60802a5637d42687fc2b8d16dd041e61986a5ab4847f5c7dc13bd1ebd170d667

Analysis

user interaction
yes
max time kernel
1049s
max time network
1020s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voice 260513_090858-1.m4a
Size 1.3MB
Sample260922-sdvdqsgh38
SHA256 60802a5637d42687fc2b8d16dd041e61986a5ab4847f5c7dc13bd1ebd170d667
MD5 5c03c6109ddc5b6868b25e1a9bb877b0
SHA1 ef4193bddb249eac792427e89407b3da80eac209
SHA512 be3d657101520e8fbd26428467400f39fe13c7b0dc10a3fa01732ec0c5003b801392dd102dd61262c01fe75d67413098fcc062dc0aa01762a4572ab270a4ab04
SSDEEP 24576:xssUpAcXrci1EsG4ld0r3qb7S83M2YJ/MMUfqNpettCUjZ1xiIW/BS:eZAF4wro282UfkpmtIHpS
TLSH
T1ED552393EB9E0529ECE16A3511D547016790BA28732BDC3A23D6CC5981375C3EE2FCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
178	raw.githubusercontent.com
179	raw.githubusercontent.com

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345629051960578"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{2A08E522-9515-4B7F-A0E6-C91E710BD33B}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5088	chrome.exe
5088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	448	wmplayer.exe
Token: SeCreatePagefilePrivilege	448	wmplayer.exe
Token: SeShutdownPrivilege	4724	unregmp2.exe
Token: SeCreatePagefilePrivilege	4724	unregmp2.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe
Token: SeShutdownPrivilege	5420	chrome.exe
Token: SeCreatePagefilePrivilege	5420	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
448	wmplayer.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe
5420	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4036	448	wmplayer.exe	86
PID 4036 wrote to memory of 4724	4036	unregmp2.exe	87
PID 5420 wrote to memory of 3452	5420	chrome.exe	105
PID 5420 wrote to memory of 1608	5420	chrome.exe	106
PID 5420 wrote to memory of 6084	5420	chrome.exe	107
PID 5420 wrote to memory of 6084	5420	chrome.exe	107
PID 5420 wrote to memory of 2436	5420	chrome.exe	108
PID 5420 wrote to memory of 2436	5420	chrome.exe	108
PID 5420 wrote to memory of 3984	5420	chrome.exe	109
PID 5420 wrote to memory of 1816	5420	chrome.exe	110
PID 5420 wrote to memory of 3984	5420	chrome.exe	109
PID 5420 wrote to memory of 1816	5420	chrome.exe	110
PID 5420 wrote to memory of 3444	5420	chrome.exe	111
PID 5420 wrote to memory of 3444	5420	chrome.exe	111
PID 5420 wrote to memory of 5080	5420	chrome.exe	114
PID 5420 wrote to memory of 5080	5420	chrome.exe	114
PID 5420 wrote to memory of 1708	5420	chrome.exe	115
PID 5420 wrote to memory of 1056	5420	chrome.exe	119
PID 5420 wrote to memory of 1056	5420	chrome.exe	119
PID 5420 wrote to memory of 5932	5420	chrome.exe	121
PID 5420 wrote to memory of 5932	5420	chrome.exe	121
PID 5420 wrote to memory of 4360	5420	chrome.exe	122
PID 5420 wrote to memory of 4360	5420	chrome.exe	122
PID 5420 wrote to memory of 1028	5420	chrome.exe	123
PID 5420 wrote to memory of 1028	5420	chrome.exe	123
PID 5420 wrote to memory of 3204	5420	chrome.exe	129
PID 5420 wrote to memory of 4684	5420	chrome.exe	130
PID 5420 wrote to memory of 936	5420	chrome.exe	131
PID 5420 wrote to memory of 2908	5420	chrome.exe	135
PID 5420 wrote to memory of 2908	5420	chrome.exe	135
