hxxps://cyberleek[.]ar[.]io

Analysis

user interaction
yes
max time kernel
899s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cyberleek.ar.io
Sample260819-psep2sbj71

Score

6^/10

discovery motw persistence phishing ransomware

Malware Config

Signatures

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
134	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	2492	chrome.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4092	1228	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316165278547022"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A61DFC6C-927A-4A8C-9B06-7F76946BB0F2}	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{09FFB024-ABE7-4EF6-9235-77CAB74AA13B}	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3B6D5A45-BABD-4B83-9D1E-56590FF086D6}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4912	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3132	chrome.exe
3132	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4912	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
1228	wmplayer.exe
1272	wmplayer.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe
4912	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 980	3480	chrome.exe	88
PID 3480 wrote to memory of 4972	3480	chrome.exe	90
PID 3480 wrote to memory of 2492	3480	chrome.exe	91
PID 3480 wrote to memory of 4972	3480	chrome.exe	90
PID 3480 wrote to memory of 3656	3480	chrome.exe	92
PID 3480 wrote to memory of 3656	3480	chrome.exe	92
PID 3480 wrote to memory of 1856	3480	chrome.exe	94
PID 3480 wrote to memory of 1856	3480	chrome.exe	94
PID 3480 wrote to memory of 4236	3480	chrome.exe	95
PID 3480 wrote to memory of 4236	3480	chrome.exe	95
PID 3480 wrote to memory of 1796	3480	chrome.exe	96
PID 3480 wrote to memory of 1588	3480	chrome.exe	98
PID 3480 wrote to memory of 2684	3480	chrome.exe	99
PID 3480 wrote to memory of 1588	3480	chrome.exe	98
PID 3480 wrote to memory of 2684	3480	chrome.exe	99
PID 3480 wrote to memory of 1232	3480	chrome.exe	100
PID 3480 wrote to memory of 1232	3480	chrome.exe	100
PID 3480 wrote to memory of 3204	3480	chrome.exe	104
PID 3480 wrote to memory of 2816	3480	chrome.exe	103
PID 3480 wrote to memory of 3204	3480	chrome.exe	104
PID 3480 wrote to memory of 2816	3480	chrome.exe	103
PID 3480 wrote to memory of 2596	3480	chrome.exe	106
PID 3480 wrote to memory of 976	3480	chrome.exe	105
PID 3480 wrote to memory of 2596	3480	chrome.exe	106
PID 3480 wrote to memory of 976	3480	chrome.exe	105
PID 3480 wrote to memory of 4416	3480	chrome.exe	107
PID 3480 wrote to memory of 4416	3480	chrome.exe	107
PID 3480 wrote to memory of 2948	3480	chrome.exe	109
PID 3480 wrote to memory of 5340	3480	chrome.exe	110
PID 3480 wrote to memory of 6012	3480	chrome.exe	111
PID 3480 wrote to memory of 720	3480	chrome.exe	112
PID 3480 wrote to memory of 720	3480	chrome.exe	112
PID 3480 wrote to memory of 2864	3480	chrome.exe	113
PID 3480 wrote to memory of 2864	3480	chrome.exe	113
PID 3480 wrote to memory of 1268	3480	chrome.exe	114
PID 3480 wrote to memory of 1268	3480	chrome.exe	114
PID 3480 wrote to memory of 2200	3480	chrome.exe	115
PID 3480 wrote to memory of 2200	3480	chrome.exe	115
PID 3480 wrote to memory of 4152	3480	chrome.exe	116
PID 3480 wrote to memory of 4152	3480	chrome.exe	116
PID 3480 wrote to memory of 2444	3480	chrome.exe	117
PID 3480 wrote to memory of 2444	3480	chrome.exe	117
PID 3480 wrote to memory of 4892	3480	chrome.exe	118
PID 3480 wrote to memory of 4892	3480	chrome.exe	118
PID 3480 wrote to memory of 2164	3480	chrome.exe	119
PID 3480 wrote to memory of 2164	3480	chrome.exe	119
PID 3480 wrote to memory of 5548	3480	chrome.exe	120
PID 3480 wrote to memory of 5548	3480	chrome.exe	120
PID 3480 wrote to memory of 1740	3480	chrome.exe	121
PID 3480 wrote to memory of 1740	3480	chrome.exe	121
PID 3480 wrote to memory of 4432	3480	chrome.exe	122
PID 3480 wrote to memory of 4432	3480	chrome.exe	122
PID 3480 wrote to memory of 5140	3480	chrome.exe	123
PID 3480 wrote to memory of 5140	3480	chrome.exe	123
PID 3480 wrote to memory of 4648	3480	chrome.exe	124
PID 3480 wrote to memory of 4648	3480	chrome.exe	124
PID 3480 wrote to memory of 612	3480	chrome.exe	125
PID 3480 wrote to memory of 612	3480	chrome.exe	125
PID 3480 wrote to memory of 5044	3480	chrome.exe	126
PID 3480 wrote to memory of 5044	3480	chrome.exe	126
PID 3480 wrote to memory of 1744	3480	chrome.exe	127
