns

75 B
139 B
1
1

DNS Request

avatars.githubusercontent.com

DNS Response

185.199.108.133

185.199.109.133

185.199.110.133

185.199.111.133
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

75 B
253 B
1
1

DNS Request

github-cloud.s3.amazonaws.com

DNS Response

52.216.33.49

16.15.192.152

54.231.204.97

52.217.11.188

54.231.161.89

3.5.20.46

3.5.30.85

3.5.29.45
8.8.8.8:53

user-images.githubusercontent.com

dns

79 B
143 B
1
1

DNS Request

user-images.githubusercontent.com

DNS Response

185.199.109.133

185.199.108.133

185.199.111.133

185.199.110.133
8.8.8.8:53

repository-images.githubusercontent.com

dns

85 B
149 B
1
1

DNS Request

repository-images.githubusercontent.com

DNS Response

185.199.111.133

185.199.109.133

185.199.108.133

185.199.110.133
8.8.8.8:53

content-autofill.googleapis.com

dns

77 B
317 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

216.58.204.74

216.58.201.106

142.250.200.10

172.217.169.42

216.58.212.234

172.217.169.10

142.250.187.202

142.250.187.234

172.217.16.234

216.58.212.202

142.250.178.10

172.217.169.74

142.250.180.10

142.250.179.234

142.250.200.42
8.8.8.8:53

collector.github.com

dns

66 B
115 B
1
1

DNS Request

collector.github.com

DNS Response

140.82.113.22
8.8.8.8:53

api.github.com

dns

60 B
76 B
1
1

DNS Request

api.github.com

DNS Response

20.26.156.210
8.8.8.8:53

toc.music.metaservices.microsoft.com

dns

82 B
155 B
1
1

DNS Request

toc.music.metaservices.microsoft.com
8.8.8.8:53

camo.githubusercontent.com

dns

72 B
136 B
1
1

DNS Request

camo.githubusercontent.com

DNS Response

185.199.111.133

185.199.109.133

185.199.110.133

185.199.108.133
216.58.204.74:443

content-autofill.googleapis.com

https

3.9kB
7.4kB
14
14
8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

collector.github.com

dns

66 B
115 B
1
1

DNS Request

collector.github.com

DNS Response

140.82.112.21
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

75 B
253 B
1
1

DNS Request

github-cloud.s3.amazonaws.com

DNS Response

54.231.232.201

52.216.218.153

16.182.97.113

16.15.216.91

52.217.201.121

3.5.30.24

3.5.29.55

3.5.10.180
8.8.8.8:53

beacons.gcp.gvt2.com

dns

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

172.217.16.227
216.58.204.74:443

content-autofill.googleapis.com

https

2.3kB
3.2kB
9
9
8.8.8.8:53

api.github.com

dns

60 B
76 B
1
1

DNS Request

api.github.com

DNS Response

20.26.156.210

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8154ad616ed68397066ff13927bf6c

SHA1
9beb5f008db1299cc09a02122f695cd5526612b0

SHA256
e0712370b2004a4ae4feb2c0b2ad5126ca52a9e0cef247fda6fb41cf160e3fe6

SHA512
f12aa8f940ed0ff0101fc0e8b21b920c505b85eb6282d6f36625c38be086be6ca0ea1387c287b115bb4144a81878ab03bdd73741bfeadcb972bc29aa06afe011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76ce435f8188583482b324e502cb189

SHA1
44ccd8bef0d318869f7387f2bba6339daf350eaf

SHA256
25c269b0f948e7e6e2f0161662ee2b41e000a02a92a98c17a4496fe646b93da5

SHA512
73e621e38abca29af528e9c13ba0d98b3fcda620201e30cd3a5b9e4343a364419634331dcbc32bd0bbf96355eab38ab3631c4e5d9c3565645f04ded49586cc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1298d83b305f18a2610db0f3d7836ff1