PID 5420 wrote to memory of 2984	5420	chrome.exe	136
PID 5420 wrote to memory of 2984	5420	chrome.exe	136
PID 5420 wrote to memory of 5088	5420	chrome.exe	144
PID 5420 wrote to memory of 1276	5420	chrome.exe	146
PID 5420 wrote to memory of 1276	5420	chrome.exe	146

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Voice 260513_090858-1.m4a"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe5cd0c728,0x7ffe5cd0c734,0x7ffe5cd0c740
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,4907710383210484793,1340236526911337505,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,9117768087929358591,6184948724705021785,262144 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,2902497910789540497,6339303532230938867,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11661376435981666160,4385853563503034347,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,17381491754624321061,245815625185049800,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,7746180384792202207,11166247359943713089,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,1272465843903828990,2667275585957688702,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,13472052829160686211,132072907826370512,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5876,i,15430670963036493107,2255241036516152972,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3312,i,14636611082538012669,18093392443222431109,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3976,i,9183714605968095485,638078309039477199,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5940,i,3497799835884322067,3773080209259997392,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,832173612142432949,9538068370504557955,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,16435208785879116065,3572772022794995012,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,2150669373466729439,12511809945474597188,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4808,i,13605473973599635757,12789720753975742190,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5828,i,13303044784476596766,11730557913011784326,2097152 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4728,i,10668755247210938634,9233052445492808013,262144 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,4637527162397158192,7762373284620520,524288 --field-trial-handle=2112,i,10308601786541580405,3473283172897053637,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:1276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7c8d7f8fe683b94eccc3608af00adfe47867c8e1c4756c2c2650632ec2b52c61
MD5 a58704aa2f3189953ecedce5fbf8d4a8
SHA1 9189f0761a57f175967023942962bb4791134441
SHA512 90c13044462669302c4b823991f6f44146c6af026bccabffd30c4bc62ee5cb2838a047b2bbdfec85ae0c197d9a838257cb9b9257acf4d81b1b7057e84ccb138b
TLSH
T1D8F0F9B5C921BC7718FD1B2D20544B47F75513573641955F3A3D820D8FB8A3B898981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f0a623f2efff506e81b845db896647acf9377c362a3d47bb04501dbbf39cf260
MD5 54e5d02c0d3ac8b6de9ec878177def8c
SHA1 f98e414ac64d1f91f4a2093b867bf3ea6f376d3f
SHA512 159954306a42df2b052202ebcee4fe1ddb4b5f27c4e1ae2b3a20df2f082b02ca531121a73926abea9f88790578e390b5553834a9972d21abeafb2120597ee4b6
