b3c1358b8f74b9e461bb2ffd36f6346875d9a4adee93cb042fa55626187a46f4

Analysis

user interaction
yes
max time kernel
300s
max time network
307s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Readme.txt
Size 366B
Sample261018-2d43lsbt7z
SHA256 b3c1358b8f74b9e461bb2ffd36f6346875d9a4adee93cb042fa55626187a46f4
MD5 84aa6e899a75d33698be348e755eb583
SHA1 02da73ba610f6e33b53e17790f8bb916ec196575
SHA512 44b7720169cded11cd1895781b84e8e42ab077892a1e31ee5155e5bedd2d36c81ae446451f4e79f5b2282429762369d1b0b284e791eb628941daee84d8c2e278
TLSH
T163E02B9B92A90EA092970301510764C45E118294520E8D38B40FB0945FECB7D5C63C4B
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4352	4764	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2160	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4716	unregmp2.exe
Token: SeCreatePagefilePrivilege	4716	unregmp2.exe
Token: SeShutdownPrivilege	4764	wmplayer.exe
Token: SeCreatePagefilePrivilege	4764	wmplayer.exe
Token: SeShutdownPrivilege	1652	wmplayer.exe
Token: SeCreatePagefilePrivilege	1652	wmplayer.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4764	wmplayer.exe
1652	wmplayer.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2392	4764	wmplayer.exe	91
PID 2392 wrote to memory of 4716	2392	unregmp2.exe	92
PID 4652 wrote to memory of 3404	4652	chrome.exe	100
PID 4652 wrote to memory of 3716	4652	chrome.exe	101
PID 4652 wrote to memory of 4700	4652	chrome.exe	102
PID 4652 wrote to memory of 4700	4652	chrome.exe	102
PID 4652 wrote to memory of 4388	4652	chrome.exe	104
PID 4652 wrote to memory of 4388	4652	chrome.exe	104
PID 4652 wrote to memory of 3000	4652	chrome.exe	105
PID 4652 wrote to memory of 3000	4652	chrome.exe	105
PID 4652 wrote to memory of 4260	4652	chrome.exe	106
PID 4652 wrote to memory of 4260	4652	chrome.exe	106
PID 4652 wrote to memory of 2900	4652	chrome.exe	107
PID 4652 wrote to memory of 2900	4652	chrome.exe	107
PID 4652 wrote to memory of 2508	4652	chrome.exe	108
PID 4652 wrote to memory of 1792	4652	chrome.exe	109
PID 4652 wrote to memory of 3680	4652	chrome.exe	110
PID 4652 wrote to memory of 1792	4652	chrome.exe	109
PID 4652 wrote to memory of 3680	4652	chrome.exe	110
PID 4652 wrote to memory of 3296	4652	chrome.exe	114
PID 4652 wrote to memory of 3296	4652	chrome.exe	114
PID 4652 wrote to memory of 5848	4652	chrome.exe	115
PID 4652 wrote to memory of 5848	4652	chrome.exe	115
PID 4652 wrote to memory of 5320	4652	chrome.exe	116
PID 4652 wrote to memory of 5320	4652	chrome.exe	116
PID 4652 wrote to memory of 4656	4652	chrome.exe	117
PID 4652 wrote to memory of 4656	4652	chrome.exe	117
PID 4652 wrote to memory of 5072	4652	chrome.exe	119
PID 4652 wrote to memory of 2640	4652	chrome.exe	118
PID 4652 wrote to memory of 5072	4652	chrome.exe	119
PID 4652 wrote to memory of 2640	4652	chrome.exe	118
PID 4652 wrote to memory of 3408	4652	chrome.exe	120
PID 4652 wrote to memory of 3388	4652	chrome.exe	121
PID 4652 wrote to memory of 3920	4652	chrome.exe	122
PID 4652 wrote to memory of 2836	4652	chrome.exe	123

