7dcca932203d9702181967ceff44d028f225bb21c95c94b71379ece65f9a6313

Resubmissions

11/05/2026, 02:49

260511-da5b7sdy2m6

11/05/2026, 02:48

260511-dahs7sdx8m6

Analysis

user interaction
yes
max time kernel
39s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
screen_1776567853224.mp4
Size 9.5MB
Sample260511-dahs7sdx8m
SHA256 7dcca932203d9702181967ceff44d028f225bb21c95c94b71379ece65f9a6313
MD5 73d63993e6b8359f20a6e88c25c2edca
SHA1 2325e28e8c5d05c2cd47e49ee92e2ca959338b1c
SHA512 e5d5fe5392dc84975e589deaf4e1af8887a9f24e9d51c9e3f962b34c2f0b9dc0fc4cc6992b6323a20d0f15073e94f2919c40984ba1a67577f508df2282a851c0
SSDEEP 196608:CbC/NLZExWiEJCKrDIhGnaHxfxAP7BO4vi8FIqw3yPZ9dOQNq6Qxf:WMFZQACOKDdxAjBzvijeZ9dpq6Qxf
TLSH
T162A633DF2728DE1FFA158E33A19B3319B1F1D2581974A3CF9B7907928AA17867CE4104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2584	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229413148244890"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{1C4391C5-E54C-4914-BADC-9AC9AD58509C}	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4472	wmplayer.exe
Token: SeCreatePagefilePrivilege	4472	wmplayer.exe
Token: SeShutdownPrivilege	4668	unregmp2.exe
Token: SeCreatePagefilePrivilege	4668	unregmp2.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4472	wmplayer.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2492	4472	wmplayer.exe	85
PID 2492 wrote to memory of 4668	2492	unregmp2.exe	86
PID 4924 wrote to memory of 1620	4924	chrome.exe	92
PID 4924 wrote to memory of 2584	4924	chrome.exe	94
PID 4924 wrote to memory of 4176	4924	chrome.exe	95
PID 4924 wrote to memory of 3176	4924	chrome.exe	96
PID 4924 wrote to memory of 4176	4924	chrome.exe	95
PID 4924 wrote to memory of 3176	4924	chrome.exe	96
PID 4924 wrote to memory of 4952	4924	chrome.exe	98
PID 4924 wrote to memory of 4952	4924	chrome.exe	98
PID 4924 wrote to memory of 1716	4924	chrome.exe	97
PID 4924 wrote to memory of 1716	4924	chrome.exe	97
PID 4924 wrote to memory of 2948	4924	chrome.exe	99
PID 4924 wrote to memory of 2948	4924	chrome.exe	99
PID 4924 wrote to memory of 4436	4924	chrome.exe	101
PID 4924 wrote to memory of 4436	4924	chrome.exe	101
PID 4924 wrote to memory of 4288	4924	chrome.exe	102
PID 4924 wrote to memory of 4288	4924	chrome.exe	102
PID 4924 wrote to memory of 3660	4924	chrome.exe	103
PID 4924 wrote to memory of 2476	4924	chrome.exe	108
PID 4924 wrote to memory of 2476	4924	chrome.exe	108
PID 4924 wrote to memory of 1828	4924	chrome.exe	124
PID 4924 wrote to memory of 1828	4924	chrome.exe	124
PID 4924 wrote to memory of 2904	4924	chrome.exe	125
PID 4924 wrote to memory of 4916	4924	chrome.exe	126
PID 4924 wrote to memory of 4540	4924	chrome.exe	127

