f01770d717241fd216a29af5a3db402f4dd276f3c2d6c7d32ec814c4a842f81f

Analysis

user interaction
yes
max time kernel
899s
max time network
884s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
извинения.mp3
Size 1.1MB
Sample260730-w71z6avfle
SHA256 f01770d717241fd216a29af5a3db402f4dd276f3c2d6c7d32ec814c4a842f81f
MD5 6ce394a1718fe4a64073f890ad94076c
SHA1 cff27cecbb7cd0f3ea3af262700e948ad27e6a5b
SHA512 a6622393656024c17d151e054fda5908d4b5d77ee214626e235987333832d0077903cbbde2b5e7a23bba155f18502abe251180b8dcf99ad392bfaa7909ca1957
SSDEEP 24576:46c4k8zv6oAWh6Qxpr+bvUnI2m6IbCh1tFrT1Ws7hZctW8etLJg:xdkP4r+bvU7NgCZFv1NoLKJg
TLSH
T1853533AA9708095FF1AF5F71B5974335F4054C8BA268D0D5F220FB84B63F2D147A8AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
66	discord.com
67	discord.com

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
65	api.ipify.org
63	api.ipify.org
64	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	2032	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299101090188931"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{90F6D8EC-0140-43DF-9E41-35D5B810B96A}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
3892	chrome.exe
3892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2032	wmplayer.exe
Token: SeCreatePagefilePrivilege	2032	wmplayer.exe
Token: SeShutdownPrivilege	2912	unregmp2.exe
Token: SeCreatePagefilePrivilege	2912	unregmp2.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2032	wmplayer.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4636	2032	wmplayer.exe	84
PID 4636 wrote to memory of 2912	4636	unregmp2.exe	85
PID 1604 wrote to memory of 4284	1604	chrome.exe	101
PID 1604 wrote to memory of 4676	1604	chrome.exe	102
PID 1604 wrote to memory of 2996	1604	chrome.exe	103
PID 1604 wrote to memory of 4676	1604	chrome.exe	102
PID 1604 wrote to memory of 3424	1604	chrome.exe	105
PID 1604 wrote to memory of 3424	1604	chrome.exe	105
PID 1604 wrote to memory of 5016	1604	chrome.exe	106
PID 1604 wrote to memory of 5016	1604	chrome.exe	106
PID 1604 wrote to memory of 2160	1604	chrome.exe	107
PID 1604 wrote to memory of 2160	1604	chrome.exe	107
PID 1604 wrote to memory of 2748	1604	chrome.exe	108
PID 1604 wrote to memory of 2748	1604	chrome.exe	108
PID 1604 wrote to memory of 4288	1604	chrome.exe	109
PID 1604 wrote to memory of 4288	1604	chrome.exe	109
PID 1604 wrote to memory of 3916	1604	chrome.exe	111
PID 1604 wrote to memory of 3308	1604	chrome.exe	119
PID 1604 wrote to memory of 3308	1604	chrome.exe	119
PID 1604 wrote to memory of 2268	1604	chrome.exe	120
PID 1604 wrote to memory of 2268	1604	chrome.exe	120
PID 1604 wrote to memory of 4016	1604	chrome.exe	121
PID 1604 wrote to memory of 1908	1604	chrome.exe	122
PID 1604 wrote to memory of 4040	1604	chrome.exe	123
PID 1604 wrote to memory of 1752	1604	chrome.exe	124
PID 1604 wrote to memory of 1752	1604	chrome.exe	124
PID 1604 wrote to memory of 3892	1604	chrome.exe	126
PID 1604 wrote to memory of 4304	1604	chrome.exe	127
PID 1604 wrote to memory of 4304	1604	chrome.exe	127

