2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581

Analysis

user interaction
yes
max time kernel
87s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mapper.exe
Size 40KB
Sample260808-adts4aaf54
SHA256 2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581
MD5 fec9ff27a05c8f56f68d22e765a6cd09
SHA1 d971a56ce72112e6ce01b0956b3f6be35013cb75
SHA512 c3290a09c53ff361ef5106e808f3d32b01e238d0e1bc258c8c2d24e4516421cf1068223520acc007dab2a85f6e18d1c52d7a30a96bca9362a96ce9f820e40e96
SSDEEP 768:CAFl6/DtHHwR1TMbYI3aW31MjHCPip1MmMbC0DH:C2Q7612YI3H1MjHCPizDoC0
TLSH
T1D3134A8293601AF2D5DBC97085F68D6A95B1F9514B2287CF9A70C1610DB2FE43B3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\gdrv.sys	mapper.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306212448080356"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2108	mapper.exe
Token: SeShutdownPrivilege	4456	svchost.exe
Token: SeShutdownPrivilege	2584	unregmp2.exe
Token: SeCreatePagefilePrivilege	2584	unregmp2.exe
Token: SeShutdownPrivilege	3964	wmplayer.exe
Token: SeCreatePagefilePrivilege	3964	wmplayer.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3964	wmplayer.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	SecHealthUI.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4460	3964	wmplayer.exe	105
PID 4460 wrote to memory of 2584	4460	unregmp2.exe	106
PID 4704 wrote to memory of 5956	4704	chrome.exe	110
PID 4704 wrote to memory of 3300	4704	chrome.exe	111
PID 4704 wrote to memory of 1708	4704	chrome.exe	112
PID 4704 wrote to memory of 3300	4704	chrome.exe	111
PID 4704 wrote to memory of 4024	4704	chrome.exe	113
PID 4704 wrote to memory of 4024	4704	chrome.exe	113
PID 4704 wrote to memory of 5800	4704	chrome.exe	114
PID 4704 wrote to memory of 1508	4704	chrome.exe	115
PID 4704 wrote to memory of 5800	4704	chrome.exe	114
PID 4704 wrote to memory of 1508	4704	chrome.exe	115
PID 4704 wrote to memory of 4788	4704	chrome.exe	116
PID 4704 wrote to memory of 4788	4704	chrome.exe	116
PID 4704 wrote to memory of 252	4704	chrome.exe	117
PID 4704 wrote to memory of 3252	4704	chrome.exe	118
PID 4704 wrote to memory of 3252	4704	chrome.exe	118
PID 4704 wrote to memory of 3980	4704	chrome.exe	119
PID 4704 wrote to memory of 3980	4704	chrome.exe	119
PID 4704 wrote to memory of 3744	4704	chrome.exe	120
PID 4704 wrote to memory of 4336	4704	chrome.exe	121
PID 4704 wrote to memory of 3744	4704	chrome.exe	120
PID 4704 wrote to memory of 4336	4704	chrome.exe	121
PID 4704 wrote to memory of 2360	4704	chrome.exe	122
PID 4704 wrote to memory of 4484	4704	chrome.exe	123
PID 4704 wrote to memory of 2360	4704	chrome.exe	122
PID 4704 wrote to memory of 4484	4704	chrome.exe	123
PID 4704 wrote to memory of 1360	4704	chrome.exe	124
PID 4704 wrote to memory of 4088	4704	chrome.exe	125
PID 4704 wrote to memory of 1360	4704	chrome.exe	124
PID 4704 wrote to memory of 4088	4704	chrome.exe	125
PID 4704 wrote to memory of 3712	4704	chrome.exe	126
PID 4704 wrote to memory of 3712	4704	chrome.exe	126
PID 4704 wrote to memory of 5280	4704	chrome.exe	127
PID 4704 wrote to memory of 5280	4704	chrome.exe	127
PID 4704 wrote to memory of 1716	4704	chrome.exe	128
PID 4704 wrote to memory of 1716	4704	chrome.exe	128
PID 4704 wrote to memory of 5928	4704	chrome.exe	129
PID 4704 wrote to memory of 5928	4704	chrome.exe	129
PID 4704 wrote to memory of 4044	4704	chrome.exe	130
PID 4704 wrote to memory of 4044	4704	chrome.exe	130
PID 4704 wrote to memory of 4692	4704	chrome.exe	131
PID 4704 wrote to memory of 4692	4704	chrome.exe	131
PID 4704 wrote to memory of 2596	4704	chrome.exe	132
PID 4704 wrote to memory of 2596	4704	chrome.exe	132
PID 4704 wrote to memory of 4484	4704	chrome.exe	133
PID 4704 wrote to memory of 5812	4704	chrome.exe	134
PID 4704 wrote to memory of 4484	4704	chrome.exe	133
PID 4704 wrote to memory of 5812	4704	chrome.exe	134
PID 4704 wrote to memory of 4360	4704	chrome.exe	135
PID 4704 wrote to memory of 4360	4704	chrome.exe	135
PID 4704 wrote to memory of 2900	4704	chrome.exe	136
PID 4704 wrote to memory of 2596	4704	chrome.exe	137
PID 4704 wrote to memory of 4640	4704	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\mapper.exe
"C:\Users\Admin\AppData\Local\Temp\mapper.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5740