SHA1
19785ab805b1d8ad603ed74b39403b8087769ead

SHA256
076966067e9da20847333a417792e094f12f3bd2084b7921a299cd97cfcb8da8

SHA512
06690e7df85cf3e85c7dd53c622eb6fafc623fcf9035e2b11eee7ee43d3e0038b9bc8968aa10ba7d97c56255a0a93cde5ba5bd0a57be5992c2c16f66d8d515a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986a2a4fdbe637fd82302dbe36558b47

SHA1
442942900d0ded0faef4d3eb3a7999134fc32367

SHA256
5c9e95f07204a6cf46686762058464a04708a8b41e39d7ef26336be0d09dbfd5

SHA512
8a014337b60d97f4d90a62c1e8e821573d5cf89cb8dd69480b326d3bfbf3b9ab91fb33d46939de731c9be038c2db3eae96a0379c2eab6caa167e32d7aa9d73d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
787f3ff83149bba8d8a29ca9784ba2cc

SHA1
63dbc2a8a030fecce0a2d97d7ede5beaeebf17be

SHA256
2467989bff9596f3e76f4adc691a5fac3aadb370be58c5a9f210636f1c999ce4

SHA512
5f7bc4edf2b0b9126263315c5aaf8b283ffa79015308542eeda84ad531c659727d26757c3690c80317af97fb32bf35d6361ff0aa687b1e578081740f7bd341b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fea04aff21668afeb840de60253906c

SHA1
a666ee88fca804a5e792c67915a8ee1064c260cf

SHA256
539173a3a19f3f4deddc54d97b24b48469e95612594db8c8b7afbc23254e152d

SHA512
ee160a40e318c87b55ebfc705ededfc152890fbb28457cffff89129afcdfd1ca6abc8dd51397a32ab77732ce544fa4da6843b30ee5a07856a4e7d3517bbb951d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a424671195c920b93b39fc96cbe320a2

SHA1
5f3eabb2b20a7efa59e87b74274c8059ceac1c78

SHA256
fb5a6f70de9dab71c00b75c03358688a564b510e62606ac5ab80bf5c1de430b2

SHA512
bb9fa067d1d866651163f9e95135c62120953f27b401a48767b331efb67ad988d364986bcaa30f499f5ea93473c661d2582da1ee25a6bdb01913a6bd8d7f58f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e70f1ef62c0f56b7bb4bfd33af48352

SHA1
f3d61b7c3cd6285004698fcc9e81e8217c1041cd

SHA256
52296438038ce3029421729f0ddd4f1d43e553723dec614ec285e3244e31ae17

SHA512
4e4500165df16c34118cab244393565717b165fe6332902ddb5ff1bdf1d0850f4144ef12ef2fa2da5a469b2652103c92ab7789493cb7cd3dc2679b9872c127ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ae09ef17a6c30cff5b36176e02e31cf

SHA1
2fa949fd29bc64739eae1d97f17e43e50cebdc28

SHA256
f3adb775b18448f5ae6bd173fb3a7335681f4d1bf818ea1149fb31ea7d4ed4d8

SHA512
a039ba8b4506be94b063b6ffe0ce344aae557f96e92d8771131956d271c5501424b32866eecb5b2a104abc017aa2669596d85adb52828cf3bf4412ae25aa5f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53126c57282944e72b4dde7e6a3b007c

SHA1
1a10077b23b53638c1f2d14f86312e08e0fcf96d

SHA256
6f95c969a19fa2ec1e1955f87e4266b124732c733979b73b6a6f8be1963ba130

SHA512
a44aae1d7c4e092206c7567feb287e05e964aee65805901b0237c083efff40961c72b668fbc05986764aaf5baeb643a8e5dc0c5406a8c7a5846d9a729a911688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0427b2944d340d057d7ff484ee4cd9d1