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\извинения.mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 2296
  2⤵
  - Program crash
  PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86fa6c728,0x7ff86fa6c734,0x7ff86fa6c740
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,13333817791997417755,13374678010419024588,262144 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,2218159016912960316,401831123388769178,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9578028030895161426,12397872097567115832,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,6927683201516695543,7250576306191841400,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2707189897345861915,11895736277158616083,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,4188300927557294302,18192859095214265708,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,15612876918018021999,851556253244247162,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8683971220604059265,1171931182714042262,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5892,i,2027672311580237349,1612778836931451513,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4880,i,1598893347538827351,5952608865958144814,2097152 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,7399096480077797735,1020989667932914286,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,4398129467910821315,7206664714552927704,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,4184541019873184970,640029495637566675,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,3963819217658642831,5144798664175416183,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3276,i,11308559103432140235,6353870156229389824,262144 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,12618364459155097866,10780389074706847426,524288 --field-trial-handle=1980,i,16860793904617243398,10931499653098195782,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:4304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2032 -ip 2032
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 25852bc2f050661c51d16462f1fd91982294de272de66851283eb38801fb98fa
MD5 21faa21d7aa39001164ad40ad10fb33b
SHA1 89116db64fe3389848a06a8f3e819253155635da
SHA512 60ef5c29da5d27cc79af4c0979076af316111885951a50f08bf72d44a45cdc77e379fd286dc53ada20ddcf2a18abaf47468cbee62f6683f7072aecabe067ab89
TLSH
T129E02BA9C962AC371CFC172864658706E651231B67409D1F373D510C4FB577A8686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e7f96fc753b5c27194e6b54a750c23a198fd8f03f7ec44727cfec066fc8cbda4
MD5 891d963daf4d0609cbdf8d31e4f7ee91
SHA1 fe82084183c4486b905240b5d3b3a2734d4b7f5c
SHA512 ef622773a397d4937eb3d2219a46ce61add68396977684fdd741b3496baedf3c403f698dafe9cd7a7581aa0cb6d62cc3fb19cb82a8c13241505ada473e1420af
SSDEEP 48:YALlqhq1hrtiptiPafo7XLsaV1gmzsT4sVTfsjosX7tUzt9sY/t9sl/t6ss+s6g1:DG0Nt8twaajDIlmH7tUztFtet+82X
TLSH
T16691ABF3C3E8866DC94196F4EB257E1FDE6A0964031C3C56C8D9AE0F53E2972E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5df6f53fbea3c5c5502f8b97d7d3284acc5bbfc6ba0d05abffa9d57e23421293
MD5 7d221f9684aee037728b8dae92f6d57b
SHA1 9391c39aa225bef9069f1ba4f90ee5568f0253fd
SHA512 3b79e980d3846889455ec3d043e5ca11dff86f1c6d5cbfbecd39e038b194fbce3ab368857a466e23dff5437adc8e43c2c06ebc21f63cc59c99c2c29d5268060c
TLSH
T11C71AAF3C3E8866DC95196F4EB157E1FDE6A0964031C3C1688D9AE0F53E2972D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c7c26dd88238707b3ad99cc95f594d68e920587aa52d5a6eb50c25b889e95bd5
MD5 83b64a3c45b14cc288520608f5914a40
SHA1 76ee13da4b3f881c10cf12cddfd1d42be74c0fe5
SHA512 93782784c20dbea74a22659be858fc288e7617452d1668d4b691564d7a78437f9b8a84a3ad08abb15e90a61ba3a67b6298c97ce21223897b678cddbd7cd92403
SSDEEP 96:DG0Nt8tENaajDIlmH7tUwtet6Iw1jhntpK:DG0Nt8tENaajDIlmH7tBtet6T1jhntpK
TLSH
T1F4A1BCF3C3E8866DC94196F4EB257E1FDE290964432C3C56C8D5AE4F93E1972D20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 84f9477e723977fcf2943d4b3bebb3836c6ad834cf3efa8654eb597adb1d98f1
MD5 645d2cb2c4ba078edba1670f442877a2
SHA1 1a30dc1e3ebd810244abd0855591ed082f8ba490
SHA512 7f05692279f1ee6499eeb04604c99527de27ace257574be7f4e7e33b413dad74e06c0a0a723c22831418f922c1b24077610dabfa1d493c410f547382791ad464
SSDEEP 96:D0uwtPt6QlaajDIlEd7tUztetL1jhntW2K:D0uwtPt6QlaajDIlEd7tatetL1jhntW9
TLSH
T173919DF783E4866DC91196F0DB257E1FDE690524032C3C6688D4AE4F93E2972D24178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c6f65a505c515d65f558b2c92fa4fab1e566f3645a5e60a85662173a8de24559