PID 3480 wrote to memory of 1744	3480	chrome.exe	127
PID 3480 wrote to memory of 808	3480	chrome.exe	128
PID 3480 wrote to memory of 808	3480	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cyberleek.ar.io
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb19ddc728,0x7ffb19ddc734,0x7ffb19ddc740
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,16217190689351669862,7346188866559995395,262144 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,7298429775783483425,16435597610371139487,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,3356083961818164616,1908481002994683442,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,11625399972540623590,5398667606499720933,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,16553798208186804745,8615105820277625632,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,13869785653158250475,16236627370522356633,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5316,i,16487319878239890430,3056551426618305751,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5348,i,8166139236493821220,12165929243088530351,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5268,i,3820434117868315141,11087505213957029083,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5772,i,5147753275672334126,2400206747919410690,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5904,i,10051878088258696873,1483264917673339452,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,7788648466571897621,7992092706015259907,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5468,i,11538792814598169017,675475784572209816,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5956,i,3400553910563567437,15718992070125657124,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,16941614780965928485,17946795955917153107,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,2692586217594587236,12869559156629573100,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,9768880125906160834,11987630488913445561,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5456,i,18411679757665514220,12120073035061536320,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5664,i,17263841691397956470,10972302478647050579,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5452,i,1588457512568600650,13685890250612310520,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3380,i,567119826170040404,8167799898119262144,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6092,i,12761523887700235212,14632707542738877687,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6320,i,13064296378822962497,8147148595991358484,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5296,i,3346940582396309538,11367547953080481242,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6200,i,15164156662879321879,11568267583672190366,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6532,i,6067370230706953048,9294838577796887106,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6452,i,15760922553408348416,4835540386532704745,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6788,i,14915526688373441912,1602780601031752560,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6808,i,10254356324871129492,5992696181621700672,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5428,i,1499151472078211608,12259106664551767892,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6400,i,14234886860371379376,9372650737141112890,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6788,i,17314018956978455788,6747435216449244894,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6112,i,5855932466528269631,8421904850640764531,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6284,i,9630776492878121676,6652690397776353906,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6244,i,8106596577487199460,18025192903093872101,2097152 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7072,i,4303060061047260072,7070678335522970610,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7076,i,4457721270811030308,1984356498318834468,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6388,i,14179877696175407002,4480039111023832297,262144 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,8593196379572207169,5521485697321420076,524288 --field-trial-handle=1924,i,17851405504854717726,15451375462167322058,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1596