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1380

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {88866959-07B0-4ED8-8EF5-54BC7443D28C} -Embedding
1⤵
PID:484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\DisconnectLimit.js"
1⤵
PID:5112

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd0879c728,0x7ffd0879c734,0x7ffd0879c740
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5210326814848227971,465061820778247217,262144 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,9693161691467047914,8312777211806218239,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,3221459101165316289,9167017812037052411,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,14629124245461808299,5399412404272416832,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,4445258547539549526,9874227372359228728,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,8053263058847430528,16549495453672479720,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,3485526713986170455,12253762709669437121,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5504,i,16876565867233219708,5518344964588175309,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5544,i,3077850618785976307,11023065694823489402,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5792,i,2484345762688170632,14481624916119452793,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5528,i,951791639199241477,16792563360567342553,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,4406362939160672632,6401518164585815674,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5548,i,10485168413295748304,8389338828058074257,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5796,i,3403706894089559621,3826904968256121991,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6004,i,11694675910978361672,2007558255279847960,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5540,i,17820329738134184842,3354737578160204059,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6072,i,5579889735915047690,9632590772242787037,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3724,i,2997713304978420177,9026448091350044285,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3544,i,10971729549252193293,8780675294494965687,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,16008736486194802266,4838330466204064118,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,11462826810915592820,15559302700248266493,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,14557490884251182171,16166534537721870530,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6172,i,13339494916817605501,7905976665176934940,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5664,i,15054853463329876792,14007615258915254341,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5512,i,2823789202196915061,16766578259155041480,2097152 