MD5 7b07635150c548c4e606dc6592fee2c2
SHA1 12af1738e24142e803ef2a286b7320385469f86f
SHA512 7202de3977d61976b760de277a0b07ce7b744e8820d1500820759fca3917bb5c34344b668b718616723b0aec75c33f1a6580615ccd5c4a894b1d9659886d840f
SSDEEP 96:D0uwtPt61laajDIlEd7tUztetvw1jhnterX:D0uwtPt61laajDIlEd7tatet41jhnteb
TLSH
T1FB91ADF783E4866DC91196F0DB257E1FDE690524032C3C6688D4AE4B93E2972D24178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 b1c5912629e6da411873a5ca466d1621f3b7eafa3ff0736d9208327b1dc1ac94
MD5 57529960757db4637f81df117a4d3fca
SHA1 e1112ce016600d90b743ab1bec876b7c3a8539da
SHA512 725aeacf749312e46b4e6af8fec08f759502ae40e6fbd488655bb8d960f207e25dce6367c0f834cfe9b8c1faa4155cfdc6a99fdbc5be7150106c647b0e9cdb81
TLSH
T11011AB63A77EB027407909BF1D04BC0918B5B835124298F9DA9FC5ACF0D55B31B22823
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e84bd9fdd2535e60974c22aaa05b7ba6c9d4a009da789f12d7ff70775779a974
MD5 52d6957f2080a08db7d4909d602e85f0
SHA1 9aaf5388c3dcda5149ef7e233cd390f25254ad68
SHA512 7e58f1fdc9b7043041328d63c0ea88ab829fb91e0f4a0d5b23a1e3cad89a409b0688a650264ee86540bb625322d81422a2707512fccd3a9c41e354ff542352b5
SSDEEP 192:dRgfPnPBZMe+v7MF+hAPRp2929HHsb+WNnWEW/dWUw2u0kwUwVyIsnAUgraJ:dRgff5n6go8Xr1wZAW52u0de
TLSH
T1EB52B42EA911297B6CCAC229FD127B57E7F6103672941E80EAFC8A2C15E76CD2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 116c92066b44ee7c5f91b6055c44681f9f8013c1c2af517571b20e4d6923163c
MD5 c932cad1c5bda34d77ffa11d9043719d
SHA1 9135f3c048dce65e71cdb2837f7f39a4cb155339
SHA512 bb90f36cf0cc72cdaf512d895c5c05506e53cd2b0c085c5d4e395f6b3eed388d389e056ba2e3f3d19e57f8456cd7ef83a39ff1de6094fc74b5db2375237122d6
SSDEEP 192:dRgfPnPBZM/Yv7MF+hAPRp29D9HHsb+WNnWEWi42Jw2u0kwUwVyIsnAUgraJ:dRgff5iEgo8XW1wZw2q2u0de
TLSH
T1FE52A52EA911297B6CCAC22AFD127B53E7F6103271941E80EAFC8A2C15E76CD2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f8430c2689aad4850753c4371964e31737b9d17e4a3ffe8741ed8fabe27abd4
MD5 5d1e0764fe4ce8288082b0b13d4af94b
SHA1 2a31d39c90baa494e53b60fd873e74b43e70b8e1
SHA512 84376f33299b05190bab4b716a13a3981a652af2e5fae76e06aace274562d99515aeff514fc487534cf7bab8c4ab0a6baab1e1306c602db2dbb82d7bfad7cbd1
SSDEEP 192:dRgfPnPBZMmTv7MF+pAPRp2S9HHsb+WNnWE0dw2u0kwUfVyIsnAUgtaJ:dRgff5hrgoUX91wZ0e2u048
TLSH
T18942B62EAD11697B6CCAC229FD127B53D7F6103271942E84EAFC8A2C15E76CD231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 94db35f25fde3be866769bcd91ffd07ef308a71124616493b6bcf5ccb03f71e2
MD5 0d335f83c2ba2e0703a89c6e86e4e6fa
SHA1 4a96d1f98fd1f35710ce836780ac7ddf0a6c56fd
SHA512 b50bb14437d34a1342de27ce28e846e0fe69302515996807bc5354daff21c47bfe963924000bf7337201dbc7af6840034c315006a8a947fb45e607cf370a8535
SSDEEP 192:dRgfPnPBZMebv7MF+hQPRpm929HHsb+WNnWEW/dWNw2u0kwU6VyIsnAUgraJ:dRgff5njgooXb1wZAWO2u0Je
TLSH
T16452C42EA911297B6CCAC629FD127B57E3F2103262901E44EAFC8B2C15E76CD2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2af8c42b5ff91131efef751f587ceaec6305d1c7d6e5c7ba54609aa77dd83e6e
MD5 ada3f7829bdb87aadfbe9095e4e12f99
SHA1 6473ce7996f5f8b6aac1c9c6c9a93e47cbd258e7
SHA512 445a5b36823b384de87873b88fffa176310cbd731ff2a5e363e5484540dd37ad33c91a036b773aa334d5cd8df75833679b10bd0309ef07ad0bb48c1932dc8687
SSDEEP 192:dRgf1nPBZMebv7MF+hQPRpm9z9HHsb+WNnWEWPkYNw2u0kwU6VyIsnAUgraJ:dRgfx5XjgooXS1wZJYO2u0Je
TLSH
T15F52D52EA910297B6CCBC62AFD127B53D3F2103662901E84EAFC8B2C15E76CD2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f7095aa86f9f38590d268aabae2d0fbc0d811adef508b697642b84c26359c76d
MD5 16ca1943cf3aeab76abb2d8e5e15cef1
SHA1 f93aca8710abf14e111ff4cdf31e0ac03505d9d9
SHA512 e2a4689d131f3239145529b2f5d423d38ad4d2575897f982de59551e9c7b60977d06797e3b699c06491172829f16a26dec83ead898bde724b89e900a51011d10
TLSH
T1FEB00265D1836312C44317F025D9EAD8B1A4DF25D6132A1292E02AB6DC6D7798625170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4bf404b269e2d90b916ebee8140efc9eb5daa49bf08fd1b98836b9db79428d05
MD5 9d5bdabb54dcc1a94ee71245d1b46620
SHA1 df352673dd43ea40baa19a76852eff94bd65565e
SHA512 5962d2d688ff334948b64aaf3bfb7e99d1bc5d959b6af1c8e323833aa3bb71f1ceae2badfac639d2993773e636a90390fb762aec853d564b2b8aac99d35eaafa
TLSH
T1ACB0120080025152C84206B02143249871145F20E71A170153E46932C825662D12D051
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 1d3e3a1613159baf9932c1a804d4758a4d531fbb4978f174fd42d0250a1d760f
MD5 6582d9614aa2f535bd83f283fb1adb2e
SHA1 44d3f95fcf398998ff8e201db75764867931fbbc
