f7eafe12cef79768b59ae2976e71609ad5a34dbc98f5dfc093882771cef2b9f3

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
878s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0702.mp4
Size 209.8MB
Sample260731-c48faabe46
SHA256 f7eafe12cef79768b59ae2976e71609ad5a34dbc98f5dfc093882771cef2b9f3
MD5 862eec85ddee2d8f027c5a0a9a260102
SHA1 630f30327fb297c93adb4065fca3b585734a075a
SHA512 99048b60806b7d01a17aa6107facaf42176a8da006c9f64022be5e69978aa2f3ff36710c4b884634bb4b2e99c05753848ee17c823b5df1b95fdaeeed0e108e88
SSDEEP 3145728:BncFfX6hH8/X9v61TRhC0Iik0o/sHRVegaU3nSOSBl3gcTEZEf9BBr:BcEhH2k1Oj03Hney3nd2l3to+fJ
TLSH
T15CA8330341CE57F5DC380A354666A904639AFB0C1367E3E3726390E3BF265E1B6A1D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299394255335066"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{5A192F94-AA2C-4EA4-9938-240C130A6D2D}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	408	wmplayer.exe
Token: SeCreatePagefilePrivilege	408	wmplayer.exe
Token: SeShutdownPrivilege	1644	unregmp2.exe
Token: SeCreatePagefilePrivilege	1644	unregmp2.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
408	wmplayer.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3996	408	wmplayer.exe	86
PID 3996 wrote to memory of 1644	3996	unregmp2.exe	87
PID 464 wrote to memory of 4752	464	chrome.exe	92
PID 464 wrote to memory of 2372	464	chrome.exe	93
PID 464 wrote to memory of 1820	464	chrome.exe	94
PID 464 wrote to memory of 1820	464	chrome.exe	94
PID 464 wrote to memory of 4784	464	chrome.exe	96
PID 464 wrote to memory of 4784	464	chrome.exe	96
PID 464 wrote to memory of 2244	464	chrome.exe	98
PID 464 wrote to memory of 2244	464	chrome.exe	98
PID 464 wrote to memory of 1536	464	chrome.exe	97
PID 464 wrote to memory of 1536	464	chrome.exe	97
PID 464 wrote to memory of 1364	464	chrome.exe	99
PID 464 wrote to memory of 1364	464	chrome.exe	99
PID 464 wrote to memory of 3540	464	chrome.exe	100
PID 464 wrote to memory of 3540	464	chrome.exe	100
PID 464 wrote to memory of 2500	464	chrome.exe	101
PID 464 wrote to memory of 4652	464	chrome.exe	104
PID 464 wrote to memory of 4652	464	chrome.exe	104
PID 464 wrote to memory of 1780	464	chrome.exe	111
PID 464 wrote to memory of 1780	464	chrome.exe	111
PID 464 wrote to memory of 908	464	chrome.exe	113
PID 464 wrote to memory of 4872	464	chrome.exe	114
PID 464 wrote to memory of 2208	464	chrome.exe	115
PID 464 wrote to memory of 4664	464	chrome.exe	117
PID 464 wrote to memory of 3808	464	chrome.exe	118
PID 464 wrote to memory of 3808	464	chrome.exe	118

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\0702.mp4"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffced15c728,0x7ffced15c734,0x7ffced15c740
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,384337719939557516,18330927646562969038,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,4543366456647015330,14521068386850643683,262144 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,18166811704334951962,15602368295909992812,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,4309625933062792317,2706214453501535229,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,3955291865427444685,4864839424148528761,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,9375884774899413342,11103111560895428062,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,6662379064828694829,11826727009632717021,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3196629491529129964,7532980364579833359,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5996,i,53188452994472055,2058917775070802338,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3544,i,1051067143982284471,7617782141344127125,2097152 