c1a51a6252505177dccea1cfe39a7f6d7f9a1778a86bc6168ba985fe463cd5a2

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
- Заны Заны Препараты от krak3 The Dark Triad.mp3
Size 739KB
Sample260925-ny3hmavepc
SHA256 c1a51a6252505177dccea1cfe39a7f6d7f9a1778a86bc6168ba985fe463cd5a2
MD5 d4ae818759b3552e65e18cd40ae886d9
SHA1 cd6fb6f3b5d4bf83fd7754a1a13cf9d9a9dade20
SHA512 060c42ecef2ea2482f8fc3f683fda8877dff014e2e7988cfcfa66fce247fbef342becdd09c91b736d2644754295c10271a12a1b2360f298462d3221dc925b596
SSDEEP 12288:sEmYIS0sCUmtsqjGfFpAnHe/kP5sTUqw2SN+SwYI3cOVxuF9u5WA/i4caB+r5krD:sxPjWGHeY5ss8Umepn1tA
TLSH
T182F422B21B1415ADF0CC6B36D6AB9D20E07A5B0D3954B9DD85F4532328FB2A2BF34349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2608	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2800	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348105942795166"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
2332	chrome.exe
2332	chrome.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2608	wmplayer.exe
Token: SeCreatePagefilePrivilege	2608	wmplayer.exe
Token: SeShutdownPrivilege	4516	unregmp2.exe
Token: SeCreatePagefilePrivilege	4516	unregmp2.exe
Token: SeDebugPrivilege	1944	taskmgr.exe
Token: SeSystemProfilePrivilege	1944	taskmgr.exe
Token: SeCreateGlobalPrivilege	1944	taskmgr.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe
Token: SeShutdownPrivilege	2332	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2608	wmplayer.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1448	2608	wmplayer.exe	89
PID 1448 wrote to memory of 4516	1448	unregmp2.exe	90
PID 2332 wrote to memory of 4792	2332	chrome.exe	107
PID 2332 wrote to memory of 4128	2332	chrome.exe	108
PID 2332 wrote to memory of 4128	2332	chrome.exe	108
PID 2332 wrote to memory of 2800	2332	chrome.exe	109
PID 2332 wrote to memory of 1696	2332	chrome.exe	111
PID 2332 wrote to memory of 1696	2332	chrome.exe	111
PID 2332 wrote to memory of 3500	2332	chrome.exe	112
PID 2332 wrote to memory of 4272	2332	chrome.exe	113
PID 2332 wrote to memory of 3500	2332	chrome.exe	112
PID 2332 wrote to memory of 4272	2332	chrome.exe	113
PID 2332 wrote to memory of 3348	2332	chrome.exe	114
PID 2332 wrote to memory of 3348	2332	chrome.exe	114
PID 2332 wrote to memory of 1120	2332	chrome.exe	115
PID 2332 wrote to memory of 1120	2332	chrome.exe	115
PID 2332 wrote to memory of 4348	2332	chrome.exe	117
PID 2332 wrote to memory of 2060	2332	chrome.exe	118
PID 2332 wrote to memory of 2060	2332	chrome.exe	118
PID 2332 wrote to memory of 4564	2332	chrome.exe	120
PID 2332 wrote to memory of 4564	2332	chrome.exe	120
PID 2332 wrote to memory of 2168	2332	chrome.exe	121
PID 2332 wrote to memory of 2168	2332	chrome.exe	121
PID 2332 wrote to memory of 4592	2332	chrome.exe	122
PID 2332 wrote to memory of 1116	2332	chrome.exe	123
PID 2332 wrote to memory of 4592	2332	chrome.exe	122
PID 2332 wrote to memory of 1116	2332	chrome.exe	123
PID 2332 wrote to memory of 5124	2332	chrome.exe	132
PID 2332 wrote to memory of 5132	2332	chrome.exe	133
PID 2332 wrote to memory of 5140	2332	chrome.exe	134
PID 2332 wrote to memory of 6072	2332	chrome.exe	139