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2160

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 3992
  2⤵
  - Program crash
  PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4764 -ip 4764
1⤵
PID:2540

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0xac,0x140,0x7fff5c58c728,0x7fff5c58c734,0x7fff5c58c740
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,18254809765495432670,9152622048028160967,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,15356989900809917205,15837458181102345145,262144 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17663000590708789145,7367110120310181715,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,15241746991016779518,18172016505335812330,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,11679053900372923959,2900181493577819039,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,10453025385316304478,9525553158536728239,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,11909366825750029914,14936733119332808015,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5488,i,14660036950341718751,3058777623269488441,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,17787171214532885577,10821482996777441712,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5820,i,2126860529573686083,2049719132125958068,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,655959090787433760,2979086774362392610,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5544,i,2609752966340243896,11607049102434342570,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5568,i,1839043667741569650,12771901223046289588,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5988,i,7456628320544699514,9908751051809733676,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5548,i,15966765157620889397,9416746153083126601,2097152 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,12550992407601046720,4598132266179922734,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,2858571123823694345,9410964985757312233,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,12661684658071939544,3703229772107215329,524288 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5912,i,11858304015408826281,10690685569009547372,262144 --field-trial-handle=1880,i,10155839046891410004,12043535840285220909,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9ac94019-0a87-41d3-b134-473539da9e10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9ac94019-0a87-41d3-b134-473539da9e10.tmp
Size 5KB
SHA256 8d54e04050612dfba4c19005f3489327b2f6c5fef2c683ce0735b064c98754ee
MD5 0409b6e38ed785c948a531adb8992054
SHA1 da2495b0e21b7a67baeb52c8cea95f86844038a1
SHA512 9043ef9e1764359592bcf84f9bc3164792b3aaa360337d567f38475a0797943b9b87c696d3669e6180f0c768f2f38e603713a686dad816d7afe4836e20eb407f
SSDEEP 96:qC0d+qw+CWJKhPPf36vZtxSl8h4otop50vYD7B6rGyvr7jAixwzFWK2KpI0j9IEB:qC0h2WJiibiU2UuF3qj9x7K2KpIUl
TLSH
T191C12A75A47C6C364AF7DA45F4032D47CEB822AFA6107F54E6D91E1801E72EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1324bf19-4a21-4985-8583-b84b2784b083.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1324bf19-4a21-4985-8583-b84b2784b083.tmp
Size 11KB
SHA256 0154f5e7ad7d1df44d21406c81903b315611c5702811a1fe35f55966bd4b6b9d
MD5 35d776df383bdebe3004ba97e0d5410a
SHA1 4d961325e1e7f1cfa3e4a7b48c9e22f7deaffed5
SHA512 4e84004e60055de4c57bb0d0b853daf1fe7cc30a795198f34ebbe8932dd09ba7a9b02c1cbcd0cc9824feab94c13a5016f4d35b0d8e20f3f4c425a693df1f1bd9
SSDEEP 192:LR5DyAMtCv7+APRp2F9JHsb+WNnRW0wCeXbxVyIsnAUge:LR5GROrXCHw00mze
TLSH
T18C32A32DE920793B5CDFC619EEA17B93D6F5102221911F80EAFC892C25E76DC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31cd8d5e-4348-45f4-8045-ae15ec1f74a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31cd8d5e-4348-45f4-8045-ae15ec1f74a7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8a5542c4-afd4-4f4d-ae2a-72d5b460a418.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a5542c4-afd4-4f4d-ae2a-72d5b460a418.tmp
Size 12KB
SHA256 77bbc77eb07a10ce0b71a9582df8f763d4916a153925f7bec6f2b538f7e04919
MD5 9f3f8f7a067d38c26489c1eaa2864121
SHA1 733f0b995d57fac399dc0636d15ea1f10c030a75
SHA512 f2bd480f44874525f9dd534f3f13f118ca01e25f9836a2d335cc30d594facca21711b8478d881d83a16ecc43dd03c48053c0f258a549f8388531388d1c0e8c41
SSDEEP 192:LR5DyAMt3v7+gPRpyF9JHsb+WNnRW0xECeXbeVyIsnAUgE:LR5GRfDXuHw00xCSE
TLSH
T1BF42A32DE920793B5CDFD61DF9A67B93E6F5102221911F84EAFC892C25E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