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,1577149375316134359,7857724953478470311,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,3369148221068844247,1303881861109518613,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,15689089503510739428,11656930976951765043,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4160,i,16953827845187615110,2685110337438598895,262144 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,8046818512057829071,16958091027987914001,524288 --field-trial-handle=2072,i,17951572746655263792,16958158300319492175,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b33e6bcbe5b3b09ce169a6550d974c97b6e7c10073060728ffb8a3996de3b6f3
MD5 3cf7e0d72f3b513ca55d42f14c5748c6
SHA1 d02b4aa306a5917c4921e768647b92a1559f7e88
SHA512 2c122c75c59a8da034da0c0dd9ebcfe52e15bca8508a1cf9b4db70385b264a4b729e58f7a578802e62af277326085d5aa05ab9b542e1adf23bea04e46b53309d
TLSH
T169E02BA9CC21BC3709FD4B1850540789E751139B2B815A0F3A3D510CCFB1B2642C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 b4a04a2448dd9514ba148edf0987e71233c47dcbc54350dbfd752993ae3dcd92
MD5 c01d12026e58b3661e820a2b324ecd26
SHA1 54cfb4c59541fa6281b33b09534060e80b772220
SHA512 ea462f08034c166dd9012ace723b2c24a0deb6da1c2597b44623cb9dbd39b8df788730e0fc7ee65f8aa092eb1e351d47328987209efbfb4ff5c8975c369e7495
TLSH
T101018478313042F1DFE4CD3583E97A7B5CC4AA951A221B4B4DB8804E75AB233E08509E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 8040e7945af8c0373ee6308d5eb19777c91b4d698ef003eb12245284fa4877ef
MD5 dc56ff3455910ebf6d74fac25e2a98ba
SHA1 51b28186e11fe9446e764d83f38bfa5c8f622200
SHA512 c6d1034d9fc21c2a2d31baae84c634e65a9c1ec639fd0210a8e48fb28826d379a069c81f7bee752ce2f6752c61a15e8aea3aeb6a7e6a91b45b37c5ab127bae91
SSDEEP 192:DvOr5ceX9uJYJwAaasZRXMmkTqsuTDvaPVvDfP8NP2sbzy:DvOr5ceX9uJYJwAaasjXMmkTqsuTDvaL
TLSH
T130F18EF7C3D8852DC95156F8D7257F1FCE2A0A28031C3D6688D8BE5B93E2871E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 57f4139b17c2858845eac1fa780db513ebcb454425bc3e17b44f998ef1f5bc5d
MD5 2135ef92d5b264e8b8878359673fb152
SHA1 7fdddecc49790913b66e4626a7b2c16004f742a6
SHA512 ff870a52eb7b776fcb88c96fee50d0c884a16c83f76cb21827001210e2053bf130c9de0efc8f135f61d8353865f3e5352163bf358af7a6ead6f6e7dbec8612a3
SSDEEP 192:DvOr5ceXyuJYJwUdaasZRXMmkTqsuTDvaPVvDfP8NPiz3ffjhvW:DvOr5ceXyuJYJwUdaasjXMmkTqsuTDvr
TLSH
T12CF19EF7C3D8852DC95156F8D7257F1FCE2A0A28032C3D6688D8BE5B93E2871E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 db77bf212305651cfe0f53adf248b0e1437485932512f2a76c18bc65fe24c80d
MD5 2a8a8699d0782d08bf03a7995b8d6be2
SHA1 da57c670676555e318fb25c2108abaeba2283d51
SHA512 9dd5296b0a2ebc69daae599018b9c9995b055c80db42d3b2e72c06047dbae2c39db4b2d0a47dd9f4b3dc4fe1fdf9e06d2db1d99f49c6c545df6c18a900eb49ed
SSDEEP 192:DvOr5ceXyuJYJwAaasZRXMmkTqsuTDvaPVvDfP8NPiK:DvOr5ceXyuJYJwAaasjXMmkTqsuTDvaq
TLSH
T1D1E18EF7C3D8862DC95156F8D7257F1FCE2A1A28031C3D6688D8BE5B93E2871E21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c2f416b4b9a7e9f67ae2c0778b6f99794460bb062db74af8056d38c2e8df5471
