njrat | 43928467506f198adaab4e629f5afbe537a3a5b7adc30fc8189b455b9248e23d

Analysis

user interaction
yes
max time kernel
291s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Payload.exe
Size 55KB
Sample260822-eksxla1bla
SHA256 43928467506f198adaab4e629f5afbe537a3a5b7adc30fc8189b455b9248e23d
MD5 ad15631a2f4d08a72a82cf16dd3808a1
SHA1 e3fc4b162a71d593d69f62474e9aff964d05329b
SHA512 d70c3d186169be54ee1fcebbc24e21a2c4f2e5d85260c0de3a4ecc1ea26677bd265bd4a4a319fdccd7898ce51594b6ff95af7c7f784f764203b7626705449c65
SSDEEP 768:dxOecKt1ManMy2Nrjyjyn3UhkSNjmwFvfu0YMDHPs5L7XJSxI3pmem:dx84DnANrjyjmADKwsNMDUXExI3pmem
TLSH
T19E432844BFEA4A05E2BD8F3468F655150634BA63E532EB1F48D668EB13327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution njrat trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3036	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MatrixMBR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Payload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	57e113630cc14df5ae4e86df4f406538.COM
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MBR2.exe

Executes dropped EXE 7 IoCs

pid	Process
3076	57e113630cc14df5ae4e86df4f406538.COM
4344	MBR2.exe
2348	TROLL5.exe
2732	TROLL2.exe
1512	MatrixMBR.exe
3304	GDI.exe
644	MBR.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3036	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\MatrixMBR.exe	MBR2.exe
File opened for modification	C:\Windows\System32\MatrixMBR.exe	MBR2.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
940	sc.exe
4048	sc.exe
4820	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe
4692	cmd.exe
3540	cmd.exe
2856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318450113314746"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3036	powershell.exe
3036	powershell.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: 33	3736	Payload.exe
Token: SeIncBasePriorityPrivilege	3736	Payload.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4372	3736	Payload.exe	86
PID 3736 wrote to memory of 2856	3736	Payload.exe	88
PID 2856 wrote to memory of 3036	2856	cmd.exe	90
PID 3736 wrote to memory of 700	3736	Payload.exe	91
PID 700 wrote to memory of 940	700	cmd.exe	93
PID 3736 wrote to memory of 4692	3736	Payload.exe	94
PID 4692 wrote to memory of 4048	4692	cmd.exe	96
PID 3736 wrote to memory of 3540	3736	Payload.exe	97
PID 3540 wrote to memory of 4820	3540	cmd.exe	99
PID 3384 wrote to memory of 1744	3384	chrome.exe	112
PID 3384 wrote to memory of 1700	3384	chrome.exe	113
PID 3384 wrote to memory of 4900	3384	chrome.exe	114
PID 3384 wrote to memory of 1700	3384	chrome.exe	113
PID 3384 wrote to memory of 4524	3384	chrome.exe	115
PID 3384 wrote to memory of 4524	3384	chrome.exe	115
PID 3384 wrote to memory of 3260	3384	chrome.exe	116
PID 3384 wrote to memory of 3260	3384	chrome.exe	116
PID 3384 wrote to memory of 376	3384	chrome.exe	117
PID 3384 wrote to memory of 376	3384	chrome.exe	117
PID 3384 wrote to memory of 596	3384	chrome.exe	119
PID 3384 wrote to memory of 596	3384	chrome.exe	119
PID 3384 wrote to memory of 840	3384	chrome.exe	120
PID 3384 wrote to memory of 3620	3384	chrome.exe	123
PID 3384 wrote to memory of 3620	3384	chrome.exe	123
PID 3384 wrote to memory of 1032	3384	chrome.exe	124
PID 3384 wrote to memory of 1032	3384	chrome.exe	124
PID 3384 wrote to memory of 2080	3384	chrome.exe	125
PID 3384 wrote to memory of 2080	3384	chrome.exe	125
PID 3384 wrote to memory of 2632	3384	chrome.exe	126
PID 3384 wrote to memory of 1384	3384	chrome.exe	127
PID 3384 wrote to memory of 4172	3384	chrome.exe	128
PID 3736 wrote to memory of 3076	3736	Payload.exe	129
PID 3076 wrote to memory of 4344	3076	57e113630cc14df5ae4e86df4f406538.COM	130
PID 3076 wrote to memory of 2348	3076	57e113630cc14df5ae4e86df4f406538.COM	131
PID 3076 wrote to memory of 2732	3076	57e113630cc14df5ae4e86df4f406538.COM	132
PID 4344 wrote to memory of 1512	4344	MBR2.exe	135
PID 1512 wrote to memory of 3304	1512	MatrixMBR.exe	136
PID 1512 wrote to memory of 644	1512	MatrixMBR.exe	137