31954f56-bb03-48ff-b0e1-802c78063816.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\31954f56-bb03-48ff-b0e1-802c78063816.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0f60ea0-26fc-4d07-9fdb-8de4768d1bdb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d0f60ea0-26fc-4d07-9fdb-8de4768d1bdb.tmp
Size 11KB
SHA256 eb1685f55cf634ab0c48eb430dfcb21c2e7bad39730c6b7bd4dbec486dc01676
MD5 969da611549d2f7491d595007b3184ac
SHA1 93879b7ef79284a68f5f4ed6a6150b74d829fd22
SHA512 40c7e2c3197ecdc24d463cfc2d2daf9721f00c9ad2aa82df06ed62cdc478b4728acf291659d536f94846339584eeda3c7bc46c5e781506c91613e094c94f8a8e
SSDEEP 192:LR5DyAMt3v7+APRp2F9JHsb+WNnRW0KCeXb8VyIsnAUgE:LR5GRfrXCHw00YEE
TLSH
T1C242A42DE920793B6CDFD61DF9667B93E6F5102221911F84EAFC892C25E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcf1211c-9705-49d3-a704-d9928c6062f6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bcf1211c-9705-49d3-a704-d9928c6062f6.tmp
Size 5KB
SHA256 4a0c821776824e9f3fff371e37b9dd1d4f15af0611ac3a3e339c6f7feb017d46
MD5 1197845fe470ce0f0b34d2c86c617538
SHA1 dc3b7f37a06d0ccd04f60476ec0298f0a5cfeffa
SHA512 47cb8290e7f453065d7f84ecc5eb50bcfcef45b938e5a143364ab259c723715bb2aec5b47115948ada9a9529d23af401fd1da43e5c84863a3372ada76a0db462
SSDEEP 96:qbJ0d+qw+CWJKhPPf36vZtxSl8h4otop50vYD7B6rGyvr7jAixwzFWK2KpI0j9Io:qt0h2WJiibiU2UuF3qj9x7K2KpIUl
TLSH
T1F3C12A75A47C6C368AF7DA45F4032943CEB822AFA6147F50E6E90E1C01E72EC2742623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d52f1a20-fa7d-41cb-bf03-2feadb491067.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d52f1a20-fa7d-41cb-bf03-2feadb491067.tmp
Size 79KB
SHA256 215bc581f723301ab8bf8263152a8f050621a4f4c78ebf6785619e57f56e0c19
MD5 78abe40fe5479581adc67723fb250ae9
SHA1 f1e3eeec4f4c294420dc27ef5f974ce2d426d227
SHA512 3ed4bb5cb51e35bba9ea478c203223d9fd5cdf535b262add988fcd1616b64cc5b3a7b2c6bb7e66fc5b9c407f06ef97b15ede87166fcd17f9107dc6fe7c3e35fe
SSDEEP 1536:/rxCdB37a9k6HgUgDsznWg2QVK4fIOA86PzfbRPLxDXzrkg+nAzYFiV:dCnG9DH6w6jsKcNaPxTJXnt
TLSH
T1D483F133E4252EBA94A71BECB5115C834DFC1BFB8388698CF098B45128AF5D49F07A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2aaeb75-3753-43d8-956c-ac7ff4759eba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f2aaeb75-3753-43d8-956c-ac7ff4759eba.tmp
Size 4KB
SHA256 47219763ff5fc4edcbd16336cf6435d6af7bc9cee7ff2208c738257e7c178bb1
MD5 dc1be26c949a9e45425ffb23d2a7809c
SHA1 439819108e62a21083f40b7f7658bb140825b491
SHA512 0c8e1e1a19291eea2499f987e859f55c76dbd07dd4d6364dd850264d651e17e8eeece973243017ab97d9d757ab6a249d330f5e05456f51e30fcf2cdd142ce2ab
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok50vsD7B6WGyvr7w7psbm3v4a:9C0h2WJiiniDUDU6Faqw7psbC
TLSH
T12BA1193294785C3B89BBC984B8832A07CEB4626FB521BF40D5DC0E0C11F72EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 afe7635f919ab9ced27fbb4607253c2fda990827a96f20695b9365e0ea656cec
MD5 f537a9d4bb9a6af90d680b9d2bee07f7
SHA1 e8f1a81712b430419dfa980a644898556e7a7bdc
SHA512 fc29ba31d1fc24947eedfd6856caf78d0bad727a654bdb36249e6891c87ffe31dfd35f166964a29b238177d0ed62bf5336a0affe5e0fa35ba39294a3e51a3080
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzAqUmNKX0AooJIm6:a69ZZQeoVYocxYCutFCJGAKt
TLSH
T19BC41F37A470A098DF3C35B1E2AC6F4CBD72641A12E006421F74B67F7A237D99A0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 c78085e2587ce88b22312faef1a583f1f69ca233c42cf90e7caa5458e28fd028
MD5 e7b5bd0210e7d55a709f74f33ce8cf6f
SHA1 fffaeaa326f4eeb55d1e66c1c4bd8e0c3956f24d
SHA512 fec30f175cf38eabed2743e491b5b325faf5e0a8d8c357e17d438cdc0055b01fd9ef434b480fb2605146139f50492a627fcc6af843b73715880948d2f08eeb16
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbal:oZP2tFP3vqY8hqEMXTaBacg+
TLSH
T1E5258437D190B0C5CF2C7071E9ED8F09BA63A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1.1MB
SHA256 dbf45a226ef72e69ea39113e78f64bebd10590caecccec6d1cbebdc52ebdf1ce
MD5 9d5bd1d825da2b66bbb8376b56af5584
SHA1 b889a76f64b7fd650c5e58f933664f3b44cada5c
SHA512 50be0575c9a16f712782fb6ee6f331897ff1c1fe6ff119ea63c9f4ddb5b3ba50750370db39ecd05ccb409a2aa43692086b08cad214f4350bab34f7127b06a24c
SSDEEP 768:30aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX0RoJImdbaK:ZZsMdtFP3oy+Y8hqEMXTaBacKjH
TLSH
T10D358437D190B0C5CF2CB071E9ED8F09BA73A10B11A052465FF8A57A7A633D99C1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 937ad639d89115d5c5146d9b9170a1cf23336bbce6e4ac6d2920420e878fec39
MD5 6bc150b7e23c767dc8b6c99d042db2e8
SHA1 bee97e2370d412b25c65dcf9b56d72ced9960414
SHA512 c77272158467573f2d75d18b2db856d43552de0431e038dde5dfd97550a09bd31be6403f7b31d3a5f4af7fa8a449771e795568332793ab44feb25e543edd0eab
SSDEEP 96:mlt2UNXt2NUMUst2l7Xt2eUMbst25UMlst2aOXt23L2t2cLXt2kt2LAt2dt2:lnKn1ni
TLSH
T15C63A098A3E4A659FBF72F716AF795165F7A38A6AE25D10C0210424D0C71F2CE930F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lastplayed.wpl