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1228
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 4352
  2⤵
  - Program crash
  PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1228 -ip 1228
1⤵
PID:5476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4796

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1272

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\video2.mp4"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1464

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 4e96874ca1f92fe453cffb3c7477040857392525b38bc2ddd057b0b4c89a2ab2
MD5 6181fa14ef547d2495cce8618b35c092
SHA1 5949cd388e9f227dff860128593a44cfe569b0b7
SHA512 59e2bfd5b99bf5fbbaea01636727fb2b91c591c66ae4916c8c781ec060e5c323ed62beee8506816679bd97a831a6d090005ca1b8d65b9cc134cee447fcc445ab
TLSH
T1C1B0120030814055C3440370A494048071A01D6409130B0186EC045B44027B0CDC11C2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 912B
SHA256 1f98a7814c2a94b57d6685c13c55d8c0f1280eb222986d72c9f1591322b0f5dc
MD5 eff8e998ed808368565b60699e98d96f
SHA1 e2d5b98a331541f93dcc846670c22af45b4b6fb1
SHA512 2a140d63b07dba733b5181a5296775aaed4b9aa4e34cfce245fc45a41a01ac8c3cfdd0c10ae0250a4ede1708dd220e813df2699b191609a7aed69d50f1d942ce
TLSH
T1E4112F3211CC3196DF30A97100928D5071F3D79B22DE1BA7D6845E6C88A3AE8E6DD159
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 0eaf0f92c17bd8f70ea738d2159d28c3f628a38ceee1acb8f8790e0df12f239c
MD5 555ad9b22feb9632657704a5e5c5d1cb
SHA1 255a3cae06f13769e22f5687577d719159f10603
SHA512 cba449b7875b7e300241a3d6843bdf71b7e91ef7d2d893791684b80ecda01f934de4b6338ac5fa919ff09d362196603213a9b21238875cdeb2ba15e9428d9525
SSDEEP 384:Drbp+ZiT7JGG7IvgaIad2DEjZUNC+sy6qKKgg3qGg6Sh7AstUY3ySR/UNPiZGe+0:K+IV/9
TLSH
T191429EF783F5462DD91252F09A14AE1BCE6D1924832C3D2AC9D4EF4BA3E2471E24179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 a85bbc936839ad7c5396ee7a9e15f47c45a61d8484726562d31fbe125950f9da
MD5 64e849d1a0849fe2b99ed542344044bd
SHA1 0daad5caad6170be7e410c88361b6e8443908c59
SHA512 113fcdde61a7d46fedbbcc61cfaad122aafd07578220859ecc2b08bc79f583dcad74631b4c13f005cc9b09ef8d4766b23379fccb84cc539167ebe79ff34cf82b
SSDEEP 192:DmaRHJKdLAuJ+Pk7IvgaIadYDEjIUNC89L2qnqKKgPY3PiGg6Sh7AstUY3yCJR/2:DmspKdLAW+Pk7IvgaIadYDEjIUNC89La
TLSH
T10232CEF783F4462DD92292F09A18EE1FCE591524832C7D79C9D4AE0793E2572E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 33d59e756a4e9574524fc5b2d1ccacf675d39c5c4eef863e46d7b58ebd5ee5ac
MD5 d0d0b614426dffd69fe2dc2d27a1650b
SHA1 16fa68c0e626abb47ba016aecaa46a2054ed0c22
SHA512 3e87b5a5641dce9545887322dbebfe07e1a8095939221fb9872cdb5090f9b156688253044d1136ecdcb8a70d9b614c2f06a67623d6087394a76e6dcac924d1a7
SSDEEP 192:DmHJKdLAuJ+PkDpe/QpaIadYDEjIUNC89L2qnqKKgPY3PiGg6Sh7AsxUY3yCJR/J:DmpKdLAW+PkDpe/iaIadYDEjIUNC89LN
TLSH
T1BF22CEF783B0462DE92292F09A18EE1FCE591524832C7D79C9D4AE07D3E2572E24179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f7ca46fc62001e6943ab7f5097d757368392adc4c58a59a5e68c5aef20dab3a9
MD5 15aec5ecb84cb4fd4f66be21adaf9725
SHA1 3144d39cedf776fbded68a142d513228ef27e583
SHA512 2b9312f6093eb34d000472680d91c24bbd8ed2714000d50899a5a0652146a0d9f527d0628f044061ef26e24fcb91eb03699a60d0df25030879b8dcce6a8bd008
SSDEEP 192:DmaRHJKdLAuJ+PkDpvgaIadYDEjIUNC89L2qnqKKgPY3PiGg6Sh7AsxUY3yCJR/n:DmspKdLAW+PkDpvgaIadYDEjIUNC89Lj
TLSH