SHA1
5d226f2eb9d5a6d455eacf638cadd8227bcc39bc

SHA256
c6976246e02aa2c53f7162c03e60f1bca49ccd185948a7b78130174d74a7af06

SHA512
902cf6f5fbbd4318ae94c06fea4e5dcd3d04277424bd2cf5305a892cf62ae74433e779e27ec98cb3c931e5955b844667b5fb9ff2c1d8e2298056f6ea3706589d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce14069da3dbd5293cdb01e753e94c1

SHA1
6f5bd1d18a5f6f5b1407c266d64adb36277f4fc9

SHA256
1129b4ba7a0c863972293027cd697a5d85b2d4e33766559f4776da8d990f455c

SHA512
0a9456159a4e90d21b323c0381dc333943f7ea61da08f23742e6ff8dd2c93669f241fac30d2a942259d6316495a1f7a1115fefa424b34af8144a3e933465815e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b7d494c361d4a9876443e374d451068

SHA1
deb9bd2d11af30099096f00a815a76e591ef69af

SHA256
f9b283b0ad68eb1e101acd31dd17ff02863342979048b58ccc14dc94b16bc10c

SHA512
6820003d4253694e279197c70456938beeb69ee069c3c620cc1aa4ac1980ba439719edeb69aa106d9fec06b0e2c0b21039be8bd3968e58be2b059d5ea388e56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4083e548aaccff5614308a64f1bb131b

SHA1
e834428f530ae09fc8b8141136e7d1b785172f3d

SHA256
b9f769d0e7a06c33e5d0cf0079a742325855734a32d0172332a26e8f2b7d612f

SHA512
781205535255eb8970ace9a99f753c8adfe5b1de6b7dbb7793b7669f5c80e4468941dfe9071708f651e67cc816b3b784d7f12ed91b4c7ab288ed3d338de85a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e14b519f7b1df40173d18a57ce67d90

SHA1
05255ad3733139bb16cee440493944f755a812ac

SHA256
fd542e4a8c3f7f96f82efc305754778662901e81032da93d62d45e2eb8eaff60

SHA512
8406b438e171495b95c0eca535b3de0b586f6674b8a88af788ada4dc79b121584ce54236a0a581f308480d90adb8c18fe42ec0f3f40f79ad32d3f18f5886ec9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1719b6c91b5e345c53e4fc69b19b49e1

SHA1
b2a7ad4025a060147345b5792d150a04fc61a06c

SHA256
17dd4b01caabee7afa267dac2ae4cbdcca7132c181b93ca10a014e9657c3af5c

SHA512
ef293d5227352a92d7b91b6d09244695c5de94838c96e9866539b3d2f84f8e6b8cebad1cd00980c4812ce18e21a19ee8f7db82cc31fc9d9eae7abb0b7cc9295b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a93a950c0cc54109e17d0aff0d41066

SHA1
56829167722358449a0f3a4cf0d2a0949ba87d02

SHA256
aa37201b44bc0baddbe41a3dd40fc6a66abc94a93cd125437eda495a8a67bfc7

SHA512
7856ebbfd69c9cf5a0b574745ea6bbf66b49a0b62da0c7de7bcfee2d5e3527cccbe29c2ad7d5cd18bcdd87101c7071242c2e19c33bc3505bb49b3bc9aee18526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa8c830cdb58e57a9e8b323d01c495c1

SHA1
d68132152da67e5904b768197b0207978d53da08

SHA256
91ddc1a060fe67e9a70ea9b883026b84141026bf76af8dd75c8906719d1a9c77

SHA512
6655b30f4ce8edb8453327465d43ab839d700268d49c95c8d933693f058609607ff668d318196ee7646d7f575e8be8c02fee3dc6360e2e70b30157f3808d3a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4432e5bd4f71d216655f1729641db68a

SHA1
6c36ae76c8d07191510936bbeec30b34ad49d819

SHA256
9f48a8471443b4b04bfb5bb0386e9163fe574e693c0e9fe561e744ca2cdf1701

SHA512
8756a462f657db1859da73cd6212a4d94c1c8ae0f486463fcf05b71bcd5266db8c64bc0b3734683d5be9adf40d1e57d8a6dcc36a2d00bbf77f04d51bc6d701b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cbedac33a820ab60569e65df69df169