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl
Size 362B
SHA256 498818427ef69f9af6ac6e967d52ccfe58380390451dd18f8096428b27528b6c
MD5 e52fc0f651ee88e0aa9110205f9f56b3
SHA1 1ff947db94122433a5ebf89ce0175546380efa78
SHA512 b718acc010327418e939cc4c960bd7eed6552fc88bfb011264777044a78ec623f301cef82d3a360fb068d0a56ac2b5f4c300d36b1e8bc170d78b84d3725bb1f7
TLSH
T138E08C23A1C47D319AB164286687FA63EE602993420A0681B0CC638B1FF7A95C6C35A0
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 5c60b4dba1495abbe4b1b17060c21eaae7be1d2b3590990271ac12c9626fd0f4
MD5 85b795e66320201fd1d0d2dee712dbb9
SHA1 8bf17fa17f83f3d3feaa06e0d8574a16279f4923
SHA512 0e45d8973eb37821c5171e3081bfd0c4bb7f3045b0f624535f8fdf7169341620c90684529871c9ebfa5d866e87eb5919559927ac3d997d78ba43d308248142e3
TLSH
T1A1217C574A0AE4B1CD6247B359CC8A27B3B6B7CB5364D425B3CEA01E880153E133D17D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 9ba2d260aa8626f18770354dca9c42e1e0f4672ba14c5e773cf8abab943a9eb7
MD5 b207a9921e09d54bd1ce08a81f26683d
SHA1 0bc8cbe90fad204c9d2ea9ab971268fb0d180e0d
SHA512 e83226c9e70964c5f26596e22d989b4c1b502a1559301c4588a04a130187e9ef7877a49b41feeb38821ecd4384f7170adfd4f31f823ef5f8415fc517ab8f734b
TLSH
T19C31EF1013E1464DE0B24573BC37A7017B75B801AB1D864F019C511A0CE5A01B97BFEA
MD5 SHA1 SHA512 TLSH