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\- Заны Заны Препараты от krak3 The Dark Triad.mp3"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 2288
  2⤵
  - Program crash
  PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2608 -ip 2608
1⤵
PID:1996

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe649cc728,0x7ffe649cc734,0x7ffe649cc740
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,13614069325198382073,2928665103275137171,262144 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,15349544484402374708,7726885099892195090,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,17674978838907018310,1772465380309652658,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,11406659718188482742,8098853860948117340,2097152 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,3177633305938980777,5667230196217544856,2097152 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,12078293942104108373,1917444281529559867,2097152 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,4910816945003335155,5624628718357296030,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,6016544624964888946,1778797108880205208,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,17360984353185465775,9645816433902272834,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,59952951372582732,9214791949296322191,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,13373700926036405601,11932087482368630927,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5728,i,3768087822989385833,162860046494570091,2097152 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5760,i,3170453212447020146,765870893944735295,2097152 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,18069269363569885966,4004694457980404669,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,10530234060218325075,5989630620278777826,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,16265332838482996779,14931317140321572103,524288 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5964,i,11133941337462694399,14446466076815205106,262144 --field-trial-handle=1980,i,11055220363586592705,17635065791225926586,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:6072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 af8fcf2e1e9ce5a0979f26a6d2248e9cc99ddb7577285adb9db7b3b3931eb6b0
MD5 83225ef1cdccd7d765ae29239871cc3f
SHA1 bde9bb1fd462ad5efa9f814e0ed3963470d57601
SHA512 936f9b69fb444010228d71ee8e6d9f09efcf008ab85fa614d12c51c11362a91439a52d84bafab76a5ab04b9717937d9ebbdd164a19911b591aedd661eff6b7a9
TLSH
T100F049B9CD21EC3718FC5B1920915B06EB80132B2680894F3A3D910D8FB463B868581C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2fd1bcab61d994d7a81eaa186b885bcab0a8a5532f784c2e77ad8d52e29a05ae
MD5 c7d56c3614013cf699553b149da5b2e1
SHA1 dcbea9adaef48a04680dac7fa1f953ab97bf0413
SHA512 be7e01fc7b72fc318a47396d59eba3277fa4d7804e890bbde16064992bb580600675bd542548b463a61b33d3757ee3527520e003b5468288a0b7746d5c221fea
TLSH
T12E519CB7D3D49A6DC81156F49B217E2FCD3D0A28122C3C66C8D8AE5B93E2972D20034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2674168fbf98eba0fc650b78199d026b248cf6fc507c2fc14b03b17302cbe8bb
MD5 ba81e1468bba3bb63b2a988eb019a1fc
SHA1 3e0a3be9a0fc4f1c4caeb261c59ac19ee6f383fe
SHA512 64d0ed29b7eff67cba5cecb88c255ae889faa3f19f9b1a745fcbca5cac1c4bff2e82841624e5e375f85fef5fd8be3d54108b6213d52cf2df42f957508959f4f9