SHA512 637437f47fd039cd571e84de937b277496ddc59f130ac03badd4a48e2271f2be3780ce7e2219fe11b38ba8aa8ac22255667d2ee91934cb07fafd5a8e12c75c5d
SSDEEP 6144:yfYuZ3V/mDy4irM4HqH9m7Rkm1tYpBeh2BAoq:ywubmaYDHU9oBGcAoq
TLSH
T18E3413765E385DB65D999F1E308E0B2E0FF25F67C875B8E184C95708239ECC81E86D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ad235fb1056348565c96793a904004950109144f273ddb0a754ef306efb059ff
MD5 aef0c7f730090f1e347f585ba38056a3
SHA1 6d33643302012ace9a967100e3e31dcc7886bb40
SHA512 be46637ab8ce2999b73b57025125229506f9f526fb0a666c6f2403454beff0844a60436595bf4f04e8d564c86329f11601453c3be528d29929d19aaa6b9f4a10
SSDEEP 3072:/NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Em7Rkm1tYpBeh2BAoM
TLSH
T10AC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 cf62d93d55e056d3727ffbe3621c8e33b521dc5206ee7312302bbb8503e31509
MD5 7f727335752191914c8421064826d7c9
SHA1 8cc74b30c1b19f6c5c4ad8d338fbd2179d2e2cc1
SHA512 23d5f4b28223ffbadb33e39f9dc8d5cec837a468ffd821d616faf445998eb1656e2c9ed2b2fbd3a79ca07b12233524589de0e67518daa626495374ef9be99ae0
SSDEEP 6144:h++uZ3V/mDy4irM4HqH9m7Rkm1tYpBeh2BAoq:h++ubmaYDHU9oBGcAoq
TLSH
T1D23413665E385DA65D599B2E30CE0B2E0FF24E67D875B5F184C9470C239ACC81E8AD38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 8d5ed78e5c562f2b6edfcd9febcad060b10cf756fdc65fdba876a37905d7da95
MD5 a62ea6f5c2357bc95f48377b170dfdbc
SHA1 5b048229ab521e421940e7e89b57d3a98961836d
SHA512 20e62c300c3322ea2377e6b64b045b64b29ce2a7a1f5a2eb52c045af7356b4461ec0c2ac52945fd2a18c28562be0592c354b15ccfcba7b559f82659211aeb491
SSDEEP 6144:6++uZ3V/mDy4irM4HqH9m7Rkm1tYpBeh2BAoq:6++ubmaYDHU9oBGcAoq
TLSH
T16A3413665E385DA65D599B2E30CE0B2E0FF24E67D875B5F184C9470C239ACC81E8AD38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9f6a776-400d-4a12-ab17-66109b11a72d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9f6a776-400d-4a12-ab17-66109b11a72d.tmp
Size 237KB
SHA256 0e23b87502c789ba7d8f5053577f67af6bd9342968d2fb1d86428c89138ddba8
MD5 4eb9038e2216516c990319d6baac6a14
SHA1 1bb9d3f01d7326679cccd4f5eac1f2c4847e6634
SHA512 5aa961ead590e53a362bd5e48f8ac94deebf7546d623b00c17cd4325472978140a7b2007ba36b166f088f68737435d33514a5a054e6246b06557c241b405c12c
SSDEEP 6144:6fYuZ3V/mDy4irM4HqH9m7Rkm1tYpBeh2BAoq:6wubmaYDHU9oBGcAoq
TLSH
T1C33413765E385DA65D999F1E308E0B2E0FF25F67C875B8E184C95708339ECC81E46D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 fb7ad0d43b5d647cf6c5ac47923ebb32ca376420352cebbbafd0d0dfeec1a950
MD5 a10b34cf7982c652a58539ee12567fe3
SHA1 299ab1c18e6fd5a482c903015f48a2919f437443
SHA512 c0a594de931c930a860514a4d4e47ee79b688cefc8e5cc7029aa06a904584edecd1dbd93a19f22b11c3859909e84ac3344872113a694a1d29434967e4137603e
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3X:569tQeoVYocxYCutFCiKt2hZ
TLSH
T1DAD41F37A560A098DF3C35B1E2AD6F4CBD72641A12E006421F74B57F7A237D8CA0B5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 4f2791bf71727b92713de35ee6f770941d85237a9bd4cd9ac8d50c04d10f9593
MD5 23461d9acf8dc3c9745317b64e5f4d7e
SHA1 f00e8f6652f1117108eb7ad767b7071add7f1e84
SHA512 fa07733fdb839d55d994e197d0dc3f852d29ffe7d13cf73fe21bd25fc774729d75e881ea9c432ef93e5b284422cf006fca9438e177b6239e12554806ccd5dc75
SSDEEP 768:x0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba/:XZP2tFP3vqY8AqEMaTaBacg2
TLSH
T1C3257337D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 1327ddaa46e7460b6981937122400fe1c30a80caeb1d0b030b0a457b937d269d
MD5 3f573def6a4930c5fa69e85d87be3cdb
SHA1 7bde8251fd9b7c653730beb5bc32356012866247
SHA512 9cddb9c24f5d6d6e4829824e49244b58ca8abaf926cb57ee29995af0d8efbcd283aa85684173397b9d82ccf7c95a64843a566a1ba2691e238362a88b45a640cd
SSDEEP 96:U7iWqC0ANw2D+jRmgcxltoRNXtdUMUst17XtuUMbstJUMlstKOXtHL2tMLXt0tbk:U7iWqC0ANw2D+jYgcinynsnar
TLSH
T12B63F21462F4564EF3F72EB2B9F695231FBA78919E39D20C0A10425E0D71F6CDA70B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 d4f244f98901470e554960c7ac24e066a5d8ebd43a7e72285208ede27bf50c76
MD5 ee1fd07ab00d770397d363efad84b051
SHA1 f4c920863d50338c9a5175f5bd37c29adb984886
SHA512 59d50ebb2e8469c23cd4dcdb29107a399d98b36b12e673262b1e276a99ac554f26c7e069743df50064d2dcfd4f0b36754b6edddd3b8cf2fa7d3e4fceb0adcf65
TLSH
T11D21495B1B8DD4708AE01BE72DEC8E2573B787CA8391D0A5B34C9039480656D6B3D16E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2032-85-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-100-0x0000000007180000-0x0000000007190000-memory.dmp

