e79e7f3cc933dd1bc331194787ef9f9a53864b73389872fa4eb0a9b5fda12606

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0622 (1).mp4
Size 78.1MB
Sample260809-skgffsba75
SHA256 e79e7f3cc933dd1bc331194787ef9f9a53864b73389872fa4eb0a9b5fda12606
MD5 f8cd3621771fabf7a0cad3c46974d025
SHA1 4c28b9c8aa55b37c24d6b4b8af93b52c70168895
SHA512 c53d915717c0e7a882e4683605266da84f5b871b460cd8ec4f0a94ed98acf136d3a8d65523b79dddc9d9fdf3ca56e791bc61fe536e9c38dd019b2812017052c9
SSDEEP 1572864:2g7ylB+8ZatoozGCIBI9hLI6awAgN36VTKE8MwAVSTfOQoOK+cTw5:Z25ahq/6a9gNqVTjS2
TLSH
T196083365E6D7013EC8BD3EB080D61301B164CE1625866BDE5E8B1B31ED80BDD6CB3AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307618943189869"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D6607987-5C83-41D0-B8D5-884180C1EC7D}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
3376	chrome.exe
3376	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	388	wmplayer.exe
Token: SeCreatePagefilePrivilege	388	wmplayer.exe
Token: SeShutdownPrivilege	5092	unregmp2.exe
Token: SeCreatePagefilePrivilege	5092	unregmp2.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	388	wmplayer.exe
Token: SeCreatePagefilePrivilege	388	wmplayer.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
388	wmplayer.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1916	388	wmplayer.exe	88
PID 1916 wrote to memory of 5092	1916	unregmp2.exe	89
PID 888 wrote to memory of 1224	888	chrome.exe	94
PID 888 wrote to memory of 4952	888	chrome.exe	96
PID 888 wrote to memory of 3820	888	chrome.exe	97
PID 888 wrote to memory of 3820	888	chrome.exe	97
PID 888 wrote to memory of 3900	888	chrome.exe	98
PID 888 wrote to memory of 3900	888	chrome.exe	98
PID 888 wrote to memory of 2604	888	chrome.exe	99
PID 888 wrote to memory of 2604	888	chrome.exe	99
PID 888 wrote to memory of 2724	888	chrome.exe	100
PID 888 wrote to memory of 2724	888	chrome.exe	100
PID 888 wrote to memory of 4560	888	chrome.exe	101
PID 888 wrote to memory of 4560	888	chrome.exe	101
PID 888 wrote to memory of 4892	888	chrome.exe	102
PID 888 wrote to memory of 4892	888	chrome.exe	102
PID 888 wrote to memory of 3980	888	chrome.exe	103
PID 888 wrote to memory of 1068	888	chrome.exe	106
PID 888 wrote to memory of 1068	888	chrome.exe	106
PID 888 wrote to memory of 3264	888	chrome.exe	107
PID 888 wrote to memory of 3264	888	chrome.exe	107
PID 888 wrote to memory of 796	888	chrome.exe	110
PID 888 wrote to memory of 3888	888	chrome.exe	111
PID 888 wrote to memory of 3376	888	chrome.exe	112
PID 888 wrote to memory of 2204	888	chrome.exe	114
PID 888 wrote to memory of 2204	888	chrome.exe	114
PID 888 wrote to memory of 1564	888	chrome.exe	122
PID 888 wrote to memory of 1564	888	chrome.exe	122
PID 888 wrote to memory of 3356	888	chrome.exe	123
PID 888 wrote to memory of 3356	888	chrome.exe	123
PID 888 wrote to memory of 904	888	chrome.exe	124
PID 888 wrote to memory of 904	888	chrome.exe	124
PID 888 wrote to memory of 3036	888	chrome.exe	125
PID 888 wrote to memory of 3036	888	chrome.exe	125
PID 888 wrote to memory of 3376	888	chrome.exe	126

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\0622 (1).mp4"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff819d4c728,0x7ff819d4c734,0x7ff819d4c740