T18632DFF783F4462DD91292F09A18EE1FCE591524832C7D79C9D4AE07A3E2572E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b3119d9fe0841587e396ac32e83b5d3d8ed980b3a8334fecdb3362b6c3794e57
MD5 f51ae262316f7a19abaac12bba8c2623
SHA1 bd4dfe409a0926705db6433fa0166ef56a842a3c
SHA512 fbe0b6bb44f292768f7fb1ab7a4aa7e1cc11b0404dabd9cbaef4750c466b2dba58184b36fa956dc5662b645a97836621dcc633fcd86fc9c24573372c845822d5
SSDEEP 192:DrRRHJ+ZiTZtJJOaIaddkSnFNHGemEjZUNC+sy2/GnqKfJgPY3Pl:Drbp+ZiTZ7JOaIaddxnFNHGemEjZUNCS
TLSH
T165F17EF7C3E5462DD81151F0AA25AE2BCD6D191483283D66C8D4FF4BA3E2471E24179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 99e40eba85d0aa5a46680d961f09433389eb6d83a1fb39e168d766f511e2ed16
MD5 66547eab9342616f24ef99218e7b11e2
SHA1 9e9eda323258c01c0ad622bce8110532f25c0da3
SHA512 dc0f7244388e3f5b1ca12fdc783bc50a676c6012310c0c511f5a5164fb8b2a9583b7c8b34ed0502e1bb13869752dcf4eb37496dac00621e554fe7a5e63f78861
SSDEEP 192:DrRRHJ+ZiTtJJGG7UaIad2DEjZUNC+sy25nqKKgPY3PiGg6Sh7AstUY3yCJR/UN7:Drbp+ZiT7JGG7UaIad2DEjZUNC+sy6qv
TLSH
T15F32AEF783F5462DD91252F09A14AE1BCE6D1924832C3D6AC8D4EF0BA3E2471E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 5626c774bc3761570c8da4a587a132a37e44e9deb410d3fe700fed487c731a37
MD5 cc5133d11a60ee1bcabdb10f2a3d5cd7
SHA1 132aa9a9a0e08b89322100b1df5565f0710fb854
SHA512 309a4c7af33784e7193719397b3b6fb2e6096874197b18f38c439dd289aba61a17580db9d174a9fcb7a7b1994d5db38955da26f12a547a1b196c3fb267576c49
TLSH
T11D515BA3D1BFB85B50BD487F4D0AB8055D7BFC31128268F5DEA6912DA0E56F34F02066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e2158240466224a9497a01c86840977b9df34daf481bef7c52bf84bbf781df08
MD5 5f19dea5c13f9f4ea43a5ad33fb3b6ef
SHA1 f4c89a93153a11387557f6e16b9dce87f25a88b9
SHA512 1f0dd682085f8a06da05e424205a7900fbd72c964a293f17210d069c76d6197734c3b14a5a5076fb3bf4fca632f03cf2bef3c8e6f35507589e16e2c324328367
SSDEEP 192:dRe6b4UoXv7DvAPRp2j+l5964Hsb+WNnY5tyL42D2PKGkwu76aVyIsnAUge:dReoro/H6X0abwmK42S7Tae
TLSH
T16E42B63EBD64297B6DCBD22AF9117B53E7F5002225942E84E6FC892C24E79CD3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3800271662cf79b41db8ec72cc18818566c9a3d5d956ac7fe03ed68ce302745d
MD5 430e9c1bc2651f8988c5a3a800287eef
SHA1 5a13a4675eb3ae38bde00dcc973ae4c17b77b570
SHA512 6be54d701dff8f4446548f25fa75e7ff3b445564975d9f52043667ab5b8896cb549535b05c7d14c56287315466ef6dd3352eba5ea8108868c0c34c1b402d8929
SSDEEP 192:dRe6b4UoLv7DvAPRp2+b+lM83964Hsb+WNzYLY5tnjEns2PKGkwu7kaVyIsnAUgE:dReorozH6X3obwEq1Eb7RaE
TLSH
T1F842B63EB96079BB6DCAD229F9117B57E7F5102221942E84FAFC892C24E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fa42d029e31e444c931a9c06a9687189817e5ff78f74fdb6104da3cb2527fcf8
MD5 35d77f3b91365bc2bd8beddbb4e27300
SHA1 cd032282a51258da579982edc1829c57b6232a78
SHA512 a226fa6c4c668ea2539eaa3ce0ef60e605f7e4bd0919fb472449ee83f2c62a4cfd96ee0fee1b5205b6ed6fed015c5d409a5bbd950fb6bfbe473e11f595b67a1c
SSDEEP 192:8Re6b4ioTv7s3dcPRpkq8pT+l71Ir964Hsb+WN255HL4tSnjvpPYff2PKGkwu72p:8Reo/orcAXOLbwy4ARYW71aE
TLSH
T1EA52C87EA96029B75CDAD22AF8157B56E7F5102225D02E84FBFC892C25E7ACC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3585b407b7e81fcee825b1efefe94299cb69c520724248766a6eeac638c331ea
MD5 a6698a23c3404494a2b534f34347980f
SHA1 749c9c027219c1bf46b1bb9f6d34d34e5519c63f
SHA512 79ba8db9853ca5ca77c9228c297e22c98186116a037cec0898986cb8d39c2306a8031029368edc64ae2e1e6ae112ca52c5770f3997159ffdfecc0ce3713c088d