SSDEEP 192:gRHSDI0v71vAPRp2Z9IHsb+WNnwX0+92Ee88n0VyIsnAUge:gRHSEw56X62w00m2lwe
TLSH
T1DF32922DAD10793B5CDBD22AFA25BB53D7F5103221952E80EAF98A3C15DB9CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c6f060a76b526db1780c5c3435b30fd7214eed4d380643d9a3e89bec08b76706
MD5 81d3290165afdcfac20f4e18172413b5
SHA1 f599d659de9085c8f14117931862edd3cf5b297c
SHA512 13558d3485efd37e3aa27de3e6fb1d000086274c87afe3ba352d1a8d8f33f4ab120b73f598072eeb4d2d5193ccd526de8769cdb53f5bb5c2ccba364467ea2392
SSDEEP 192:gRHSDIOkv71H6PRp0Z9IHsb+WNn5ut592Ee88nWVyIsnAUgE:gRHSEOA5MXM2wctX2luE
TLSH
T14842A42DAD10793B5CDBD22AFA65BB53D7F9103621942E80E6FD8A3C15EB9CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8f64fe8754754dd3fa494f0453170c070e6e43982f3122b30cd918e5335a0773
MD5 b940a5ab42ca11ae743921d89724f9a8
SHA1 3fc9fda3790ac3fdfd56d16a1904ee2a1a02ef2e
SHA512 ae5cfd821a79bc734eb87f988658ce4112616315d915e042fca9823a9066a0a2a6f68f39aaff2671375544358b95542dc8ae8dc39c7fd38313a9b21284fd4d65
SSDEEP 192:gRHSDI0v71HAPRp2Z9IHsb+WNn5utl92Ee88n0VyIsnAUge:gRHSEw5CX62wctz2lwe
TLSH
T1D932932DAD10753B5CDBD22AFA25BB53D7F9103621952E80E6FD8A3C15DB9CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c1159e513aef6d0b32e359cb720d7056cddfce29d23ce3bf1bb9d90b2330ff9d
MD5 30167bdcb73c7498d17dd02df642e53a
SHA1 e08596c9b2782e4cb145b850124ddc12a35021b0
SHA512 e3c66c86848ae5b9c83fcf90febee6abca9043f08fd69ddc0a8ff83d0c5a9d5dd69902472eb899a7f8a91cddf7653b6faae6cf22becfe590549071404aea9a42
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3SWHGZVt7Sh1n:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEo
TLSH
T191521967684C9A3F0FD8CA4DDC12AF4FADF501576668492453FB9C18039A7CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 369cc0227ebc982591fd448f87ec65654e090da7b283b7324c831afac9eb081a
MD5 433f1b47facf1036d6beadf428dcb4b8
SHA1 7d280f65e72e9057b553934b39ee259eb517ca69
SHA512 4c6f6d210e8de7e257646d08bad71761c10fbbc1b3603b151f54d57a58141b13c4b561108df5d2c792b6de4b15050484dfc8e571100e810408f49757af74d2ca
TLSH
T13DA00210E2C01D11CE1063B164716E452252582D59529B2764A55444995F5C04212621
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 6b2dcce3fa6ca912c015f028a179c22914bf3c269619174f515b15a05be294c3
MD5 07250c96ed82105943b3e0ab24461e2f
SHA1 3fc51d4b403db16762a700b7996e9e0837016ada
SHA512 297f35c6fa0da511d20aba66c7f3515f30ddb361736b8319c52a2ce6e8ded6bcea9a0d1bc0f29650f5a5659cb0dcf1bb8ec8c5d01cb862f047c4ec0177ec0456
SSDEEP 6144:J5TtEVjEfT5CCL9A7taB1o3wxluaQpp310nSd+hFD+7t56OD9ZfSApprm:J5mNEVLBARaBWeOh+SdyFSXD9ZfS4E
TLSH
T180442262ED41FC7B89BC1441714BAA168EA3E8F841DF354A4452AFCBE5BBD450B33836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 0ca251eb5f92017183496433166dbb7597e93f1a2d80b08d5e39c8da7ea8804c
MD5 f54271fac564937fbbe87a8672d59097
SHA1 3f338204019cecfeb244952ccf46ad24027650c1
SHA512 5f61120d8b654b1e1f101377f344363fd43c641a891a65e087dc8b4f7d0a5dd10c6a5c3a1de9c0d2077b16358c3ae4a5e3516c0b7958c0a3287bfe037273ea41
SSDEEP 6144:iVmztEVjEfT5CCL9A7taB1o3wxluaQpp310nSd+hFD+7t56OD9ZfSApprm:iVTNEVLBARaBWeOh+SdyFSXD9ZfS4E
TLSH
T16D442272ED41FCA748BC154171476A158EB3E8F984DE654D8852AFC6E1BBD480F33836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 4062a4d361798ed415d6e2ab3194ad28ba0e9790b16941eefe49806a87986f13
MD5 cd19d211cba76c9d49d5b57f1b2bd773
SHA1 70a8b455305bb96be5cf52d3fb8beb8b5b684720
SHA512 0ef854e4f94471f5f100c5458042510e27b8fb06f53e093c2dc9088dbedbaf162568efb6a08c8bcccd668944657436179fc6da4c4a65b0627f4e2da1de7ff8d5