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6049360225840726714,14302311888872048788,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12456828539800408657,10246046824932281866,262144 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,8798564065242074491,8909300255281591338,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,10621970350636419039,2752254119824031769,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=1720,i,5183643278030959481,11670354403623039310,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,9127237120723829102,8947437887396440477,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,2488419181818939151,12926380734565157548,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,8209504123660455437,18008727567074029094,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,1564608253935007381,6318799813689608342,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5920,i,17122997947214219793,15466913053676507883,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,10276975868256379876,16655752222160843351,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,15933660011995619016,643098042201447226,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,3880914402245742811,12415740005599504205,524288 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3484,i,12719661339351610123,17501838120630101733,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4752,i,7618106174837299604,13981203778159347261,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5676,i,12198982310915431986,4019386320733960999,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6060,i,3709660331458092698,12888078106655840319,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3256,i,8468308313041312040,9740708565708447892,2097152 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6104,i,5925858117094850115,2609670101741975436,262144 --field-trial-handle=2020,i,13620576992967829743,12861870509405161241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9eb0f101-2a6b-42a8-b603-cc6d8ec6e287.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9eb0f101-2a6b-42a8-b603-cc6d8ec6e287.tmp
Size 115KB
SHA256 07a604f55dcd439bc0030584b93ea2cf9f730343775401bd28faafe424d2815e
MD5 e5bce3d8fcab64072b8735f3db477894
SHA1 b06075a5c76415ccac4f931bb57bf413d62dcd8f
SHA512 fcbe238100ea8521f831b5ab55ed226185f185db7b988f09efc664eb10e0ed8b61cb2d60673b154a4fd4542bf35042da6cda1d328f70dd20c0988ade27604522
SSDEEP 3072:/dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/0m7Rkm1tYpBeh2BAoM
TLSH
T1A8C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d1d3e558bd5c2d012f5af91113dcf05c3729396bc8a3136f4b8f5d48f10d505c
MD5 17bcb73aa4a6a5f143156acad023a870
SHA1 787c90ee5a6cdd9748e0e3a55ffe7e871bbc7b54
SHA512 3819f6d9a38cc2961f0467aae2004e7fbc1f2bab5ed884fb1121431ea5b133d762be395f18ca35a56dac5d5ccdefc42a992dee1759b86501a0b7c19b38db5c8c
TLSH
T1A6E02BA5C932AC3728F82718A4B54706E64123173A40985F3B3D910C4FB477AC586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 f6f780f85fd4d96205c513d62c2780f870dd61920f7def086b540c59eb309807
MD5 680169206fcfddfffa0033019d4e897e
SHA1 c91a2f9ce73b0ab9e8ca143e666fbbf7dd677bbc
SHA512 7fadef99a528370c4ff60174054dacd71b9dd38a0bd75e087e4f1e6c661624e5df76585b26ce7746750f862356cecedf39ceedd82e6e4358956082e68d6e5f2e
TLSH
T14AC02B55C040524DC7340D7114504C0002B0AD3D1112A1928081080668175F32D51403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f9b99c4ac3800280e928e70e94e2c4c179bec524d721a0999d0bfcee467be0a1
MD5 fc256bf0ca162675372e6027c1ca5a9b