SSDEEP 192:8Re6b4PoTv7s3dcPRpkSxP8QT+l7nCrIr964Hsb+WNvhNOCF5HL4tSnjvpPYff2z:8ReoWorcAXfZAbwv34ARYW71aE
TLSH
T17362D87EA96029B75CDAD22AF815BB66E3F5102265D01E84FBFC892C24D7ACC7213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 af17dc39d5f1f48d60af2e5225acbfec4a3abb468716a8d792aa7337bc444685
MD5 c4c98e016f6aa74813b1447dfc14b4bc
SHA1 5011d4fdd0121eea3e96cf48eb45a649444ac957
SHA512 28ab6c771a72e3ee322faba281ff678febda2a61b65fd906df24f693971ce76446184940a3a00a3c1da30deca402cb87ccd8de7f4cc090082c3df40c54244658
SSDEEP 192:8Re6b4ioTv7syPRpk+b+lM8r964Hsb+WNzY3HL4tSnjvCI4eBf2PKGkwu72aVyI4:8Reo/or/XZIbwEX4Ar4e871aE
TLSH
T11552C73EB9202AB75CDAD629F9117F56E7F5102225942E84FAFC892C24E7ACC3213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 50521c8391699a9f3fe77fcd5281774e32eb8f10a6092ab19d872e9349b9a8d1
MD5 81c8bef82af2529d37d53d915d3298a9
SHA1 1404e9b54c5148542bd839df6c0e6352fdd582d3
SHA512 7b255f54e4248dce8836ff3c04b9b6061c7e1508e9c1530d4620e08ecd27149edaf1a4ef04cdf75bf93e31809bcdc6da8c38e994911386dd65c6ff08bacb8bab
SSDEEP 96:6bJod+cAOIt5aDVmufj7Ic1Sl8h4otop5F0IDKB67Gov9JbQDQNRNC39ISyVNCFg:6toLA/TE57viU2DajEbQDQNuCMJWf
TLSH
T104C1F778A8AD6DAB5CFAA495F1433D43CEA8611BA9253E58EDED0E0C01D38DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 c82dcf50c026a2d8672179955be7a6f6566ce5b1e2083f45b6fe31b8e5cab4ec
MD5 356f23a533318a72f24b6dd0d31a09ee
SHA1 ef09cea78135bc4884863df48f7ec62072e21544
SHA512 d8e6358faebadd0e600fde8e674d8f5ca5de4117b163bb33d248fe4c73face7ac344d66ff7a9a4213a0ac006d8f0f45ed0106241fa3c9acfb3467c17323b2eb7
SSDEEP 192:6t0LA/TE57viU2wajEtFGSwa7DQNuCMJWl:6tGthvoYtUUQNuCMJM
TLSH
T162D12974A86D6DA74DFAB490F1837D43CEA8605BA9257E949CED4F0C01D38DC1383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 af0497fbf279a5e3101abd547eeeef3480245102e008cd49290280b6a1be9295
MD5 bc3c2c6f5340414332ab8025c079c13a
SHA1 1b7c9af095c62bb178b735d47c1201b0b1096898
SHA512 d302f4df3ad2cb33ff8d2af9df44a70f2889f505b39f0f30f65ec7eac50bb0476783b1e329d8ac03c873a8bcb882f9219c59935cb0aac4d18c2f28da637da2d2
SSDEEP 96:6C0d+cAOIt5aDVmufj7Ic1Sl8h4otop5FpDKB6xGyv9JtFiO0AuSwWmSDQy0j9IN:6C0LA/TE57viU23a1+tFGSwXSDQyUZvS
TLSH
T1E2C13974A8AD69B35DF6A590F5827E43CEB4A027A9216E80CDED0F1C11D74DC2343623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7a829d71aaa3f15d7cf0bcd5ce380d81193d03bad7f5bea3f8b7b691994e92d4
MD5 bd68c5c4551bd11f243d31d7ff5a76e4
SHA1 e6ab3d1b1ed4101de15599b7224a40647c16df9d
SHA512 b63a85ba43f038a06571b2cff64de615e8eeb00f42ca3d7b67997af5b6e1360e336fd9f9317c90e30dac72426b602ca3f82c20f58a3f2c93fc7334683784892e
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5FCDKB6/dGyv95SQhbb2Jv4a:gC0LA/TE57cDUDqaUweSQhbKl
TLSH
T1AAA10875B8A95AF75DB9D584F4827E83CF68A117A9226F80D8DD1F0C10E74EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 23d378273fa254c012b3b5f3003892f86220cad1906b39bd7efc767b76e66771
MD5 28cfcb1b7e0553428e1517aa4115f15d
SHA1 fc9940f9cc6c45e803d84e0e2d8b77eaa319802d
SHA512 646af896be059188c3344252b7e651bfceadd0d4ba83f0c449db1052c7a39385dd88cd087b2371c425eff1c7cd19bdb131f668fda9386880be3c42114d36bbae
SSDEEP 96:6bJ0d+cAOIt5aDVmufj7Ic1Sl8h4otop5F0IDKB67Gov9JbQDQNRNC39ISyVNCFg:6t0LA/TE57viU2DajEbQDQNuCMJWf
TLSH
T149C1F778A8AD6DAB4CFAB491F1433D43CEA8611BA9253E54EDED0E0C01D78DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1c943dcdebc90536a24d24cc6f77e2c616824edd162b70f6a6157964ff52ea02
MD5 bf8ecb031694e56097655009cd393e57