Submit Download

CM96867HIV36E95UWRCR.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CM96867HIV36E95UWRCR.temp
Size 3KB
SHA256 5a89849fd586e2fd7a22118ecfcf8b302d35b2c44f0a702b1e6f9d5139f0d04b
MD5 5fd36e7adcbb27db4a37a337c8cd9ba8
SHA1 87c4a9f48c039627cfecac8d65ac0076d885826e
SHA512 5616cf91cbd9a9174a52253d60b7f33aea81a4ba8d4736421543eb8d694889bef588614a6347521a401d15626dcd6634ec8533cb215cbe2489f8cf3d9a201bfb
TLSH
T1B471EF0013E1524DE0E28673AC379B01BB75B802AB1D9A4F4699511A0CE5A00B97FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

ONX2DB7H6QGKKHSJKVTU.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ONX2DB7H6QGKKHSJKVTU.temp
Size 3KB
SHA256 52386b0e93de4f319c0bb2ddd91c79f95dc09c31021346139b92bdd81ec8dbfb
MD5 936a0a4cb4ce02d634ce4f7f29e8b8e2
SHA1 702061d3386a238e7a474aca7259640c703b8e80
SHA512 2f43034d17c2e5fbad9df45fc34d07e09a71f5daa025db890ae29031bd8137104318e034373e236d728aa13da11081428b8fc69d8bd1d7f7c5e2809dd3abf8ec
TLSH
T1E571DE1017E1528DF1F28673AC37AB01BB35B802AB1DD64F4699511B0CE5A01E97FBEB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4764-78-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-89-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-60-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-62-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-64-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-63-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-65-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-66-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-68-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-67-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-70-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-69-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-71-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-72-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-73-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-74-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-75-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-76-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-77-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-59-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-79-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-80-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-82-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-81-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-83-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-84-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-85-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-86-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-88-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-87-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-90-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-61-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-92-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-93-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-91-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-95-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-94-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-97-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-96-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-98-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-100-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-99-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-101-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-102-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-103-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-104-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-58-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-57-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-55-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-54-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-52-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-53-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-51-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-50-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-49-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-48-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-41-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-42-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-39-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-38-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-36-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-35-0x0000000007950000-0x0000000007960000-memory.dmp

Download

memory/4764-105-0x0000000008590000-0x00000000085A0000-memory.dmp

Download

memory/4764-106-0x0000000008590000-0x00000000085A0000-memory.dmp

Download