SHA1 35322472d25d4b541fe435a02888d0cf17abb829
SHA512 14a0a7be2cb7961faae439a3baa8d47c1be9487f359c5a92eccf3d4b673698063fab2211523ae7610663ee10123764de55c9b101501bb3e12cca9340d642dbb1
TLSH
T18F51CB01D8C44CCDCB911C7715A599D72B3CCA16A7831E024797FCF07BDA3A81D9682C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 862b5a565db448388a6d13f6de306418c1e41d48f47c900000b16dfac8ee07d8
MD5 0e347e7373e2e095877fc013ff62b2f1
SHA1 7e521fe0c4cc1ad1e105df700d8ee6b951fcb825
SHA512 1816213e721ec38c773b5a0e18d1defa2e69357d05dbdd4912dc793316351536298983069d270a0e45d946e5ff770464c24bdee5ab346b821f67856f92d2da64
SSDEEP 48:YALlqvqAhKhxh9hRafo7XLskgmzsDVfsyoseKsNV+sqtsH/s1Ps+/4svcs4qzs9R:D4ZknnXaaV4V7ObVkMoR/v0dR
TLSH
T1CFA17CF7C3D8C62D991156F4AB257F1ECE2D0A28532C3C66C8D4AE5B93E2872D21064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fa584f16-43a3-4032-9935-4cfda2c0e503.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fa584f16-43a3-4032-9935-4cfda2c0e503.tmp
Size 8KB
SHA256 eace5e95aeceecb0fd0796e6986fa0b52cd9c716e7b8ee2700483f861a653e2c
MD5 18e268a07d6c192f096d512452dc136e
SHA1 61671362c2e51271c85a883783248404f839e9ee
SHA512 e26c77677483d7c14c1d85cac3c7a17028dc67db613d5401462722495b87752d5a78683a60230708c776c7fd906a522613e6b94b7d05f476e7d2d5247a197586
SSDEEP 192:D4ZknnD9OrJmh3lwRaaVC7ONo9yjXIkQIh8aPJzMSOvYfPp/NPZmmANmFmDmzmH:D4ZknnD9OrJmh3lwRaaVC7ONo9yjIkQh
TLSH
T12512ACF7C3E8862D991156F4AB157F1ECE290A28431C3C26C9D8AE5B93E2871E21574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 baac6631a8ab34f1d72cf3ecdcfbdc54438fee5728494c457ab974c21e32b75c
MD5 ec82a18e1df9baa351e53825c3f4bf30
SHA1 56d7d1c969882eb9437e18c0278d596a4b4b5e85
SHA512 bc24158e12cdcf054ed561024f995a4b76603e6c057702a8d775a632153edcd2aa7cfe08689b112124ac4569a0c22db64818f43fbf1fc03c43a8a6bdf515e9ed
SSDEEP 192:hRUntwxKujV+yv7MF+pAPRp2S9HHsb+WNnFC0fCaWT0VyIsnAUgtaJ:hRUnS0egoUX91wg0qK8
TLSH
T17442C52ABE112E7B6CCBD229FD267B53D7F5102125952E94EAFC992C04E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b3d5aeb92d7e4e53881627ef0be9eeaafa40274db00b5b2a125802a71592d063
MD5 dc9cc736ecc23f548b1a503637f3aa02
SHA1 e4a51cae4d748ce22557c5eda42d524c9869d1f2
SHA512 92a0e99a931cf76c974c987bec5040c4abaebe8d7f9fae8c15a9ab232350c724aa0c9087ba8508e36f1027b8281a574523fec37c0a2727eea3fb754e5f4d850a
SSDEEP 192:SRkcBzntwxKujV4yv7MF+ptPRpRzSeo9HHsb+WNxDxEtBlquBCaWT1VyIsnAUgrK:SRkmznSiegofX21wA2uQ9e
TLSH
T1BC62D66AB9112EB76CDAD22DFC26BB57D3F1202225D41E94EAFC9D2C04E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ccd84c98cea90278d9d282dfa3122dde9cfbb5f744e5b22767ee57547071e77
MD5 1d01e3eebf11948f853a3bbde171a920
SHA1 30970d92ef20644131bd7684e3be9b11390e899e
SHA512 b7bc502b26c22d29a01ee9a6a131d8edf8619e1f649a484a0fab1a82e2a0fe06e4e76a1f390802b23db2f2ff893110c4627279b7a3399a3bc212ca482cea21f0
SSDEEP 192:SRUntwxKujV+yv7MF+pAPRp2zSu9HHsb+WNnEtBklW8CaWT0VyIsnAUgtaJ:SRUnS0egoUXk1wMKWbK8
TLSH
T13C52D62AFE116E7B6CCBD229FD267B17D7F1102225941E94EAFC992C10E76CC221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6c117d15caf58169327f53b15e17df637864ec9cc757451137bd36d54430a5e7
MD5 55f206c61709d21a68255cff9e561707
SHA1 b04f4ae9d8415f52897c2e7089bad805cc498b6b
SHA512 02fa679d4a82f84abc296ccb8477c1a9bb0c39f22f686989395f819c2cbf2efde282d7d47ce735da9ba7971abcc5a78ce0fc4889b70f94f096bca328f8b1be6d
SSDEEP 192:SRkcBzntwxKujV+yv7MF+pAPRp2znL9HHsb+WNnEtBlqu9CaWTnVyIsnAUgraJ:SRkmznS0egoUXa1wM2usLe
TLSH