MD5 19017978cacd1b617398e8e3b9e739a6
SHA1 6fa78bba71a12055c87255494b2296210730cfdb
SHA512 127ede0445be3ab277ee339e0159697e118c4ee52aef04b1858eda7d55f4731ba4036c85f43e02cd296b910f5a7cb322577b2eefa15845891946813099b4dfad
SSDEEP 192:D0uLitH+AJJyJEJaasZREdmuTDkSqmvaPVvqfPiNPiznfjhnYK:D0uLitH+AJJyJEJaasjEdmuTDkSqmvaE
TLSH
T119D1BAF783E4822D891196F4DB15AF1FCE2A0628032C3D7689D4AE1793E2872E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a2d6ad03ff2ba4efe051c1fe43d49645b8f4305020715d4eb6a1292744c7b7fa
MD5 71cf2ce1fb5197ffc1e92ecb165df9c4
SHA1 2cbe9faa14bf38abc5422ec3aaa6988092ef58ab
SHA512 b5c550717f1059a5d3f55f970604d6847c7eb0a761830040a4532d32448cd67f7941568868697a71e2a8559e6d67a6323045568ff47eb058f15ec871b0b80ec1
SSDEEP 192:D0uLitH+AJJyJwdaasZREdmuTDkSqmvaPVvqfPiNPiznfjhvYKK:D0uLitH+AJJyJwdaasjEdmuTDkSqmvah
TLSH
T127D1BAF7C3E4822DC90156F4DB15AF1FCE2A0628032C3D7689D4AE1B93E2872E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e506c7185b756caec43b3a65d8255b0e803adb37b29cfca260aa4588894f6280
MD5 3a3572299a64f9bc6c4342e9b22e65a8
SHA1 e357a1564b46b4334f889aac23e6a6223ca8d598
SHA512 c15b7d3250607335d156b74751f3f80d48cad2bf06a471d44e42e4c17cc90cc180c56a3e5994a4197550dd67000c878daaf404fdcac8ab53a32b951ee34fca1e
TLSH
T126F059B7E6AB742764BD59BF1E00BC065CB2A83603D029F5DF9B813C90858E31B02857
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7596a100a7de5bde4e43be3abba55936b4a149779f7b4c8e60f5ef789c71ce61
MD5 60fc54f84a868e48b9c9453f7105cb95
SHA1 4c14f496d9408d44697e9a39c6df29ee9fe2cda4
SHA512 99e9e7e4f77b9d5f30400053a3e54ab61d581eae45e0de11d7ca770a614b29ab653fd1618983717e8ca9e2c5987ae3a6c13c93eacfc9c70d348719d02995bb3f
SSDEEP 192:SR+cBzJPRlt/G+v7spAPRp22mck9wHsb+WNnfX41B2OK2HegVwDjaLBVyIsnAUg8:SR+mzJpK6YUX/0KwfQ2R2tVsa78
TLSH
T17F52D82FB914693B5CCAC21AF9267B6BD7F6106132942E90EAFC892C15D75CC231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f25b3d61d9579270ca12d27ffb3ae9de9a36c93003a9a4ccd376b614d618267d
MD5 35ee7cacfd1f8e0e0c875e2265611502
SHA1 8027c66d05c29dae62640156b53e483021042fe2
SHA512 a83c23b5d0053bf31f8d4fa04a2be1014a3bece8319c957da09db181559ebce9aebe6ae06105131384b69e264f3de797ffe6215b59edeb124788c33f54e5a9be
SSDEEP 192:SR+cBhJPRlt/GSv7spU09PRpv0s2mT+9wHsb+WNnfX4DTe92ZK2HegVwDjap9BVK:SR+mhJpK+Yi0lXv0RfKwfoen2tVsap1e
TLSH
T1CD52E92FF910697B6CC6D21AF9267B67D7F6106172902E80EAFC8A1C15E75CC231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27c187f7f39d241b0829e2d8ccd4e411fa0913e2bb941d9d7e90102cb450e5b9
MD5 0210394148bf31f4a56b03694e0972b5
SHA1 7be6aa1349b29ac7fca0fe8688d24a5911f57990
SHA512 5e2ead2832633a45fc031ce633ffcdcf890139fdb977d15a86b21bc7bbfdfe79f98605ce55752a645793da8b115efcf7aaf71a20157f199e27ca123efc8b811b
SSDEEP 192:SR+cBhJwRlt/GSv7spU09PRpv0s2mT+9wHsb+WNnfX4DTe92ZK2HegVwDjap9BVK:SR+mhJqK+Yi0lXv0RfKwfoen2tVsap1e
TLSH
T1A152E82FF910697B6CC6D21AF9267B67D7F6106172902E80EAFC8A1C15E75CC231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f8a7929b5b50261ac47080d941a2e5516d171731053e657a49b7e3e33e6c92e4
MD5 a6093e7306031ce80356e11748214ae7
SHA1 9b1b99c3534a9518eb435ed45256f1b5f8f4cf70
SHA512 17d7ed4d31bf13652f5b41d9f2e1b6d9d5a9af31cf8869affd44976144cf08ba97055535372da2ac101dbd08f9d57271651abbac67b0b6b81f595a5b169f0127
SSDEEP 192:SR+cBhJPRlt/G+v7spAPRp22mT+9wHsb+WNnfX4DTegK2HegVwDjaLBVyIsnAUg8:SR+mhJpK6YUX/fKwfoe72tVsa78
TLSH