SHA1
833b3a7852759ee9fdc310049a52f7d60c7d472c

SHA256
cdf7ed05429d3f7f7f578d1c5e17281f3492fe0fe1787aec494ccb5abc1cbd61

SHA512
ff4a873ed836feaa5a4134b3b83fdb684d7c250afc9fb4718cdaf8631db450da3bfa65d6a06626c0f2efb06d9b26f574ad42836aec8a903535bb0033d7b7c520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ec74347bed136869443eb859f141159

SHA1
6d073fbcc57b8787dc80bfc235a05397a57d7004

SHA256
2a64845f5fa3214347cd8d1f1e67cfdb1874b7d3a0e53c1e424bed0889147c30

SHA512
73235d4111595fadff2e0c20d3474d53cbd067d5210127c9e6cf5b524a2236fdc2e47f25ca28ebe7fce4208c2feca49ca834f7ccfa568ec48a6d53808d342e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a2ae359442b5a20b054e6e64abedacf

SHA1
4948132b8eda6043ac54598483e9dec17b779b57

SHA256
bf0ec6ee37bedd535c7c6424137dc7dc9c4c0f384a8525b0db92b4086768d7f8

SHA512
56abc8fb9996c696a47b56015d449ec85f61cf7bbbd07fc421525d56a5564010b678b5d049bfaf79a99248e9d6423151fca7179ea2818ddbe2b943f1ccea44e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc944f7bbb24123de70408048e5fd747

SHA1
2535104892fce89ace169c41a71c55b649777a11

SHA256
8fd0cdf448debda0a4995df1159661076ff27860178b72acf6a71814be4ff93d

SHA512
a1851320b0a3a4a335116c2afd4d6f99fa0369f042d370e60f7ca9ff9450db4176fa0fdc744582bf0ea478e46ff45ec25371fd18b5728aaa30b7525eb73fad74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9b720f81c578ee238af6b345002fda

SHA1
3f98f87f343d8e3186922a7223b5baef6258c9cf

SHA256
61a4fb6f0af04f366458f271d09f15116bbb7559ca14da4dfdba8d8ba3345f32

SHA512
4811373a2b2e7cc1e275b9bbba1b230b2c8fe036aced83a4fc9dad0d7e9bbf2cb4a7159bc1858022bca95a8cfecec978595b11714684fa40880e2ac2d3232aee

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2025033020.000\NetworkDiagnostics.0.debugreport.xml

Filesize
64KB

MD5
c29db9ec5f6ab8399754e0baf867d675

SHA1
9bc775c458902296c8e4ebb528f452724a115118

SHA256
8f4a242e0c510facb578add1f85b5b5b07c6ed235641ce4be717b7f37f6b9260

SHA512
cae6a2764d94a8fb9e0dd096aa23806189fc0a8a7057155e43b2f2c9fc6327cf8fd6bb9f3bab97e03366791dd93d60715dc473f6c4a1ea9d80eefa503582476a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\47019726-5f41-4a02-8f79-49bfc9ec5390.tmp

Filesize
362KB

MD5
95e42e437616f04dc804fa2fd4a70307

SHA1
556aa75ab73944b41cc9094319d7bb8aca2c3bb0

SHA256
9556697e17af3cce5d70e23df02ef7a1c09ecea8ac7684f80ca7fa720564222d

SHA512
617ef85362861b14d559eeda0016bad8fbef4cee22148f5051d4ecf19316dfb48b3eb663a17344f1938000851535b7509e79744042cdc7fa28e6712033219a5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1c64ee17-3066-453f-a7a9-4d7de83509f5.tmp