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4372	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc query windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\sc.exe
    sc query windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc stop windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\sc.exe
    sc stop windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc delete windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Users\Admin\AppData\Local\Temp\57e113630cc14df5ae4e86df4f406538.COM
  "C:\Users\Admin\AppData\Local\Temp\57e113630cc14df5ae4e86df4f406538.COM"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:644
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9b2fbc728,0x7ff9b2fbc734,0x7ff9b2fbc740
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,313266793198386457,17061481183011897005,262144 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1628,i,6353174011383527850,15986257134589567963,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2444,i,8659761694215876694,11996867633719788659,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,9592528293673481433,6332575273302684205,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,9729903360251566725,13901043083976038493,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4596,i,11881193697851903636,14658026719697870704,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5372,i,7540817448501180599,14604547577762807403,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5788,i,2816353978049268107,6234071211821127413,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5984,i,7012994980659392435,3277692645812283181,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5672,i,7616932446278022528,15237632071645795367,2097152 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5948,i,3726028883545256021,14500197550230814610,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5968,i,17050353413392036439,10887141444552639926,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5664,i,11218072992718939460,17630391276007525135,524288 --field-trial-handle=1960,i,16029876343513552801,7289889050990224057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x418
1⤵
PID:444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2d4b89fdc33fbd860e56d26d6e0e17f2df82391e8c8c4464841ce030b67b3942
MD5 6419dbdf7e6b6be483110abe7aae33f4
SHA1 35324516d1be1e6ce7475d902fba4a53685de5c1
SHA512 4289a735275fe7e52dee2857a59dabe31e989400cbea41d7acc313dd20cf319846eff2327a559d15161a63c910325eeabd6345afef07d5198bfd1c2a396c632b
TLSH
T1E9E02BBADA35AC2718FD172C5040474AD740135B3B40C94F3A3D8109CFB963A055681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 1598abb59efbc7428e4b3c38d5f2e6380319cbf4008ecf011e38de65f3929cb7
MD5 4c0055b9d501ac1e4aed5ccd41d2548f
SHA1 f32a584efd9901cb7bc6a4c9343f307847084238
SHA512 88e30ec00ffe4a2c17322e97a2503a1e60163ab58c0c28d190301e7ddfeab6d44e582110b3cd1f07a87382db1b498d88ec5dbacc549b4872140ec5522a1393bd
TLSH
T177D012225E1645B2C75B053171AF044724F2159B87905166959013A8B152DE1774794D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 17c31d1aa5711654e9d021162d0315836aa33fee89e85b6f06c02d117c7392cf
MD5 b075cd6c5bcdb0ec04e9ccfaa8359b71
SHA1 8ecd66034e396a3daa9cfa26df1c9c944070afad
SHA512 f4637b473c15d74680ad95115ca2c81803f6c11c46695f8da4c4cee3a282dc40aa9f3e8ae7522ec809920bffe8bd7ed0f394b7a357eb8af068fbf8056344bc1d
SSDEEP 48:YALlqFqCh3hHh0hfdaXYfoKsu1fskos/BsUHdIyssKsWtsgcsK4sg+svPsdg:DSXpJmxdaIJZvj9I+M3WgFcg
TLSH
T1F6917EF7C3D4C66DC91156F49B11AE1FCE290A28432C3C67C8D8AE5B93E2872D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 955aa11b2540ee8eefbb4e8db5744044aeaedce0069bbffe874ff4994f4d79af
MD5 2b38ef225aca2d5fe68799af3b2df43b
SHA1 ec74f3648dee9e71f86db3dc85129724f7b5cfb2
SHA512 ed093fb99f97aabfe014f3ddb4dacdf70c00cccf241874c691b1842fc6a06e19e4b5d61a2307a6fe1c23ef8da9c4030945404abf7dc2e8df4e5f87d0d139984d
SSDEEP 192:FRcAxJAFv78pAPRp2rSJ49DHsb+WNnVy8mF2xd8kwdaYVyIsnAUgraJ:FRcAQ14UXg5wIz2c9a8e
TLSH