T1FD52D72ABA116E776CCBD22DFD267B17D7F1102226D41E94EAFC992C10E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8463e9ff22119cca18c9f7fbe20676128cd84b8fa2f60975b548df2b656357a7
MD5 9317d02047dd9a7e8324868b710b4107
SHA1 2e9b450608741e7f5cb40ac29a443468ea186785
SHA512 a36d8eda05a1f2e0a31750c6aa7f830d4dbdc750cdbb723f78129011aef32cbf479ccbaee32b235b76eb8c8736daa18697b656b4ddb62d80980a6f2abb715815
SSDEEP 192:SRkcBXntwxKujV+yv7MF+ptPRpRz3eD9HHsb+WNxDxEtBlquBCaWT1VyIsnAUgrK:SRkmXnS0egofXa1wA2uQ9e
TLSH
T18B52C61AB9112EB76CDAD22DFC26BB57D3F1202225D45E94EAFC9D2C04E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8022d825bc3ed3877e36650e24b7fc04b7672771b64e93b576df08c3e5b49189
MD5 11e96bd730c246964c586fad3ba5c9aa
SHA1 9e8fdd4129eaf3e1402a5d200823947c733ccc91
SHA512 8fcccaf4bce4f846330071eec5c990fbaf8756faccde32f18bc54146b79c242d77da3db1cffbd3fb081f207e0ca50a5c69abcd0c265a050d01bc5f19298ec8cf
SSDEEP 192:SRkcBzntwxKujV4hv7MF+ptPRpRpUSto9HHsb+WNxsXEtBzTIs/CaWT1VyIsnAUp:SRkmznSixgofX61wR+sK9e
TLSH
T1BE62C65AB9112EB76CDAD22DFC26BB57E3F1202225D45E94EAFC9D2C00E76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4799e1e17e6557d7a719093a736e125bcc3fda49b5df07020c3ea75ceedbb480
MD5 e68d109520fe8e7e52e335cc7ae41515
SHA1 08dcc70c19442c92d2af765421d4c0967dd6cab2
SHA512 2a8cc5e6f69b04d90b904b38dd97dfed9bda7f8274cf8dc72e949c840daad601217d66b58eac698c9826967144bb68c1fedd9bd88df415250c7fb6559e1499d7
TLSH
T181B01280C0016501C0120AF4114328D8B138DF10A60E17065BE06D629C3A5908014070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a62e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a62e.TMP
Size 96B
SHA256 4166b7dde60dc2f16278f80a93b2c870c09854eb228d78f21769c7b861f327c8
MD5 4db16e4e459af9993c88ed24f1e491da
SHA1 ed3693afb4d0ae351981d256eae931288810120f
SHA512 85b818fe46a6e7be69daaa9796e8b9246ed89f505f61ee6159d5c1189186ae7e4ebfde536bbd265ccdf63d60007c78b9862cc99465feb10609b69c6d99ee6d5b
TLSH
T100B00296C1027223D8520BB42DE599D97770DF29F603121A97E05EA6DC26A604529560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5dede9c6689507ebc52f438e0935c7a9bdfa0957385be3fe01336d944bd913b2
MD5 c6caa2067d4123078647b7f937a0deea
SHA1 3e96933ce6aea07e95f3fce6d9a7c6711f441724
SHA512 616e0805f6362bdf75bbe763869006b8f64e9a4a1682f7d2c47289e6740f1140abfb3d5e22a6ac7fed19276d6e04bcb0b94b95775f411de541ec7a8dbc285b23
TLSH
T10DB0220A2CC00E02CE020BF8A2C2CA0033B02CC003838BE3BCAC00F0C8333080320880
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b665727389adb01c19b2f7e95d47fc24b13595105ab0a434fcc9e9003f446587
MD5 2e327f7d97b5d4d8f99b09ca02ac79ca
SHA1 a51e98f386672ef5c4b445c5fb32f3d4fe4633ea
SHA512 ea6f681d405f1d7a50600ac296dd007ede7b0e5acdd2c61c101f9fb882ac5bcd2f6e08e04dd7234e9e10a99d442057a86235d8c5b87b2647bfc2e4ba0a131769
SSDEEP 6144:OAX4NwhgqKR4ILo59R57lOYo8gm7Rkm1tYpBeh2BAo+:OAoNweqYhLw/7lR9oBGcAo+
TLSH
T106342372EE326FB95CB9ABAF300C1B290FF29599D568E542C8C57A08335D9CC470893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7cbfaf739d1cefa9ef02407e9e1f3da54c7aeccbe3d676e1b3a39c8ffb74ecc8
MD5 12e0f5c359b571d6b081bcf520d72700
SHA1 c810fd0dd4f26a883d74f034fdf372cec880999e
SHA512 dd87ccb316748e8045c94e1c35a56e73d6a40a26b9692c5ddbef87271e16b7d560ca889de139e651cc5b1da3fd0a0d8f3d5cfa90e55f9d7932ad5d96bc7382fa
SSDEEP 6144:xvX4NwhgqKR4ILo59R57lOYo8gm7Rkm1tYpBeh2BAo+:xvoNweqYhLw/7lR9oBGcAo+
TLSH