SHA1 f4a7b2fd96ebc15e1f69f82a9abe1506d46d0aad
SHA512 af11357231357466c4c8ea0bd85398120180cd28bfff5928a14bfe898b87e27c0e0129b0a5be9998fdeb84491b40ebbd008694fe4e8395d4ebf1eaceffd2a232
SSDEEP 96:6bJ0d+cAOIt5aDVmufj7Ic1Sl8h4otop5FSDKB67Gov9JtFiO0AuSwWmSDQy0j9c:6t0LA/TE57viU2eajEtFGSwXSDQyUZvS
TLSH
T1C8C12974A8AD69B35DF6A590F5827A43CEB4A01BA9216E90CDED0F1C11D74DC2343623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 33cc5f4aae5239166ca10fe41fd62dddcf40aaab4084949666a1a599038d013a
MD5 3d48a9ae98daef041e1d2b3dcdca0c18
SHA1 53b3082931b2e54f6ba79b86f40df013584fc8cf
SHA512 01d92a796a5348792c84e83c1d765151f9feda529a7bb51d6569cc952df28d3c1652e5a6705029755fa58a637e2ebb91661c26dd1968c0dd30f3e82eedaf7c07
SSDEEP 96:6bJ0d+cAOIt5aDVmufj7Ic1Sl8h4otop5F/DKB67Gov9JbQDQNRNC39ISyVNCFXw:6t0LA/TE57viU2lajEbQDQNuCMJWf
TLSH
T119C1F7B8A8AD6DA74CFAB491F1433D43CEA8611BA9253E54EDED0E0C01D78DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b74dcfcd65938e081641e2858e4756d0bc6bc5b2cf422a75ee4e8993ec799218
MD5 9a1555c4ae4b52e9be7f5b20c9cac6cc
SHA1 9cedc1c1d2c9623a95a5f7ff93efd32f2cb2c23b
SHA512 9b7d27c7da2e2078f48f25adcae04f162b5c0643e101d158101d6d015c6755ad40406246a145daf008882f79b9439dd01d74ba9219b9ef8ef2133921ebacc454
SSDEEP 96:6bJ0d+cAOIt5aDVmufj7Ic1Sl8h4otop5F0hDKB67Gov9JbQDQNRNC39ISyVNCFg:6t0LA/TE57viU2YajEbQDQNuCMJWf
TLSH
T1D7C1F778A8AD6DAB4CFAB491F1433D43CEA8611BA9253E54EDED0E0C01D78DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 3fc7d5abf880606a3f2e61d6a3802b4e4d34cac2fead9c4c6d4a8915de5fceeb
MD5 e0313b97b2279c7abc59f4843caf7ac5
SHA1 e7d1590b0805df6b74672d81ba6f29229f513b41
SHA512 be25cafb9e629f4f841765953a269d52df26a5181dfc08fa4d0ede4c81a78a60bc49bb0e88bbacf74a2b358016b2eab07ec31cac71ded9a0766cce0b66191f95
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:a69tQeoVYo
TLSH
T17C843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406425FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 aca10c45557f2245b34b3bd2f8f578ce1c2b54d45b140421f5b0b6f1d5cf975d
MD5 dc070febc667647b2168b3d29c4e28f7
SHA1 42d6fdc8fae358bf2d82709f054b5c290d9b30a5
SHA512 50f55aaf2ba73ac653766492cb9834fcd4e492c64a0466e90dcd09eaae613178a689d7b735580bfb8e6f93419a2d98ab869bb761c432159878b9f082b5e00446
SSDEEP 768:60aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaf:UZP2tFP3vqY8+qEMsTaBacgs
TLSH
T181258437D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1.2MB
SHA256 8a6edb8e0a4634e7867a62ff35d1f1b227f58bce387dbc87c0c1cd858b86e11c
MD5 484fcee01d26c48f7fbd3c92e4d45253
SHA1 03dda72c5eb44c124fb20ccc25701984fadde144
SHA512 2215f34f4a34776477f23f54fc39208a32dfd7d9d79206a2dccc584d57ed575e33427339fef8614b82ac95ce9313da317a53e619c30a6c1c94026871bd7ec1cc
SSDEEP 1536:MZdnMUtFP3FXY8+qEMsTaBacXpwFBUU2KO:MrnM0h+hTal
TLSH
T1F3559437D150B4C5CE2CB172E9EDCF09BA73A107129062465FF8A57A7A633C99C0B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 c51b8e298786a89338d75fb759b0064deb53e066e13a9d937c7ebfbedf6bcef8
MD5 8d8f5255ea3980f11581313738c06854
SHA1 717e7745ec3cc67defc94ef9e65343f788e7a4ed
SHA512 bbdc7a8c8e06b1c44442bc64e3ef0a2ac81cbf5bd213171dafc2b7e3b82325df78289c633ee38a2d206e88fb95c8f71bd4a6829769bd6eb6ee9358b8b0ad13a1
SSDEEP 96:eHufmsTvltGNXtzUMUst77XtQUMbstCyUMlstwOXtJL2tOLXt6tFAtjtBXh:eHQ1snCn3yn6R
TLSH
T1F363C56416E8A749F3F76EB02AF656561F7E78A06E35D24C4290424E1CA1F28E930F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lastplayed.wpl