Filesize
6KB

MD5
1f2ab48ef543d0d11b247f8dacd746f1

SHA1
034d28d0ed880d592301aa3e519bcc7ccd51c92c

SHA256
738629e449b1033185969dd00f75f82932c14b9e6bb5aabf875558a8a34e2086

SHA512
d357c4a3d326cd16a476a46801c97a91fc57c8c9a7575caf5e41f9cb612ed4486fa122916b2465b144afcc3c3a7961b8ded5b71022907c1632552d4b9fba6140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
38KB

MD5
b8103746b4757c6332fe545f11de8f70

SHA1
588965d6333eb015af39c7f44ce71dfac67fb0f7

SHA256
4177d563a186175d3a67091c399db6c57fc271e202406e244d4bc8ad95b1aebd

SHA512
c83bd52d674d90752dfffeb76971a4f9684054d6f02cfdbe8f336758ac46d8b430f306cc64be00112b8c38d191afd1b8395d58600b12cefcb6a052ab70214ebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
21KB

MD5
ec0963f084571ccba8609e51d71bf6ec

SHA1
b4a93e1b2e235488747b17c212ae14e5551c2db9

SHA256
39041d7cca3821b6b33037d88740780d6c1b380cf4973f7a869b101d35b015c3

SHA512
88689aab98763297eb045308d3a1c415bcb0dcb58dc5d3f4338e5c92018666a0b0c5bc2cc444ffe333c4b6ea54f0286a4c6310a9e18d418fba83ff2698be5525

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
36KB

MD5
2661bff6dabf18be9bcd62fc612912d2

SHA1
6e90a28a20d59b0383f87355b39f05254bfaff20

SHA256
d8be88da29a93137d4e69bdb3b486f9b48ffd789a4e54bc0200acd8decb1a6ae

SHA512
f210e2c8e29ec830fd6d46e60bf714abc224c5d1465a75395060fa6cecdf4d9b627c1208c40ef4c39e52cc1697c38f22c8f1882b30b3daf7eb4602dfe06efc69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
16KB

MD5
dc491f2e34e1eb5974c0781d49b8cbaf

SHA1
b73ca9b5f9c627d49da4ecbc3455192e4b305a3f

SHA256
f956049f0d96d455a71003eba400cb94f7067bc52620cd05b81006ecfdd438d8

SHA512
5c9bd0d5c93a05ca76eb727328a0fde40f2be7fe53b6b6c9eb260e8f20f92cfc831fd4b46f954d85baf151ae8aba1cdd6f76b0faf96217922cad844c905f3645

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\44d5079ad5841b25_0

Filesize
1KB

MD5
611f0d63f146598fd8f61fbf7add904c

SHA1
f76e51b400b4c5dade520aeb43b31af2c49a2eb2

SHA256
04fadc4cdcc635b2960a7a2e2b747d626683cf0bbbf963b27365820349a6a5c7

SHA512
8f100b3ce2ec4f0161a23b1235b5816d758b4a820f832914d8391201d9e8a25f122cabc11f51e3fc76368355af0d657f491cdd0f7b7099f693fe96404fa346da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
02fd8365c0f3741c70a2302ead3819be

SHA1
a45063d8d54103f962fab9559525891bca1a7168

SHA256
4fd1a7008da42689bf807b8da833b8332f16019e9eb16ee663256c386254b380

SHA512
495e583526d4ee8ab3ad497e66fcddacfbdb51bb626299c2035871e41eed910be1bf08b841780a40700663c1da740749fef173da4b821e29595f74c55f27c81e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd3fc1d86be50d76612920fdc91f3f90

SHA1
415a6cb43a6dbda9620d84760b19092e7efd5420

SHA256
915a744a2864564f9f7b4d19d401d4ea9903ace3f20e6f9532f64ac3e2c31546

SHA512
476572cd8ecd7e71c5544ae3a6175f3ead5e4158737fefe908e6a27c5e5f8c434e7323e040985d2b43836195bcc4d1a619962f0f565ccf7bff1c93d771258bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
619d94b21463694563b01a3b1a72ad74