Download

memory/2032-69-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-70-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-71-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-74-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-75-0x0000000007180000-0x0000000007190000-memory.dmp

Download

memory/2032-73-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-72-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-76-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-77-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-78-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-79-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-80-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-81-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-84-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-86-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-62-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-83-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-82-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-87-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-88-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-92-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-91-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-90-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-89-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-93-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-94-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-96-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-95-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-97-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-68-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-98-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-99-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-102-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-104-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-105-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-103-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-107-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-106-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-108-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-65-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-66-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-63-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-64-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-61-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-55-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-56-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-58-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-57-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-54-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-53-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-52-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-50-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-48-0x00000000092C0000-0x00000000092D0000-memory.dmp

Download

memory/2032-47-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-46-0x0000000007DF0000-0x0000000007E00000-memory.dmp

Download

memory/2032-44-0x0000000007180000-0x0000000007190000-memory.dmp

Download

memory/2032-34-0x0000000004940000-0x0000000004950000-memory.dmp

Download

memory/2032-35-0x0000000004940000-0x0000000004950000-memory.dmp

Download

memory/2032-30-0x0000000004940000-0x0000000004950000-memory.dmp

Download

memory/2032-33-0x0000000004940000-0x0000000004950000-memory.dmp

Download

memory/2032-32-0x0000000004940000-0x0000000004950000-memory.dmp

Download

memory/2032-31-0x0000000004940000-0x0000000004950000-memory.dmp

Download