TLSH
T1B331FE5A6E970538EB70B1B9F6E86D892532377F3E571A3A28B7246328862E0305494C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9656152ee87a5d398677cd5e96d1e06a874495a9a0fa8c7dab1e810fab20d35e
MD5 a160e73ec037e67b925df01cb2823f6e
SHA1 a4b4d2f2ab581bdb9f3c893ca17aa01ff7b85e75
SHA512 1bf4f1fa396974a23eacac5ee744072d60db3ce500497060d12e08657b296a5f3f50dba8a6d681b4338bb97e3d21a78d5ac6b001e3d6196ced172a894d92a863
TLSH
T1BB41205A6E970538EF70B0B9F6E86D892432376F3E570B3B28B7246328862E0301484C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 6e8f231fc44d618d70ac7d9925907606cba42ba4aa5554b7929429b498df45f7
MD5 4c1cd03d5b3f5cddbbe76a225251d23f
SHA1 e0e797b03157773e6189609aa359892def4cecdc
SHA512 809c5245902e9fdc4658576c14848330b181ff52e0412b334e63b22e138159f1e80cdbcae60b9a708aefce171f9e2bb8214d79b6c5fb2eacd1a6be3e46127286
SSDEEP 384:DuPD+RTGrUrGrfercr1VmrmrirPrHrPBec4rirhCNRm0APyZnVrpqNsawvrrrpAj:kiEk6kkojLPcoRzGXYSHLLwEZGyoscmq
TLSH
T146927BF7C3E4863DCB2155F4A6142E1ACE2E053493AC7C66C5EC9E5BA3F14B1E18264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 2bcc966d59cb444ebe68cb3c451c78454599c054af46bb625683481fc193b066
MD5 0aff317d0bc01e3d4a7664e3f195001b
SHA1 87a8927e84315f083a2f344d1c379db72d293f31
SHA512 1878821c24b4efc7162cd0baf2d09c915f29efb1352406d055be80456a1e2f992ddfb2300a755e59cbd9040a3692aa01cbffe2959a2a499411174d5825d76041
SSDEEP 384:DuPD+RTGrUrGrfercr1VmrmrirPrHrPBeECNRm0APyZnVrpqNsawvrrrpArSYOrt:kiEk6kkojLPhzGXYSHLLwEZGyoscmSKL
TLSH
T108928BB7C3E4863DCB2155F4A6142F1ACE2E053493AC7C66C5EC9E5BA3F14B1E18264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 3c5ac2b87c3bccfd9fb38f689edab9c50105f854328896ec3e8445ffd0922c95
MD5 bd70d8062cc87ae099424420fbdcd4fc
SHA1 1e51580727972bc82a80ef8308938f82ada91873
SHA512 b28dcbcae477784e5e951fe17bc11f6c371bc4aaee0a6bdb0a818468e2f1833443b617a2a0d68e41ed7302ed87e8210872eff8293f50ae3a4e31840547fc5df6
SSDEEP 384:DBuhityHrJrsrnerormwrbrbrCrzr7BeElrzrgCNRiEdPyZkZrUqNsaqvrrrpArF:elqMu3nnIv7fvTzIXYS1LLwEZGyoscmQ
TLSH
T114826CF783A0863DCB2155F0A6146F1F9E2E053493AC7CA5C5EC9E5AE3F14B1E18264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 6e4a16d31b6f562b664299f74b2b485acf0282c1598d222afa9e3fad6f51c682
MD5 b0aeaf2766a96883aae5c72164c9864b
SHA1 6a16df8b501a97dccf607edc36a59a504bed12b1
SHA512 69e54171cfec86d9dc277677ddc19daeff4f817b42da8c8b75e5258796361f70b984ee8c1e6c86c8d14f3874c44a9cb7642c8ae925ea6f603654609ae9dc4e69
SSDEEP 384:DuPD+RTGrUrGrfercr1VmrmrirPrHrPBWCNRm0APyZnVrpqNsawvrrrpArSYOrHg:kiEk6kkojLP+zGXYSHL2lwEZGyossmSE
TLSH
T120828AB7C3E4863DCB2155F4A6142E1ACE2E053493AC7C66C5EC9E5BA3F14B1E18264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 31379d74dcb111784feef162370acae5c60a6ea9b1da9aa726f4729520ab25ab
MD5 2c854f80e2aae5d430e1ce70506832aa
SHA1 0a1570670255ea98115fbb61d4a0535d66be24a6
SHA512 fc73b0b37c4b68f3645c35a6c3f21e1814e8fceb60a656285f17348bafbb03dec641468c4bc070ce75a8eaa23cf4ef338f53405b008bc8b3bdd6906c55eefd87
TLSH
T1C1619D93967EB42B10BD0DBF1E647C495CFEE8340292A8F4EBEB82AC70C15F35616416
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 409e8a3fc92eecae56b58c31f13bdbdc6d0848b12a02d0d25ffa5a7baa70b136