SHA1
38677d14acf5c49235e788b0cedcd3b6a91cdde4

SHA256
2ad3c9f247256bf1f84d4d04dbb205e1657df9f6e9a4463d030d79fedda1f1ec

SHA512
c27956583f7f07a481e833ae990be166a9595a6768fe34eeb440aea511af171f6cfa06f7738a4a0bfde820d1f326aecab6b77c1b62185334ff58fb6f6b9fa69b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
50defdd1b65b53f630227398c08eaeba

SHA1
59fd4b927780d3e58ed363f8686bdf237339e23d

SHA256
47c706c032bf0a040b63d94b0462ac6b9a61de6cff9529036efef27435973f97

SHA512
1bd60ec70c212ebdb8fd3cf524d1c67bc649759199396bb1597281aa289b94bea93c813e3e784db4fdcdb552457e1713bac4d3db0ac4fb3290bef9627b306a25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a8eb44351597b09cb27a64f985565d31

SHA1
c13fe02afe3d70c2af16a52052f2c66c89936517

SHA256
43e6d1e1c7d78bb5238b83fc16b894ef5db1b80a577d9ba607e3a1485290604b

SHA512
b3d9d5f43d855de49210546929ebb6bf578a1cdfa2df12296e5948077498eb6263830b1f01d1d4a8a6435226d15fa7589e1aecbe9e865d041883769fb6eaf365

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ab81a721ff0260bc6b7b45dded7b64d6

SHA1
d205fb11d51aec2063dbbc2163619e2e47cedeb4

SHA256
c4d902bbbf45474a6984b2dffa34f19916d84afe6d6be7856c1af6924522fc5e

SHA512
64e961f212f0c699cb4433bddb7ee469412963890f53690f3e9b35e9aaba722363af932c1e275e636f8ebce09a5e244c2cd1dabdf8326ae3d7f48118c84db761

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
82e9ce304e985aa54822b389f2fb6068

SHA1
2bedf6c0285577a0a380591ea2bdfee9ba5f5a3c

SHA256
27def0a77696a083a764b39383f45038f6440a54406dac3d09514e9a0fe71eea

SHA512
fe3fe3d35d25bd7e4bef2eb08004125699f97fa4526f5f4dd8603c64459a859784e1d4bdfafa882826aca457659da48ad91952488a1be0ee326fd17d95117544

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1014B

MD5
007abeebf152b5cdb7bb6fe04762ea26

SHA1
570e2d4c6beda25e0e5d8da09e88b709441fb03d

SHA256
9d3b7c723eceb24dbb405bb6bbcc078d555560ff59e95a903bccd33eaa2dcf54

SHA512
90c2f5b6991e41f78b5e9d59e041adb33e64dfb6fb89e041cc4a7a99092a89f1ac74161752ad7496a8388a2f719306a8aacbfe587813173ded3e67edfc2d3629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
9c098cbe13937a53eb3b2f7657c87cdb

SHA1
c0e09fadb1e208851a6ce824834d47847fe04c20

SHA256
dc4ddbfa61473f778c10c2f0fb71fc7a50894eb2a88ede3caf73a6a6542da775

SHA512
dadcb56622e353195e91b0f2a40bcb8a6bed3be651542c5cf57ecaa8f826f378abd6b83ebc1e14e725e5d05ef7cd9f0c38281e700758940514d231192163b755

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
800d3a172b6aa53a3f3cfed8827d44d0

SHA1
61c2d045bbc4337d2fbf7b9f5cfdef4a3ca1b6c1

SHA256
45c3318763e7cc86b227241903ce23ddf6f04e743aa257de7d6540748e247779

SHA512
62ee409db644db22c915b0863f66fe786b637b88d68ae355ed1f7d5bf9c92d3bae6a884b6a36c7409f22e6d1ddbfc941ecc72d929ca309c4dbc70f4fc4ca8939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3ae3efb8a6a4315a77f4074ecf954099