SSDEEP 6144:i5TtEVjEfT5CCL9A7taB1o3wxluaQpp310nSd+hFD+7t56OD9ZfSApprm:i5mNEVLBARaBWeOh+SdyFSXD9ZfS4E
TLSH
T1EE442262ED41FC7B89BC1441714BAA168EA3E8F841DF354A4452AFCBE5BBD450B33836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ef5c4b9e2dde04ff643d0a2c02e27ac879caa9fd8139c978cc6d3e0efc2ef640
MD5 d49e5eb9ecc90e2102d4ec9ca7adf8a4
SHA1 680944dfefcbf3e4b84e719e6b93e5fb68460bc9
SHA512 bfa43d3fbb892e93f7614b960449a78defc89c9a7df33260ac83e790c2cacc66c8cb60340d38f3c093d875f18fa103c297994bc0b6cfebd5c55ce46379ca9881
SSDEEP 3072:d5N+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d5N+hFD+7t56OD9ZfSApprr
TLSH
T14CD31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 34b625fc94867c9835ae9b43f3884058f5401f8df23759dfe004f0484257409f
MD5 c294b8ffa8e3aaa4d598b9b99a56fc5b
SHA1 ac462156eda7abac328d5ac54c9c9bf51e523040
SHA512 e766cd1f2b450d498a4c8edeefd1c180eb59f17b84f2194381a02939154fe677c851b4c1b9c0789a59dec365e0f9484fb6b580f3a5dbbec78c6e94035d454c79
SSDEEP 768:77KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjP8:l9tQeoVYkYpktMGAKt2hZCDX
TLSH
T1E4E42E3BA470A088DF3C35B1E1AC6F4CBD72641612E002421F74B67F7A237D8DA5A5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 a89f5039f8b1c2b362674b769e0320b009dde2993e170052a6d89429d67992ee
MD5 25b7848bca5a5d8eea69e7b4fe29a754
SHA1 a898ed7fdb74cdfc278c5585c3c08a183612ea24
SHA512 e24fd5d2044ff7f0ea128710b635360dcbf6584dc3800a3632d8c827c9d4d2696816b8004b10eb00b1d991a0685acfb3ac553c0b92b545832194ff4f4926c110
SSDEEP 768:70aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaV:FZP2tFP3vqY8uqEMpTaBacg
TLSH
T18F257437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6926239a-dd3b-4a5b-a888-eed511579f7f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2332_7952111\6926239a-dd3b-4a5b-a888-eed511579f7f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2332_7952111\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 77298a916b8c3274a584160d0ff02f5ff0f878f3ad0b0d37325542624334ebf4
MD5 2c71cbc66df316a6dc22e664cadd8858
SHA1 c1fb54a4af72ee841c744fdb59e36622a1b060cf
SHA512 6dfa59b764eda872a982069d769f69b6acf544b5c13528a048b21c4121024a5685ce802563445a2f03a27dec6ead7e8abee7c72dc4ab453574f53dd7c2f4ce59
TLSH
T1F8216B571B8DE8708AE01BA76CEC8E2573B7C7CA83A1D0A5B3499439880353D6B3D16D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1944-45-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-53-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-54-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-56-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-52-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-46-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-44-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-55-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-51-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/1944-50-0x000002ADFF850000-0x000002ADFF851000-memory.dmp

Download

memory/2608-31-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download

memory/2608-32-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download

memory/2608-33-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download

memory/2608-30-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download

memory/2608-35-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download

memory/2608-34-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

Download