MD5 c14c306e22f8b8ce9e373da7274ff2fd
SHA1 f40f3e6fa22dbd90e3cb00fa717c359d73032f96
SHA512 8f78227aa266fc119e4ea74e4a8b127a578c7ae4d9904253ab8131d62b0a9d1e8222ab608d37ddbfd367626301eeac487a25f5374e6aed89abfd120f2af7448d
SSDEEP 192:PRN+cBzDj0lyfh+Dv7Gp8PRp6D2Cz96Hsb+WNiwhPJX18/rR22ZReHlxel2lsDHj:PRN+mzDV+7CIXcswxX62E+lxel2lsz2e
TLSH
T17652942EF910697B9CDBD229F9117B66D3F6202564D42E84E7FC8A3C10EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 00e7267e76ff14ccff16aa34afdf3a743dc62002b32c6fb822f0addd951f4d8b
MD5 5037ef905191a809628927b8f4f449ae
SHA1 f2686f8d69e575a7cadd6e17d535d7913a99edca
SHA512 5a81d1dbc6796df07ae7ae8a5d3eac211c5e197af9a491389029adb79f4a86034ea215f22f878abc8d9efe74fe8a0ba9e1b11cb2e835758d7cb5c8da7ad5eb1e
SSDEEP 192:PRNncBzDj0lyfh9v7GpAPRp2Dnz96Hsb+WNnhP4rR2/ZReHlxel2lsDG+VyIsnA4:PRNnmzDV9CUXSswpi2h+lxel2lsy28
TLSH
T12F42822EFD10793B5CDBD22AF9217B66D3F2102664942E80E7F8893C10EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 40c1a5d0f89c517f9b49adc0bcd03d475adfff5856044249cb0ecffabcfb39ee
MD5 33a3704b9b85f367da1993662f37c55a
SHA1 6de38402968c7181b77c542f39bded4167a60a8e
SHA512 564d6c3aed040c4240ec1ed248571479d744308576d81051f9cb31bc7b69f7775e2138449cc5787d63a3b9254896a7889495fcec90d390a8fcd16b0d38d4946f
SSDEEP 192:PRNncBzDj0lyfhLv7GpAPRp2D2Cz96Hsb+WNiwhPJ0SgrR21ZReHlxel2lsDJ+VK:PRNnmzDVzCUXQswxXq2P+lxel2ls12e
TLSH
T18752952EF920797B5CDBD229F9217B66D3F1102564942E80E7F88A3C11EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5d2a072bbbd1632bba392a84c55c27e7227e28f316fc6e537ac542e1ef8b3448
MD5 2ad751652491605be23b50de3d678042
SHA1 aff4648f2ab3e10cbeb2b6026621b806695fed24
SHA512 75b2ee00d39b58c0727bf8d9a934efb671ecc3c27f7d7bea2eebb69210090c0c1365f7637aede68935514c435e64c79b3b16335e63dc7f00ca6079497f6ebd2d
SSDEEP 192:PRN+cBzDr0lyfhcSv7Gp8PRp6D2Cz96Hsb+WNiwhPJkL4rR2YZReHlxel2lsDH+M:PRN+mzDtzCIXcswx6i2O+lxel2lsz2e
TLSH
T15E52A52EF910797B5CD7D22AF9217B66D3F1102664942E84EBFC8A3D10EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5f6f265decf1337302ffcb7bfd65f3f5e04f503e9aa2bce5cdbe391a8ff61724
MD5 67175e1a5cd82a3074b3d74e80397d5e
SHA1 fb11175035c71a2b8345e3984cdc693645bfc3d5
SHA512 94c87ba03f966153a14f01b77fa1b003ff0f666bf1e48fbfd9435fe40fd9ef5febdad95f2f62da30eb108c10aeb7be5ab68dca8bb915972436f4ae3a68c5c5cc
SSDEEP 192:PRNncBzDj0lyfhDv7GpAPRp2D2Cz96Hsb+WNiwhPJEa+rR2JZReHlxel2lsDJ+VK:PRNnmzDV7CUXQswxrI2z+lxel2ls12e
TLSH
T18E52A52EFD10797B5CDBD22AF9217B66D3F2102564942E80E7F88A3C11EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8cec753768a70cf17a31af51b172c251813bc344f1cbaecf866474570370aa3c
MD5 4d184fcb18e8d666fcca7d84fd1dd66b
SHA1 9c10f50f91794129e3763cdf84dcd5b847edbb68
SHA512 024729651dfe87e5c63412a8e6e63ce78273c314b521c412d8c7715519e5780ecf6c57a9a5036316ff7016e00b405f902c8ac799996059a74fd01a538c7baf21
SSDEEP 192:PRNncBzDj0lyfhyv7Gp8PRp6D2Cz96Hsb+WNiwhPJtborR2wZReHlxel2lsDH+VK:PRNnmzDVeCIXcswxLS2W+lxel2lsz2e
TLSH
T1BF52842EF910697B5CD7D62AF9217B66D3F5202664942E80E7F88A3C10EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 376afd19f17cf40d10c62331b011babb3fadb57e0f90d674b38ae45c52aaf09c
MD5 fd962e6ead5fda2fd514679434f75125
SHA1 9f722075f49eeed21eafb4acb171fc5dcaabd3c9