SHA1
3d978e86f8925c8fd666fa4fab5977dbab7c66a6

SHA256
9ccff4226abde5fa6b0d4f06c55cb5f43f91c4741b583809796658b42daff2c6

SHA512
eb7f26b7ba6010eb23d25e22e0c46a45d5c894e81daa6c155936afa8f718e0b9a0ab5a7d797b68c240c1ffb94bd4a0d1518647d4f9ca9159fa6a55d9075973ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9a918f6944b5834c82540d9e01f8fa57

SHA1
d4c170c9d68faa7840e86d4985d0f0fedd1be518

SHA256
25ddbdcc4aaa4336cb6072f1922fdd9d7d96ffcb484cd34e78b822a3f32f1b9f

SHA512
4aef7dfed259019a48670eeddc9e33583dc1f04b3e1436008ba7d9bb006b747a438638f4db06d560f97eceb84120d8395d10c6c4a92991f91b3b5b874f98b1e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
4167722dc9a3a950be6287e0053ce012

SHA1
112568695f92ff2566101e351b4c1b8146fe4329

SHA256
0ae48cb602d4633322ddb37633aebaca4a9dd7cd6c60c0ce2edb23f163145c2e

SHA512
9e63a8e28de0ecf2d3a243070e30435a5302495239e7ab57cfaa7a5218a67ed9cf5ef7c9399411ff3661d407e1c7df45e65e220ccab5aa4b174327e5db92803b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
378KB

MD5
a90d38d73046d4fb01c54a3a6a3286df

SHA1
85cd34c686f2e1b1514424a63100a71a95892b2e

SHA256
d5b216d7aec746d79d40a836679c275d646e7e549f4c9478148324d1c0c4caff

SHA512
cad732c2e17982bf3d4771f7ce491d3d95618a12a075301263cc043540e6ae6f601e4d506a2b279c76317672930b54df0fd623a714ccd4be1900a41e2d58c800

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
74KB

MD5
02ff4c9e24b0a67b521e9bf561f65d12

SHA1
b71820eed009354b74d8942a047a1031e9c77de8

SHA256
e38715c0d6173e79e427ceafae42f62105e9ed8d89e5eb8cf3c81087d3af2ffe

SHA512
ae6af3fc9632d2ecd1fe5c6934c9a4efbc9392d5297cd23268b945482b2914f3273288264bc6d4ed1e48766e1bea602dbbc6da57e2c3a3106ac1131df88eecd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{66D13931-0DA5-11F0-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
167903b186c9575b0f4f7f1ac0e9d819

SHA1
ce7939656a45d830c579af1e301aae121777712a

SHA256
6b6fa6caa899f256c9751465457ff464967e10d529f062ed0e7ae05f1c85a6f8

SHA512
f957893b400221cfd8049818800ec96a7210e2d308f132924d4a6f323c00ad70da6a6c2593c0381858ea7ac7e491dc4562e14f0c3b9bf8dce0653dcdf3b4df25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{768A00F1-0DA5-11F0-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
737b279f37728a98c76cf7540a4992cf

SHA1
98c8ab62eaa41c6bde25e8ccd4a09af8b4f4366e

SHA256
1d78e180eefeabb95910e95a42be30ca2ed51eebd37a7baed7cd3cf5015faa94

SHA512
8cb645addbd442beaf92b70752ae2dec24d0dfe63866f77e2549f140397c94d1185b5889b055217f70c89b7abfaa71ae8b6e2bd643c435813612769af1147480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{C98F8537-6BD4-4619-8D5D-586BFB1473A7}.jpg

Filesize
22KB

MD5
35e787587cd3fa8ed360036c9fca3df2

SHA1
84c76a25c6fe336f6559c033917a4c327279886d

SHA256
98c49a68ee578e10947209ebc17c0ad188ed39c7d0c91a2b505f317259c0c9b2

SHA512
aeec3eed5a52670f4cc35935005bb04bb435964a1975e489b8e101adfbce278142fd1a6c475860b7ccb414afe5e24613361a66d92f457937de9b21a7a112e1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{EAFF8907-3C6E-4B6B-AE69-1CCF43151382}.jpg