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl
Size 357B
SHA256 1d0c653ed4d90410589ae512ebcb23eab159403fd274e643187c9a6b4567b61f
MD5 6a96b6f86988e01dd5e8f5b6f2e388ef
SHA1 f5b0b548546471b2389777a246eca76051a44321
SHA512 cc11985ed41916fda6d7ad6d371f031015eec550da7d365068ab8c4f1c21fb2cc9becd0641fe41530584b6a185d9cb9d6fe49314cf06504913a204484310d45d
TLSH
T1B5E0C237B1C47E229AB170142683FA63FE70288342461681B0CC32CB4FF2E95C3C31A0
MD5 SHA1 SHA512 TLSH

Submit Download

wmpfolders.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmpfolders.wmdb
Size 682B
SHA256 d8a42cce4862ec8d4ab8b6dd284cd2659d0ad3f22451d5ac1be748a820f5d4be
MD5 3eb779c75391aefb7b27eb92fe7145a2
SHA1 29e43728de28241d6fb6787b9fd61b70662ccab1
SHA512 30f5e7a515960d461a26fa28fa9660ff4a91ddbcdeb8112b4794216aa2c4d9baf694886bce31d5108a80147732a144b3ca4464dc8ae91ea3665003aca67c6d88
TLSH
T14801A41213FD5206E262ED08EAB144171EA33D92593C544CC0AB1E0E4AA3F8A9913FFB
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 44edbea33470e70327275c2ffcf5f94eadf2c3c3b83bf591e717b7b375e008b8
MD5 2e443b1bd32a5dd6ca16602853021985
SHA1 881ddee6b4c9cb267900ec35bf832d9103ce10f9
SHA512 9e774f2c4b35124cccbf7d19101db3844d0b6efff4de85c03c1e2dbdee8c826ef2e3c60a007e61cecbeeb25d3dba135d46bcceb20ce3d0add6a2441d6c3c2ce7
TLSH
T199218E574A0AE4B1CE6287B358CC8A27B3BAA7DB5354D015B3CAE01E894113F233E17D
MD5 SHA1 SHA512 TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 b56f378a55b2c56e4a0e45143a52ef0df1b9bde2652090960cf7e9ed0bb63e40
MD5 1498def06373bf643cdf0251fd304c7a
SHA1 1b827787bfcf9a952a1ab5b9abe64fa07f7603e1
SHA512 7163a48ee098d25fdfe413bf42b3f3b1341f5b741404c360054e2c32646e7753bab2c267122e43fa798649766d99a7bcec8b7606665de88c2129c1010f0e77a7
SSDEEP 96:+ghybZeFfVYZNOsghybbU7h9lOtghy0vmFgFOtrghyfOQ8gfhygLODs:7y9NiyHUl7y0QIyf7yE
TLSH
T1FD22E3517BFA2E15F1F38B72AAB237114F7FF81259188A0E4281820A0D71E105DA9F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 9a9d3b6f2c48d9d3709f503fd4b34c102ee480cb3bb2a96b4f74b3863ca5797a
MD5 50db83d5c4865a7332510b691001de2e
SHA1 a40f05d8a0b71778fa485d54335852b181b622f1
SHA512 636accecb1d8c75d4f0d1a2f531269a8abb1eeaaae8f6360e8315de2cbb4a0445741f6663749a022b4bf1bea020bfb2a39ea2117ca12194d303c13de1ca3cc7e
SSDEEP 96:vjCy0vmFgFOtYjhy2ePi/ymNnYwgXy1Cfbcadb0py3OnjhyfOQ8gMhygLODs:+y0Qoy2ePyyyYHy45b0JyfyyE
TLSH
T10C02FD512BFB1A19F0B3CF71AFB677614F7FF5125A089A4A0181420A4C61E10DEA9B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 beada21fa85d7244ae8d1a9c0b589a9301e299f9435d83afc0c8f16007941174
MD5 c878342346a984dfe82c1aeff9b64ad7
SHA1 43c07ed67c4d9ccc0b7b8795ddeb2149a879663d
SHA512 f34d78e630724cb652b352509aaa50c245e342c68a24dd0ff1086aac8776e7f3cf07196dfd0ece95a22ba98e0521523fc9dae91e916894e1f2e328a374d3a66c
SSDEEP 96:+PhybbU7h9lOtPhy0vmFgFOtYPhy2ePi/ymNnYwgXy1Cfbcadb0py3OnPhyfOQ8x:+yHUl+y0QIy2ePyyyYHy45b0FyfmyE
TLSH
T1F5220E512BFB1A19F0F38F32AFB677614F7FF81269089A490181420A4D71E109DA9F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 189f23a19fab2878c5c6c7acd8cf698cb19dbe0d63f366f9f4dc599d823c7b38
MD5 2baa9db2e931c355c7203d3aecfb229d
SHA1 4e83e6c5b1f7408e24e19f090d46479c20c9173a
SHA512 5cc104dae207cadb63a3a611473fd730474e39a2e8c9a9d08cf49aef4adf600a471e575959ce0aeba72bf1a795b6c55009b7f5c69b8ae276918aef6a91fe126d
TLSH
T11F31051097D5260AF0A38633BD3767056735B806A61A8B4B024D514E4CD450479BBBBF
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 2be61d03b0fc197a312742bd3000e7f9d52fe85c2f23985544539ee7528a945a
MD5 eaccfd8340f56ec373cad4fb3e0dc028
SHA1 abc38cb2b65bd85bebb09ad8d7a6b0246d2b2039
SHA512 c5d90dcdbe2be2311cd5015b8b7fedcbe10962627f3e5db28033d347e3b06a6d6478e26e824ff5ccff4dc738079ae2f600904da27916b5dcf1a0092bbbd8c5a2
TLSH
T16F71271057E5620AF1A396337E776700AB35B803A616C74F024D514F4CE4600B9BBB7F
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 b98ccc08eab5e06a1ca231f147614feb265e9e2b88b3c53b2305ce34d4d7638e
MD5 0be154853b424ea200cf7143e417e29c
SHA1 d887517eaf2b173437679c8babb5f66c2ce2e633
SHA512 a6c3667bfa3574c48117556c9a46ab1ccc89d59999926de83bb93b2afe9d4c206294968eb2adb76ea783765a93d015807c797baa044bca5684b2a08812838bda
TLSH
T1A771041057D5620AF1A296337E776701AB39B806A61ACB8F024D514B5CE4600B9BBBBF
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc.4912

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc.4912
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video2 (1).mp4.crdownload