SHA512 e357b3d86f53f644207f10a1c6ab77e6254a3d69bdf045522e3c4e52b743e5e7ff1ed67f4d861b465fe25ed54e53b5e9ab5803f9358e380a0ca38e0322c1eb83
SSDEEP 192:PRN+cBzDj0lyfh1v7Gp8PRp6D2Cz96Hsb+WNiwhPJigorR2/ZReHlxel2lsDH+VK:PRN+mzDVFCIXcswxbS2h+lxel2lsz2e
TLSH
T10D52A52EF910797B5CDBD22AF9617B66D3F2102564942E84E7FC8A3C10EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a29d6ab62818cfd07b7153ceaaf2bb2439910bb4fcb94546c769eccac5e0ac1c
MD5 8c8c2350f1df6e808235c57abbc32aae
SHA1 6cf5f582f465a132b5ba749b659c170cefce36d1
SHA512 1011d00b05f60d83dd9d33de415dbce14ecc8c2b58bd7e51643b254dff21e33a6c869fe156457367532765597d2c4489e05c47cf0e3f5d79d50affff998af53b
TLSH
T107B0121580472302C04203F01155E05436608F3BD1121BCDD1F00D119832170401B10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5933b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5933b8.TMP
Size 96B
SHA256 5cfcfb580f1ba631e714dfe3cd9dd9c8a7d50a1a81ab6c989d0bfd1976baabf2
MD5 0cab05d6da9e0db53355d9a2e7b6010b
SHA1 7000b0cee9fece4bc642c1afe45b3d4ba3dd4f94
SHA512 f6c1b09620bd8b638c2e17cdf7e45e0dc5eb3be5df0cb84b9784a9a98627ba56fdc8285628a40e9d694fa19941fc7efd16733c350ff25d3cfbd119374e98ff4a
TLSH
T101B02200C002B303C08203B038A080C8BC20CFA8CA23030382E00A22CC303330222030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 b8ad99f225b935c665415dfe2799b081cd6d451ccc94526ab4bc7fef03f47838
MD5 895c9547ee119aabb97e8e8d26100676
SHA1 ec1e5a140863c30315d98d0cf1a0912c0ec89434
SHA512 7a94ca3f6ad5db18c15981579de95eaaa0ccba9e60a33f7643efa4a36c6b103a008497f912ece6e8adb534e56990ef165596f6115933c52bd0f550cd70d26d56
TLSH
T108B012C004884B02C40006F2DBC1498173F0AA343345E703015908248C015C70542505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c75ea2292c56a74ad3c1600a9284ede245365e09d5dee41a0e1e4f29de1198ae
MD5 97c9a5b2ea4658e916db1a2a0155a9c0
SHA1 12d681283cc5794ba636c20ff8df972f3e1c21f0
SHA512 dfe5aafe089ae18324759115f67c15255816296056bb121f96e7d00fb9d2efc5796837b6496330d8cf1e9fe0cf5a2e1d1cc5ed922301f9eb52301624c237439f
TLSH
T125B022C80080830AC20003F0C3C00AC033B23F3F3BCBC2330CB00808CB02B830202200
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 5d96756a5ddef893c0ff8588c5da9c58f26bed2b42659101dd5b781ef44f7d4c
MD5 2520b7f7d41e10cdfe4c11a80b32dfb1
SHA1 e261e8fe9240c742ba2ff26149a6dfcf72168644
SHA512 1b39dada588f734bc4033c3f88d049a98b007eeb39ca6a8a4066b91a9ccca5f892cff249a82dc3cc4462d2006f00f86461d209e1bf18febf5461b7fcd7564064
SSDEEP 3072:UC+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UC+hFD+7t56OD9ZfSApprB
TLSH
T145D31232AA91D8BBC9BC6541B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 9c144205382fc313c932970e51a2e96789ce063ba048cc26c58f13d064f65859
MD5 7cba82bec6d08cc76c3dfc512904a8c8
SHA1 d7f3a39338858f6edf98b313c545302774cd0db3
SHA512 005444e045168c05fe36d5aecdd3fb1a44bb6c729fcbf5522551a3e206d3869648afdbd62f6c26f54fb83a519f8aa131f451136bb5879fa691a00e3ee151945c
SSDEEP 6144:qei+4TXY2saH8cq6S+hFD+7t56OD9ZfSAppr5:MTX/s48ySyFSXD9ZfS4H
TLSH
T16F441226BA25ECBB8EF86001A1679310BD9558EE4DDF271904A49FCAD58FD090732F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 09f4469dae2c68072667cfded59b06d2ba81cd63cc075f513e9317616633dd8c