T11352E82FF914697B5CCAC22AF9267B6BD7F6106131942D80EAFC892C15D79CC231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ed472c1ba4829e773b01bf32e022dbdcd4ee73bdc38c38b5a3f7e1cb7a152d5f
MD5 2bbc8bdc07ff39a5adfc613879adda96
SHA1 7016165911f235d3597840967c4cd15c3f3101cf
SHA512 8620afd1399324e5be5f39b8d9124d2978fccfe82dcbcce414b49914ed129903ae8191d98d0d4106839594f99c86159c64fe1d0fe14b441810a6e1b97364c6a5
SSDEEP 192:SR+cBhJPRlt/GAv7spAPRp22mT+9wHsb+WNnfX4DTeCaK2HegVwDja/9BVyIsnAq:SR+mhJpKcYUX/fKwfoeU2tVsa/1e
TLSH
T11052E82FB910697B6CC6D21AF9267B67D7F6106131942E80EAFC8A2C15E79CC231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 58a1853a83dd15253b0f46f6e0259ed07fee9a809db451be158ebe005ffb14e5
MD5 4efc971dc5a0db583b6108512efcc2bb
SHA1 77efb74d4b391b654a5bb4eef51b459adaec6e08
SHA512 0e35aa10b4ec009be39b7698f46968fd5833e954f5ee977053ebe9c09e25b342565e2719bde942c9bffc1db9b085eeb245ecb6c62dd184afb76821054a5061fc
TLSH
T1C7B0120084095141C0C20AF0128218897214AF14EA0A170643E06A36D8251618414090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf32.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cf32.TMP
Size 96B
SHA256 0036fce8a9073d6aeafec566a3b52f4eaafffc9ba849800c58818a950ffdaffb
MD5 7e69b9d5d7ec2481e244da21ff24b8db
SHA1 8d86d875027a6cf90dd57ef08b0ce1261889534f
SHA512 e5d95432076b660338a461365e8b1a43cc847265d1d6737425f5ebeac46f7aac147f19c8a2676d0daeb39ae5d7ab6f007b5d3d6ab96149269a18c48168528be1
TLSH
T1E6B02200C20222E2C00203F022C082CAF322CF28C2030202E3E02A22CC20AB00220020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 43a6c8f8665b06e57d12a6812c5dacb92a68e19d64d7a894b1a5890122889be4
MD5 4a6cdcfeb804e33cff0396c9f0702b51
SHA1 cec134918e12eece9d745fcadb011c2bcd2817e4
SHA512 14578c077e16ca88648977872578341f600604beb763be18e3e88228c80fc93a205c7d296135d939b3a54af4bc0af5f64900b9f9176d3d37439baf04affd7b48
TLSH
T195B011C800200002CA0282B02AC208C0BB220C20A3A288EE80A080A0A802A028308A0C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 eff1bb783c09be16f537cfaf154c2e137bca7950074f602b0786c79502e5611a
MD5 dc58a0d693cb232a7bde8c703555a4ab
SHA1 47a7e2445936642c8a3ebef144bbb62dd66cd2fd
SHA512 ad8b5213e9f7b85279deab5db7b17eda4bf3a4c476d599b9399fc8576e8eaac83d8dce209395bf5f8cbce66930d4a94184278daa3ca0f06f1e8d3012f7e365e9
SSDEEP 6144:h6qrmDy4irM4HqHHam7Rkm1tYpBeh2BAoH:VmaYDHH19oBGcAoH
TLSH
T1A53413765D356CA94D6AEE1F708E1A2A1FF24F97CA2478C5C5D89B0C238E9C80E46C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 278KB
SHA256 30a3b30fc349b36277cfd5597280125453e341bd0153a504a53432eed9af5c06
MD5 5b9e87e3a50d70f0d28502bac48bc85c
SHA1 d6060a1ce4a45df3dfbb2c4fc51925a467ee93c0
SHA512 12cafe5d5aa65533003b1f13b44187099784db2e7404d538e81680b6fd1a6157ae66eb22653bce6b50bc5cfb9852ba4f83efbd952e54b19349798fa27839498e
SSDEEP 6144:i4vBR3UNRXbqrmDy4irM4HqHHam7Rkm1tYpBeh2BAoH:i4vB9UjamaYDHH19oBGcAoH
TLSH
T1FB5412368D316D794B66DE1E308F2E191FF68ED7DA24A8C9D1D9AB0C234F9C40E46D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 06f04c58cf066b1d363077718604da91cf4c15a2a278fad5e7b97a5408ea05a8
MD5 caaa92830dfaf869733e5ca29de094db
SHA1 969e1dc389c293b4a4e9fbec8f900bf63389c62f
SHA512 e9aa7a4fc45b05942610b42c6b2b61f22248d0ac35c7373d6b106aade7fd3571ceb470efe2c14a666bf81775a50e596e4c4ce91c480f49bb3f819494cbf091a7
SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:5m7Rkm1tYpBeh2BAoK
TLSH