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\screen_1776567853224.mp4"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe93b9c728,0x7ffe93b9c734,0x7ffe93b9c740
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,15202496866779314722,11202390697880139457,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2644 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,15812071488534067400,16031290305916716004,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13574285151340226609,11541861581310224056,262144 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1539749958372718309,11627410417469315738,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,13674918030069113012,8859952784278320986,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,13339258659613205870,17609502667078189427,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,12746470500607083018,3927080906926445177,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5504,i,8563199931141654970,533656469899138297,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,8558913136561825257,13104508348752903399,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3268,i,14739969284117953454,4180177979934111818,2097152 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,152991625742997227,6279571022425188810,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,13739690309119912994,8163908935951961243,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,17242303952550024941,14813338778292320024,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,8877080671791065690,1703640007130704321,524288 --field-trial-handle=2204,i,15758753086798313686,14579863814137972292,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ceaecab3777baf3d23e8ba17f9c500c5d3099464055cacf815a2e1f51559907b
MD5 3c56d9df3bba650116479a22c1b24a18
SHA1 f6852d04248480246d3c654db4d33e165f82c40a
SHA512 1b69d6a48c7a190227e5bfaa3db7efb4195671415118fa510ac9b1f46ac6db57cd9e6db907ad4ac6530b0103fe3778f2ea90138d0cc06cb00858816a08a5bdb4
TLSH
T184E02B96D955EC3708FE6B1C61691742FB0143162F40854F3A3CE20D8FB0636524AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 79a755ca5d9b56cd9df59f921b6f2eb8a09aead0771fd3eeb1f055addea47d0b
MD5 bf1414a0001dcb4f090075ab36e0f0e5
SHA1 f96be1f31960924a3cc64c1c6471eebe09a980e7
SHA512 e72d298401c413f0484e1d723bd5e7790c225406321d2feee5cf59d2d0d91c11df438f4340ca03aff9b6b95f43cf080f352e872d2e09568dc0a9b14cd04a469f
SSDEEP 192:cR2xcBzb/2ptqiG6Nv7ZpIpAPRp2NVIgX9wHsb+WNpXLB4L52e2Oywrw8l2ZshAx:cR2xmzD8w+EUXSOwjK2eCAx2Sn5MC8
TLSH
T17A52C76EB914693B5CDBC32AF9217B27D7F5102165942E84E6FCCA2C28E75CC711780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7085bd26a00ea25f436317507845db76624f1e305c5ea5c1633f0710fb2525e9
MD5 6fedf8e0cda28604a18bc21b3b3a9b01
SHA1 6e736322a4f9228617a8d1dccd80d010032b80ff
SHA512 7c43690cde2a8678a5465e416e0cead981d993013a68eccf60d0f0f8520df5a31229546fee29023f6dada5f06f5e8901b2628e5ccb2a58fa5dcaf82771739eca
SSDEEP 384:UO62joO6z7KxkXqKf/pUZNCgVLH2HfgslBr7pLuLcifKO6/XODoO6P+ErU3f6HGy:UO62oO6z7KxkXqKf/pUZNCgVLH2Hfgsr
TLSH
T18972E9676C4C9E770F94CACCD816BE4FADB5010B65D9886843FA982903D4BDB11462FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6c7219f2aa4ccba65b86c98ccb426a5a5e1a792d266b403f3c3ec902f8697a9e
MD5 30194fcf83401a5c59e62aa2da73ee96
SHA1 b2f0c92d0e06a50bb6bff2b78846a4ba511075ae
SHA512 8b74aa085e9c13110e5eded1f37501e698effbad42a490dcc2f2e2043c2a1f3b031acd9bf6a1a699d9fa94d47aeffb982db23cd71e3e83045711ef21ae6eefdb
TLSH
T11CB012A080815592C02302F41582448831189F20C706230553E07A71AC261D08027251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58755a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58755a.TMP
Size 96B
SHA256 bd5cf6d874001073492fb498c3086294463bcb1ca8b2725c32b64811fb25f1cc
MD5 68ae60189212e9699bb8e271bea4f0e1
SHA1 c6c4077041a812531acea7f845eb02220451caaf
SHA512 55cb95fe7fd3f7a8e2cd3a2c51c3f02b60f24ec1a26be3c1302712f23ebfc2dc07bbd96b11d2d8134a12ae6c3aca6c48be243b59569d4b9252eb353072be477e
TLSH
T197B00255C1526616C08623B82A999EE8BD61EF25C703231B92F03A6BDD35A70C52A5B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5d428daf706fb77283b16d2ff1d0a2dc68690e9076756c00f05ce5950f4edfed
MD5 9334c697d247dfdf037c513ae328835a
SHA1 a60aa04ed03c139593a0ec7f62990f465afe436f