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,12494130440008089130,4564617328499402763,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,94170397417512733,8800740485010157880,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,18072888167817655616,9210955419264226078,524288 --field-trial-handle=1848,i,11142905414607298365,18012710991752880647,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 3f9c36ca7d2e84d26184869aed10f2d14521352c5375bc9f8be5816403b4a42a
MD5 7bdcdff285bf63fce4e5436b2a43bae7
SHA1 2f6c185031052c200e524429a6aadbc00a9d9e53
SHA512 9fcc0995f40737be8f02bb3731f30cd905f1f0b252681617f664d38d107c79991faa85cdf24020a29356a5a2b7d2d8947e35ac08073ddc9b76e7b43ce87e079f
TLSH
T11ED080D551D41404EB4053F41C731C2271167E4D06E0C30261E54C9454B3A657DC63B7
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 d66db8ffb298282b4c7143156c8b6556a397adcb140ccc242a692a9a1e3c351b
MD5 7f52ad405c5df2e0f9de6782c1a69d0f
SHA1 9347ebc3bae03bae069806bf5b0d2b266a67a7cf
SHA512 bca26cb7d25b79aefa882491d503395a3642bc292fc81ebda0bec292efd8aaa1e8068e0dc52cbdb9d456f5a19837aed39dcaadbaba5386da5ffc99e211f33c43
SSDEEP 3:MsEllllkEthXllkl2zEkln+X:/M/xT02znne
TLSH
T1504404447FC40C05CD0011305071DF500FF0F4504511574334510C135CC55400C04300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 29c2ee492cbc854ec44143a8a451aba1577c87ef839075e5302825932aa61e3f
MD5 48d972e16a7860ef1c3f979b58bd37c1
SHA1 583918ef9d675e7b450ef3766190213f1eac97c3
SHA512 83a344321d99e65c07f25138ee399a3a01122ecc57d81442199829384a66dda3364ae76bfc8c4d2e81104a28335ef236ba5ab18fa28cfae834869b1bedd67dc9
SSDEEP 192:D4++Ovh9eGJPWjTgHNaZnKX5qez8FY+K/H:D4++Ovh9eGJPWjTgHNaZnKX5qez8FY++
TLSH
T170D17CF3D2E9876DCD1152F0EA10AE1ACE3D0A24536C3C56C9E89E5F97F1971E24068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2309914ecc3ecfa001080a28d81c547811cb60bc7247bfa5c50058f3d303b0be
MD5 02e618f1c7f20813e31d4e6b59c8a08b
SHA1 e90585aba7057109088fe69cf96b7a27d0f118e7
SHA512 44a3861abeea25c68b376f84dba793d986fcda01eb0140aaba9af456cd4106537ee176729e7583f3e0b932c5e213191a33bb2158f3a354b29171bac71777125e
TLSH
T1781159A7D17FB4A7203D8A7F5E04B8066876A436095139F4DFA7866CB0918FB0B124A3
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9028dc9bb2c0cb9493f3d1a93dea63200820b236fe71f3883a4f3f12a6ddd222
MD5 23ed9f21bc2cc50d05c2be0e9a750a74
SHA1 89bae83a337b41a9cc32f83518fe102911262204
SHA512 6fbbebce995fa061b86853068b140db764485668b6d1ee51ebb1b9e1f4c615f7bc25256b3c880b1da784b02fa768c6ae7227a20e20a80d68fa90b5dffd6ffa46
SSDEEP 192:+Rl2amQv7pAPRp2ax79XxHsb+WNnTBXHl2Juek4VyIsnAUge:+Rl2RMAXlfw912ece
TLSH
T1CC42A52AAE20697B6DCBD22EFA617B53E7F6102125D42E44E7FC996C14DB5CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4f4f7665527808eece1fc31b274cf8abde8af6c502ac1a11c121305e43d6cdb
MD5 3507f7420b6a92c7652dcb5ae90fe617
SHA1 8509341fdadd12f71bc4269e2557dab0e875c1ca
SHA512 311142cd465dd585d574856327d6877f1c024e0a4b416cb3bed7b4117a42eb346239444a36d7758c1c187030df9bf454c1807ad47082badd21bfbe72a1c0d6b0