Filesize
23KB

MD5
fd5fd28e41676618aac733b243ad54db

SHA1
b2d69ad6a2e22c30ef1806ac4f990790c3b44763

SHA256
a26544648ef8ceffad6c789a3677031be3c515918627d7c8f8e0587d3033c431

SHA512
4c32623796679be7066b719f231d08d24341784ecfd5d6461e8140379f5b394216e446865df56e05b5f1e36962c9d34d2b5041275366aeabcd606f4536217fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6329.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDF5C91.tmp

Filesize
3KB

MD5
c35e1f9f3fba8bf84b8407b707eabafc

SHA1
a598816084f1346640e7999540477715e77e4f5b

SHA256
4cea0dd4ecde99a440d27598465e93053286798120cb645c54062b6184271d96

SHA512
35999f4062927c9d524aa2f797e77789485f0c5d4f38d0b8cd093ccbfa7e64c15f23cf155eb1f1740be66490353e7beb3691308867b40cd215950607e00cf8db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6468.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF35B91C2A230C9EAC.TMP

Filesize
16KB

MD5
c3e3f62a850ef5666f11910e36220590

SHA1
6985d390ff7d42ef9619ac84697d7637e02f6948

SHA256
bc5198638178bf141ee676646ac0ba65d1dc36e870e71250f85cf78001eb273f

SHA512
5f6ea62b689cbdb6554a0dedad8a3b148004a6bc1d7ecc5ad4756855646743a63fd962b7519051c383f865585cd24fac870a4ee5128765ebf1052a858bf5eece

Download Submit
C:\Windows\TEMP\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\NetworkDiagnosticsTroubleshoot.ps1

Filesize
23KB

MD5
1d192ce36953dbb7dc7ee0d04c57ad8d

SHA1
7008e759cb47bf74a4ea4cd911de158ef00ace84

SHA256
935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

SHA512
e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

Download Submit
C:\Windows\TEMP\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\UtilityFunctions.ps1

Filesize
52KB

MD5
2f7c3db0c268cf1cf506fe6e8aecb8a0

SHA1
fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

SHA256
886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

SHA512
322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

Download Submit
C:\Windows\TEMP\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\en-US\LocalizationData.psd1

Filesize
5KB

MD5
dc9be0fdf9a4e01693cfb7d8a0d49054

SHA1
74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

SHA256
944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

SHA512
92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

Download Submit
C:\Windows\Temp\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\DiagPackage.dll

Filesize
478KB

MD5
4dae3266ab0bdb38766836008bf2c408

SHA1
1748737e777752491b2a147b7e5360eda4276364

SHA256
d2ff079b3f9a577f22856d1be0217376f140fcf156e3adf27ebe6149c9fd225a

SHA512
91fb8abd1832d785cd5a20da42c5143cd87a8ef49196c06cfb57a7a8de607f39543e8a36be9207842a992769b1c3c55d557519e59063f1f263b499f01887b01b

Download Submit
C:\Windows\Temp\SDIAG_d0ca91a3-6124-47b6-a530-e3cb01f4ae23\en-US\DiagPackage.dll.mui

Filesize
13KB

MD5
1ccc67c44ae56a3b45cc256374e75ee1

SHA1
bbfc04c4b0220ae38fa3f3e2ea52b7370436ed1f

SHA256
030191d10ffb98cecd3f09ebdc606c768aaf566872f718303592fff06ba51367

SHA512
b67241f4ad582e50a32f0ecf53c11796aef9e5b125c4be02511e310b85bdfa3796579bbf3f0c8fe5f106a5591ec85e66d89e062b792ea38ca29cb3b03802f6c6

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request