SHA512 3f15f42d3ade3a9443cb1ca9a944fad0597c97c808bd562bb0f440a5a756c4c98e99baae381126db623f3de02b0a05c35356b73801606b55933ee60f3881c39c
TLSH
T1D0A0026193845101C206327365C163583F1058516113124744A20389E9601404B23042
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 159291783c4b06dcaaf8fe5517c1d659c9e39fe2d35765b401d8a1f82668b36f
MD5 f9a96de275940496ead37b1e71e2a029
SHA1 88be1640b4f737b3d740fa9c0cc7a93c9fefb3bc
SHA512 4c416c2e9bdd2785327ac148586a8f8a66363da5a2ce28a9b1a13465174fd76caf5270dc5da55b702f7c7d5040a23d6686d607b226d03b7cd31af26389a2cb9e
SSDEEP 1536:YQcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3u:n3Qw/xLANk0mUW5GmRntSFCjEEN4
TLSH
T1CF9302BA9E174AEB957D4A8176AE7909CE12230D70AFA9CC315C538C31D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 f1d29c710afc8b8f5679894fec63bea0ccbeb56493678f61a657ac8912a3bca1
MD5 cb05f55450842049abfef5e28e12fa1b
SHA1 856d2ea959b57ae015f61d3a60c5eb1112e02ce9
SHA512 9befbfa096a2900c865f2fe8dcfd256bf3ef1b7c94c3bc0e7a376ab668460cc14fe5b16610fff2d86fbf333cd86895d9335f4b1dcbcfa0fa27801c2a64920a9d
SSDEEP 3072:ZhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/73Qw/xLANk0mUW5GmRntSFCjEEN5:Z6OgB2HWv3G8YnOnDrOk0HOGm/SFyEEv
TLSH
T14F1412264A259DF5113DA2C1B12F3D41CE11665AE4DFB8C9B2A5338E52D43483F8BF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f6cfe110fe7117c4a0155bcaecc7bd8e06fc074c15edfdb4966dc5fe44710c50
MD5 490fe6fd28f29f6d9548b66ff7539a7d
SHA1 6cec181334fd9f484d8468b2159123d0ef75a765
SHA512 a4eb2bd5654d5e6bb088f52f3a07fe15eac87961826e46464dd775e2d33d3247cbbd58d96fd650289e0cf1149eb6ff6afb43c0cb5deb5d31c5974a5816ea71ec
SSDEEP 6:nu+1E3+e9XplsknAxtg53kTRUrydRKHkI10cAe:nf1E3+e9XwknArgiiGdRKR0
TLSH
T1EC535E18EB64C2A1C815867AE08B1746B321B47A4A2FEB16612C257E1C422992950185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 785d945e451a9941ba7fa5ea76454d6c65ed53d146cc241261fef1b643807149
MD5 66c170c80fe77736dfbf7efdeb89482e
SHA1 77cd8dd011bd7bd8f23c434beae1f9d08c129132
SHA512 353cfead69dab2042f54f92a3ae3eef14ea25272a75f8346c855e0e292f0ed5a567dc82d056dadc704bb089b5a111ce82bae03b35da6aacce26f3dc101b623f4
SSDEEP 768:i0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaY:MZP2tFP3vqY8TqEMdXTaBacg
TLSH
T1C9257437D190B0C5CF2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 63627a899e6b360565797bddaaf8389dcb924f459a327c0dc1bd7354b0be7916
MD5 cd51d3683e57312506804bcadeb7e327
SHA1 5e057b9ff8a0838cecc0184f13dcd9530bcafb00
SHA512 e0c736c9ce4f3235415bf6f17f38e79db309b64788ab272591a87c271dcc3c45bf8d301b3fa3c08f9cf0c4ba23de4635781ac7c17f7574a77f850fce10098382
TLSH
T115216B671B4ED470C9E01BE71DED8E2573B7C7CA87A0D0A5B34D9039480252D5B3E06D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4472-39-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-91-0x0000000004230000-0x0000000004238000-memory.dmp

Download

memory/4472-48-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-53-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-52-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-55-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-54-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-51-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-50-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-49-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-47-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-45-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-44-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-46-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-90-0x00000000027E0000-0x00000000027F9000-memory.dmp

Download

memory/4472-40-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-41-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-42-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-43-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-38-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/4472-271-0x00000000027E0000-0x00000000027F9000-memory.dmp

Download

memory/4472-36-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-37-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-34-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-35-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-30-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download

memory/4472-31-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

Download