MD5 da272c349bdc275338cabfd084445cb0
SHA1 540544c54c39a74a0937f454ac78b8988feecb76
SHA512 549e589a2d2161e9e56556ff8af189e111f27ae4dbebdb21929ce2df32f087ba72a2d7b3831a4d369977db9b37173b9a1b7186b2785b2c56325bc5a17b361182
SSDEEP 6144:PPxi+4TXY2saH8cq6S+hFD+7t56OD9ZfSAppr5:ATX/s48ySyFSXD9ZfS4H
TLSH
T170441236BA25ECBB8EF860019157A3107D9558EF4DCF6B1905A4ABCA858F9190732F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 4633c450757060d852f32478b74278af3444f4732fdb3c8ebde659f76bbdb0cf
MD5 afce7d85ad6ef97c8892ac01143394cd
SHA1 c9502dd2480b43cf1229bb5fdc7351bf2d5b8274
SHA512 8655b8367da682255fe8b52a56f2558c058f3511913fcd7fc1ba7d54067863eb4394d6972210e1e68341cb5ddf8142eeacc531a9259f5c99384497916fe8e6c8
SSDEEP 6144:LPxi+4TXY2saH8cq6S+hFD+7t56OD9ZfSAppr5:8TX/s48ySyFSXD9ZfS4H
TLSH
T1B5441236BA25ECBB8EF860019157A3107D9558EF4DCF2B1905A4ABCA858F9190733F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 80e8d6db6fdea0775c5b3f38b4c4b727808500dbaf01ecd77f37f1ff8a51d525
MD5 c56a13f79c54396c749dc3453e1de3e9
SHA1 a1735076d1d2b78406e75d56ac29de94674068d2
SHA512 2227bbf511187b1cec9d22d085b8b759b9e363ec4b62cd8073aee311d2d7578fe30497e44668b5000f6a68e6fe05e2e0bfb6030f39faba5ca22465d0da660e23
SSDEEP 6144:Pei+4TXY2saH8cq6S+hFD+7t56OD9ZfSAppr5:lTX/s48ySyFSXD9ZfS4H
TLSH
T139441225BA25ECBB8EF86001A167A310BD9558EE4DDF271904A49FCAD58FD090732F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 6856a2e4cbb16288dedab8768bd2d666824377112f87dea9b994066052276047
MD5 a23bfa54b253ba4587c2fac6d144c6d0
SHA1 9106ad60ee01a2f6b53e565040c427f22c0cf388
SHA512 c27912f9f728766a87e76abaf71e239452e67d293ff659d044fcf826d57b339133955785b038bec9f4120d45f2610ab997d783ec83fcebb6b482ad7ed299394e
SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba9:jZP2tFP3vqY80qEMLTaBacg
TLSH
T116258537D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 243c1934658fa646ed3abda9c18055d8f51e173a5e30c3872a60383fa878dc34
MD5 1cd9a493716cecc8f43dbc8dc7b86d2c
SHA1 95000a1b1ed7aeb50a07e64e98db12fa81aa13ac
SHA512 171fd608a14aa7697a2364fc744e23b1fe4d3d5f691d8278f3da828384edb5b3c634179977a86b27054fd37a3f6b1026b05701e35a1d5c74e1bf0ea2e6b99c69
SSDEEP 768:UZnmUf2qnDjFmQsD7U8Bywdna5mfJCAemA/a:UZnmUf2qnDjFmQsD7U8Bywdne/a
TLSH
T185639BE06ED4518AF6F60DB2DBF27F521B2ABCB51F259F082240470D0C66A19BD35B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 76dc794fda881ae89c297666d9264587fbe07a59f0f23a9a4b7c041ad46580bc
MD5 3452e938334153fdcd65c833bcb5f4c2
SHA1 1a65fdde89483e3ec8cfd290c469ea80419201df
SHA512 9c122ac5b12de5293dd5fd7fd7611b89d5d3aaed0924b42fa77a0d4760afdcbda82a15e98edfbd4bfd45cb84d345cf1b98fcd6e45d9911e0686826649a409c18
TLSH
T123217D571B8ED4708AE01BE76CEC8E267377C7CA87A1D065B38DA039880312D6B3E05D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/448-61-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/448-33-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/448-30-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/448-32-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/448-31-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/448-35-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/448-34-0x00000000052F0000-0x0000000005300000-memory.dmp

Download