T165342372EE326BB95CB9BBAF300C1A294FF29599D568E542C8C57A08335D9CC470893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 af2b0601128fa338aa82b333c55603f1647a1daed28776726f8153eab990c40d
MD5 6665b312381e61ebbcd34a6be0c7fda1
SHA1 96b4e8b25b10562915f7490813a834640e1e37dd
SHA512 388f3f8070bd698a29960c556db370f451254f9075853916a18fccbcee293c9fba3ef4162e347ec34f0178e3ffa7eeba5a42e85ed00aea6903d235d39e0edac8
SSDEEP 6144:xw5X4NwhgqKR4ILo59R57lOYo8gm7Rkm1tYpBeh2BAo+:xYoNweqYhLw/7lR9oBGcAo+
TLSH
T1F2341372ED326F795CB9BF6F300C2A290FF1979AD568D942D8C47A08335E5984B0993C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 d1f59a42c372feb81bd88d586c3bda40b71d14a9d8c7b40f413e21d40a72fe4c
MD5 b04f9f4f65789c7dce5c452f9eafcecf
SHA1 e26ecf35f502133e736a9e1c72b451cc537b2dc6
SHA512 9407ae9639b23e189156142ce76c075f40db54077c634fc54d40ea102f0525b3137a31e18b66bdd8af2da133afae74214458c7c27b49c860743534dbbf6b585b
SSDEEP 6144:OvX4NwhgqKR4ILo59R57lOYo8gm7Rkm1tYpBeh2BAo+:OvoNweqYhLw/7lR9oBGcAo+
TLSH
T15B342372EE326FB95CB9ABAF300C1B694FF29599D568E542C8C57A08335D9CC470893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 6009ba2b960e078ff66e87f5ec6e2553399106f1616e960ae38190f669593e83
MD5 8a2c63fd4bbf5316a51a06a9d72c04b0
SHA1 c5c85fc4a6b154895659cb9347832a44309ff6a5
SHA512 ff0b93c2f7170f41310a23a0ea1aaeb609801f7913306e3b554c3d9c67f12bc4a4d6f14503e3243d876b2e9679c4ebeb6918db5b1d5f7b0c2b352a235cbbd4f6
SSDEEP 768:U7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPJ:K9tQeoVYocxYCutFCJGAKt2hZ
TLSH
T1CFD42D3BA470A098DF3C35B2E2AD6B4CBD71641A22E006421F74B57F76337D8DA0A5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 100b00b54d305d7ab081cbf39e26215530c0a2ed87604b91724ead751dab20ae
MD5 aa2e61d41bdb42e49b7d883bfcaaf7be
SHA1 65228298c2e40307026e07fcfd6c1a3dca1fcd06
SHA512 1b758bbd780f6ae94b979034db0d78b4af37277caeef0ca07630e9a14b006d563a181f325c2d24ec27cbd3a7155317341c81d9dbaea30f7eac2b2c9ec76dbcab
SSDEEP 768:o0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaK:WZP2tFP3vqY8AqEM7TaBacg
TLSH
T187257437D190B0C5CF2C7171E9ED8F08BA23A10B11A052465FF8957A7A633D99D1B2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 0c8de563e99d8bec02aa091c4ec41b822f919131a56bd12f4e3ed88db6435345
MD5 81b8f250ef0d6904fea6851f035b04c8
SHA1 844f07f61bb283c59e04400a5f8277232eb09582
SHA512 7a3d8487cf9472ff3fefaefc81de3c240339bf8debb99aa72de6c6d8cd89e1ed1ee5ba45f23eb35e1166c9470ec17dfe9cbea4336edb5f9ec5b9aaaca9094015
SSDEEP 96:VtKFiSNVltoRNXtdUMUst17XtuUMbstJUMlstKOXtHL2tMLXt0tbAttt:zKFiSNmnynsna
TLSH
T1E463B65433FC564AF3F76E7069FA555B2D7A78A26D39E12C4210424D1AB0F1CDE30B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 77119e620d6b99c331927a30596442003748384d3852106f94a3646cc7f9e56a
MD5 393c1109a6d566e7a424dc62822b9adc
SHA1 7e28e020a452b38a651ff1e5b6d8c12ac8f28acf
SHA512 ad5a5f597241443c851ef29d7af4053c26a8d93ba7034937e8368bc8aba6f850874b7bdf24cb2687bf58839e4488f464c03f482523382149ad0427d5ef667266
TLSH
T10A216B571B4ED4708AE01BE71DEC8E25B3BBD7CA87A1D0A5B348A029480652D6B3D06E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/388-389-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-404-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-372-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-373-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-374-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-375-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-376-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-378-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-379-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-382-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-381-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-380-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-377-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-384-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-385-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-387-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-68-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-388-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-386-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-390-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-391-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-393-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-395-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-397-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/388-396-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-394-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-392-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-399-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-401-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-400-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-402-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-371-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/388-403-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-406-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-405-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-409-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-408-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-407-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-410-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-411-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-412-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-413-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-415-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-414-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-417-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-419-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-418-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-420-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-421-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-423-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-424-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/388-422-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-425-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-426-0x000000000A890000-0x000000000A8A0000-memory.dmp

Download

memory/388-71-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-69-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-70-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-67-0x00000000066A0000-0x00000000066B0000-memory.dmp

Download

memory/388-57-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-58-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-52-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-53-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-54-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/388-55-0x0000000004360000-0x0000000004370000-memory.dmp

Download