Path C:\Users\Admin\Downloads\video2 (1).mp4.crdownload
Size 34.7MB
SHA256 c2a2284d8b83b28f4fa4919e99b5f903bbea3925a35177357fe398a861a9a638
MD5 2ed931a5370f84c446212313e263147b
SHA1 63219196e955c8fa2d2d8a90bd81dde75094aaf1
SHA512 41e55b2a665755eda8b8242c07b1735c96a890f0fa4cee1f326772d5a92d8d593e4a50d299696405901d3d459369dc4e1113d2f51a431c77bcac61a6981d9ae3
SSDEEP 786432:urS4Gke60C4F/ltqzjFx1ykumJ1THz0xFJfWPCrnv/a3YB99C261:urS4Le6y/kFjgmTTT0xFJuP4nv//BDq
TLSH
T166873302B7661A46DF2B45319AE1FF20A331C121B70947CEE94853253C3BFE55E9E2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-437-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-473-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-475-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-474-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-472-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-468-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-470-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-471-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-469-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-449-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-450-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-447-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-448-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-436-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-435-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1228-434-0x0000000007D20000-0x0000000007D30000-memory.dmp

Download

memory/1272-510-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-530-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-509-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-512-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-511-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-528-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-527-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/1272-536-0x0000000004110000-0x0000000004120000-memory.dmp

Download

memory/1272-529-0x00000000078A0000-0x00000000078B0000-memory.dmp

Download

memory/4912-555-0x00007FFB0E840000-0x00007FFB0E912000-memory.dmp

Download

memory/4912-569-0x00007FFB0D270000-0x00007FFB0D2BF000-memory.dmp

Download

memory/4912-566-0x00007FFB0E1E0000-0x00007FFB0E1F1000-memory.dmp

Download

memory/4912-564-0x00007FFB11160000-0x00007FFB1117A000-memory.dmp

Download

memory/4912-565-0x00007FFB0F0F0000-0x00007FFB0F101000-memory.dmp

Download

memory/4912-563-0x00007FFB0E200000-0x00007FFB0E22D000-memory.dmp

Download

memory/4912-561-0x00007FFB12130000-0x00007FFB12148000-memory.dmp

Download

memory/4912-562-0x00007FFB0E230000-0x00007FFB0E256000-memory.dmp

Download

memory/4912-559-0x00007FFB0E700000-0x00007FFB0E741000-memory.dmp

Download

memory/4912-560-0x00007FFB0E260000-0x00007FFB0E28F000-memory.dmp

Download

memory/4912-556-0x00007FFB0D570000-0x00007FFB0D806000-memory.dmp

Download

memory/4912-544-0x00007FFB0D810000-0x00007FFB0DBA0000-memory.dmp

Download

memory/4912-543-0x00007FFB0E920000-0x00007FFB0E94B000-memory.dmp

Download

memory/4912-558-0x00007FFB0E290000-0x00007FFB0E373000-memory.dmp

Download

memory/4912-557-0x00007FFB0E750000-0x00007FFB0E838000-memory.dmp

Download

memory/4912-572-0x00007FFB0D1A0000-0x00007FFB0D1BB000-memory.dmp

Download

memory/4912-571-0x00007FFB0D1C0000-0x00007FFB0D26B000-memory.dmp

Download

memory/4912-554-0x00007FFB142E0000-0x00007FFB142F1000-memory.dmp

Download

memory/4912-570-0x00007FFB0E1B0000-0x00007FFB0E1D5000-memory.dmp

Download

memory/4912-568-0x00007FFB0D2C0000-0x00007FFB0D358000-memory.dmp

Download

memory/4912-567-0x00007FFB0D360000-0x00007FFB0D56B000-memory.dmp

Download

memory/4912-553-0x00007FFB143C0000-0x00007FFB143D4000-memory.dmp

Download

memory/4912-573-0x00007FFB06600000-0x00007FFB06845000-memory.dmp

Download

memory/4912-594-0x00007FFB0E950000-0x00007FFB0EC06000-memory.dmp

Download

memory/4912-653-0x00007FFB0E950000-0x00007FFB0EC06000-memory.dmp

Download

memory/4912-682-0x00007FFB0E950000-0x00007FFB0EC06000-memory.dmp

Download

memory/4912-539-0x00007FFB0E950000-0x00007FFB0EC06000-memory.dmp

Download

memory/4912-785-0x00007FFB0E950000-0x00007FFB0EC06000-memory.dmp

Download

memory/4912-538-0x00007FFB14300000-0x00007FFB14334000-memory.dmp

Download

memory/4912-540-0x00007FFB1C260000-0x00007FFB1C271000-memory.dmp

Download

memory/4912-541-0x00007FFB1A890000-0x00007FFB1A8A9000-memory.dmp

Download

memory/4912-542-0x00007FFB133B0000-0x00007FFB133D2000-memory.dmp

Download

memory/4912-537-0x00007FF7E0A50000-0x00007FF7E0B48000-memory.dmp

Download