T19EC3123B5D65E97B9979AB0EB08E0B1F1EF149A2D920DE52C8D85B0437F97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 05c599f7975b7fd4cf7371507abf0d2caf23901f5796028f30391584648c567d
MD5 2d32c63e89d1dd7bf27383a4af33c1be
SHA1 f8d6a028876c682533891b129df541ad865faa02
SHA512 6f0f6283a2bed33492f190d63977fcc8074281f574581b9ac7f5923bdb8da3bcfe28883e849e83577d7124447a11a2a44cea0fe116fb8e01e630db7af9c1320d
SSDEEP 6144:rqrmDy4irM4HqHHam7Rkm1tYpBeh2BAoH:6maYDHH19oBGcAoH
TLSH
T1DE3412764D356CA94D2AEE1F308E0E2A2FF64ED7C62579D285D58B0C238DAC81E46C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e5cc0401d20cdcbf8846d26555cf2815a96e2b74218c308253808dec4a0f6fad
MD5 a0623abd544b637820918f7178deeb2a
SHA1 6107b33bd614029ece083d8223a86bd1247ea8e8
SHA512 5825e06094d9ba8c209c97f357c807c9fa21328357cd8e533fa7239ca92233cc8e8f4ab5cdfdf5cecbc2367479f24cec3f362f98c80bb32d2190f80994c46e46
SSDEEP 6144:KqrmDy4irM4HqHHam7Rkm1tYpBeh2BAoH:3maYDHH19oBGcAoH
TLSH
T10C3412764D356CA94D1AEE1F308E0E2A2FF64ED7C62579D285D58B0C238DAC81E46C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 7db9f55fafd56eff6c4eae14e9ad8a42b5f580c452917fca5245f6d0263c6b71
MD5 183dd714ab25ac72f3ed376192426b1b
SHA1 f372a00c1a71541afcd8a5a96b55d72682495314
SHA512 04bf5175dbe5c23ff42f02581be9a9f58ef3dfb066ed5489334575e968c8531eb20b5c98fe1d61495849c8ea6770ae14772cdf4abf679e291b40a11a9bec0ff9
SSDEEP 768:N0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbad:7ZP2tFP3vqY8IqEMNTaBacg
TLSH
T1E5257437D190B0C5CF2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 50c5da3bc2a25001a0fdfcfef8153d2f64c755932ef72de15a4fcb4bd4638373
MD5 622c47f21c2cbeefa6d7b1229e73dbd0
SHA1 9460958838617bc59b04ed6b9987990a539c6eba
SHA512 02c020e4e3e6ce10bb0f2523f409ca5d2df5d30d8e6616010c09496a359d91cce58d1705fc78463f754f13d45ee44137eead72dc8ee6e79d0e9ace650fdb73dc
TLSH
T1272129571B4EE8708AE01BE75DEC8E25B3B787CE87A0D0A5B34DA039480356D6B3D16D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/408-52-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-56-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-57-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-51-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-53-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-54-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-55-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-50-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-40-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-41-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-48-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-47-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-49-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-46-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-42-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-43-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-44-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-39-0x000000000A080000-0x000000000A090000-memory.dmp

Download

memory/408-36-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-37-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-34-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-35-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-33-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/408-32-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download