SSDEEP 192:+Rl2amQv7qAPRp2aMy79XxHsb+WNCrTBXImeCuek7VyIsnAUgE:+Rl2RMXXlfwqNe39E
TLSH
T1F142B72AAD20697B6DCBD22DFA617B53E7F6102121D02E44E7FC9A6C15DB6CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d392a95ac082505ff52b051568653b45543f4ad049cc0004f52e3e6b0f946b8b
MD5 da3239465acc541aae11e789376cdd05
SHA1 2bfe9caf8e53625f3490dfa2893d5790374e8684
SHA512 76e24a02761742b70fcc805e87ec5c9b5844dd040e0708ef84d4989cd8bd3cb74181d43c3286d98e4a4cba5a13b9f3f8f35d5d460ec9e4f7389991b06af95bb4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3203ed7e8905f8f99b31494cae5d4d27bf7f863b3289126ff8d8cf0aca8759f2
MD5 8834023a1b8e2c59ef6ed8027892646d
SHA1 7a1a2af99be7fd94b3e92e83659a71e762f322e6
SHA512 d854a631585f440ed00c62c5fbca83f998d44dbaa9381257dfd8df8f92ba15764dbdc26ca5c4bb26fbd3e36ed9f8be522c868d3dd5b5b556d8181e02056e29ac
TLSH
T138A0026091C05914DF1942706131258632E678165890830349951C698E9B4C05111380
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5e35c929c599b0c7f13d69bd1913afad058d021d9596fe7fd8dda807ea3b8588
MD5 37fcb501ad4fe751d66434ac1f24b9f9
SHA1 b910db5550a61c8ba106e71349f9843146b6b2fc
SHA512 66765362a24d076d12b143c541377e17d682a6d549b2ad257cd3be41000a2131e61d6f5962585dc7ff2444c514ebc0963f1f0b7d5e3b5c80836216f416716f9d
SSDEEP 3072:G/xRY93awM1/fqyQXaYrfJXXkfYkYS69mi5E8lN/9nMIRoopCV:G/xKcvfHpY1X0AkL69mn8lN/9n9JpA
TLSH
T18AC312148879EEB358CDD33B71377A6D7FB0A05AA64968C5DBC05BDC9B04260B3E812D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 441fc2e77fb2bddacb28c2a77f4553d0e22161a6e8b03a25965ff0f9f71d3e4b
MD5 203d0b7e64299a4432d97a7b0dfa509f
SHA1 4c29e3d8aad8b19f193e44095cdf1b1aab85138b
SHA512 72a54ca1515a4d1adea44d73e50408911e9262e0f03fdb93b644752dc8c71b2c266c99f03f06cfc6d5a12e95550e9aa6d12ee2c3415699b96510855c341251ce
SSDEEP 3072:bExRY93awM1/fqyQXaYrfJXXkfYkYS69mi5E8lN/9nMIRoopCV:bExKcvfHpY1X0AkL69mn8lN/9n9JpA
TLSH
T136C312148879EEA354CDD33B72377A6D7FB0A05AA64968C5DBC05BDC9B04260B3E812D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3725b68a18373928978544e4f63f652e6c7e232c2502c4cd1c522a3c1a261388
MD5 0abb6f959899de0aec0759898cd07b10
SHA1 04ad720ac7b8d10f8724745b60c31ae571832cb8
SHA512 7968b7974d15e1d17632fbb6eec3c97bac95066016c7680f4241ae22a69106e7bc7df9a5151718cf387a74b9034b73267e76bf660fa00fd5494ea054b8198ea6
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5HmDkB6nGyvn0b4T8DybJv4a:xC0ITo+TQ0InDUDgIPPb4T8Dybl
TLSH
T13DA10935A0684DB74476D44AF1622A43CFB97067E972AFA0EADD0F0D24F70EC1741A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7b8207a68b479708333fdceac994d845515a73da31079281bf161722a561ad1b
MD5 726e28ea12588602faf7e77a6a8be7f0
SHA1 50ba7e9c633fdb6eaa62ec74b197975b79f78faf
SHA512 37e59e5ada344ad1d3ceba966dbc7d11a2f9502c2041bd1734be77de90d79f59be69835c0d2d6e2d3a81df1ea14c026d189df32e3ccae3950547bb9866e027f8
SSDEEP 96:RC0d+r2io+TJ/E0f6m934mYM+vSl8h4otop5HicDkB6EGyvn0SvQxwzQJhjm+9Du:RC0ITo+TQ0I/tiU25IMPSIx9hjm+9DxE
TLSH
T188C13972A46D5C7715A3E446F1122A47CDF8206BDA51BF70EAE90F1C01EB0EC2382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 6c5e0573e808f544c26c4240fe4604c24e6a961ca5f1a5bbe670583a25e28295
MD5 9ce64b055b1c27e88d5eb602a326b3d3
SHA1 c4b4ae2f76a66ee3916a6653944dffc5771f08bf
SHA512 0cb27e9d4bb57fc81ab746d044247eccb7f93493becb3e7a781ecf56e4dbde7c8f0871ce4ceff26dfffd513b98519032a7d303dbf5a2811d96a751a96fcd4d0e
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:569tQeoVYocxYCutFCiKt
TLSH
T139C40037A570A098DF3C35B1E2AC6B4CBD72651A12E006421F74B57F7A237D8CA0B5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 2dcf8cc7f231b4c0cb287b627ec5abf4a2e6ade638aa3443c7b2af777f6b1262
MD5 0a18aee26bce68721a96795360fb0aae
SHA1 ecc2d8a29265f9a76d7ee74ab22fe44f2cb5dff0
SHA512 0ae6ca83ab28c871b1ec1b19dc59cfb6f56d5f348832a02a732b1ddb01f3b5750f7bd9ba670cdf1ad1ce65ec3fbe3878e56daad84b17874a40057d7b3b63cbb5
SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbak:mZP2tFP3vqY8NqEMPTaBacg
TLSH
T15D258437D190B0C5CE2CB171E9ED8F09BA23B10B11A052465FF8A57E7A533D98D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_1297520633\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 642f5a6848b6ef1ea679cff7fd937ab76dc55bc14cd80617417e5ee79c922bb7
MD5 c373f48363f3ebce451ccf3ee73c3914
SHA1 c7111ca21ae55a689406ddf2b0ed519f7793d90b
SHA512 4cf95a2c036608645219cde7acd58e5c870ec6cf0e575052b8bbed608cff02450dd13a9b403c95653f97ac9b7ac3b8239afc9c6032b8cf363485d5e98c327fb5
TLSH
T1D9215A574A0AE4B5CD6287A399CC8A2773BAB7CA5764D015738EB02A894123F233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 905f68f225266542c82eb10ab7bf281be6db4fcdf8b6e1bc62044520e9187146
MD5 cdf0a0ab5308452a18ee3a88d5ea8593
SHA1 405d73139a0c6c5282711cb63024aa2f498b7357
SHA512 e4de5fd4e564ced8ff1652f53fb7388bb4deb1153d47a0384dd8772ddcbf16dddce1ecb5856fde0a693f291068e85274f9ed067651ff975f05d1dde9c813fdeb
TLSH
T1A4310210A7D5920AE1A28173FC3B67066F76FC02AB1D974B428C82591C95600B97BBEE
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 434c4b05b1e871bf37aa5bd851329be6015d330815e6022c701b7485a38c96a7
MD5 548f5786113619c5c991a5dfbcf0e561
SHA1 c6d1c1c9d0bcc06880a905eca55b25b9fef4ced0
SHA512 ce8df6feb6d096ad3f7496951f23fefbcf3d4e96febad7904f7e4d69bdf46f834a0c17de8c9db2ce0c19b64466388fa5337e0933c2fe0f2ec397c638f9409a8a
TLSH
T16771331067E5A10AE0A14573BC3B67057F37BC02AB19D74F424C825A1CA1600A97B7AF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3964-39-0x0000000008A50000-0x0000000008A60000-memory.dmp

Download

memory/3964-37-0x0000000008A50000-0x0000000008A60000-memory.dmp

Download

memory/3964-36-0x0000000008A50000-0x0000000008A60000-memory.dmp

Download

memory/3964-38-0x0000000008A50000-0x0000000008A60000-memory.dmp

Download

memory/3964-34-0x0000000006D50000-0x0000000006D60000-memory.dmp

Download