T17B42B62EB924293B5CDBE719F9257753D3F6102261952E84EAFC892C14EF5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4f66f43095cf987f63a5b47f5ba015d963652f33eb2fbd9b2a7ad048b894ff1b
MD5 bd4545effdc8d9bcdb5a6332902a0de5
SHA1 f75e63d7e0db1d9be383dcfd9e82c35bcd4786d2
SHA512 d60965ed3e83c2b4358ee9b301b387b32b6a37314ce880bc600d4898083685e293c109378a89653a16792d35ba571bed7b24d26ab0ae20b1926e70508942eb09
SSDEEP 192:FRcAxJAFv78pxPRpdrSJ49DHsb+WNnVy8mF2Hd8kwdaSVyIsnAUgraJ:FRcAQ14LXf5wIz2K9aSe
TLSH
T15952B52EB920293B5CDAE719F9257753D7F6102261A52E84EBFC892C14EF5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 16c1e71fd06e2d4283afe51e047dbfc7836f9acc26bd08f6fd93657d99f3d595
MD5 009919ea24a2da4afd009b243c51313c
SHA1 94c7977e30f52250340ea2137258ee60a0f2bb3d
SHA512 1e327d7eee7d97e77a665bdbebdbc1ce0f085d1e1fdc4d05b2b93af1fc212c4cd36e75b641c19977be13d758e0dc67e266ccd2e7d955c8bbcec912784dd453a0
SSDEEP 192:FRHAxJAQv78pAPRp209DHsb+WNn+l0Xd8kwda4VyIsnAUgtaJ:FRHAQM4UXD5w0069ac8
TLSH
T1EB42B52EAD24693B5CDBE219FE257753D3F6102261952E84EAFC892C14EF5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d77513688f8b43ec552bfb2323f7ad1987f826b77c4b2fe847800c098ab4b1ad
MD5 251fa04d4cf2430e2fc02fd7aff030a6
SHA1 397cd60785f328a19668dd613bd14ddb90f12f81
SHA512 601d4fa80cfc5b567d36161f6b149a147258f44f611226a1bcfc59e55d7e7ae85c50b9d024d001ccf1e22027bf43612fccff5a10e43f820db675988f51ab1cef
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:1m7Rkm1tYpBeh2BAoO
TLSH
T116C3123B5D75E9375978A70EB48E0B1E1EF249A6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 e2afa19507ac3355929eaec0ecf5f2abde875ff2b65c985771b2896321baae2c
MD5 08643da1ba4acf964c9e88add830b017
SHA1 649a48707d256536707d674dee07f1651e8d8b03
SHA512 a685fdb3cb0363a5c2c9bf966761dc00186eba8390c83688501686bb87790bb0e0ddf1437733ae4bf50f8f39ba61bccb3cced10b84d0319d0db7eaa2a29141dd
SSDEEP 6144:qfj/a7Vd+pbYgrP5qzm7Rkm1tYpBeh2BAoG:qrm09nP5qC9oBGcAoG
TLSH
T1693423735D759D365F1DE70C640E3F1F1EF64C969D7E88A14A842A0C93AE3E80909EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 3c7b31533f75777ff17fa43ab4a2e9510d474692c9be8bc0942306f69b7a9f12
MD5 2f38811a9ca05c837b90a973d6c9e8ad
SHA1 be58b8e2908326eb3fc22371c7341495f03e94e4
SHA512 14204e5927a4207da85e53aca69984e5ac7220bee69139b3671546731d6a1e4d0768174456ef4a7ddc2267053568a702569dffa42a47190143547f6827404880
SSDEEP 6144:9fj/a7Vd+pbYgrP5qzm7Rkm1tYpBeh2BAoG:9rm09nP5qC9oBGcAoG
TLSH
T1C13423735D759D3A5F1DE70C640E2F1F1EF64C969D7E98924A842A0C93EE3E80909EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b1ccb95e65c9e94a344f8798fa280a336c67f25c117fb3dc8ec69deefdd0c0a8
MD5 9df42cec70fb1da5fab9a59e9dd0bc50
SHA1 f66efb66ac3abf1fa8e8b41cdfdcef2d46434f36
SHA512 326abf3096ca66f52786872b88b44832ff8aeb2a27599d39bf2ee5c596ecc768e29dc4ba1a9e1970d4bd36e4e2a1fc0b9621ae9c8b3a44fcd8718683326931f0
SSDEEP 6144:/1yj/a7Vd+pbYgrP5qzm7Rkm1tYpBeh2BAoG:Nym09nP5qC9oBGcAoG
TLSH
T17C3412772C368C365F1DE70C600E3B1F0EF25D66C97E989159842A08A3AE3E84D09EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57e113630cc14df5ae4e86df4f406538.COM

Path C:\Users\Admin\AppData\Local\Temp\57e113630cc14df5ae4e86df4f406538.COM
Size 921KB
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_41pxrjr4.fz2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41pxrjr4.fz2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-250-0x0000000000900000-0x0000000000946000-memory.dmp

Download

memory/2348-232-0x00000000003D0000-0x0000000000488000-memory.dmp

Download

memory/2348-235-0x00000000029F0000-0x00000000029FA000-memory.dmp

Download

memory/2348-233-0x0000000005350000-0x00000000058F4000-memory.dmp

Download

memory/2348-234-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Download

memory/2732-245-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3036-22-0x0000000006870000-0x00000000068A2000-memory.dmp

Download

memory/3036-7-0x0000000005BE0000-0x0000000005C46000-memory.dmp

Download

memory/3036-43-0x00000000078E0000-0x00000000078E8000-memory.dmp

Download

memory/3036-41-0x0000000007800000-0x0000000007814000-memory.dmp

Download

memory/3036-40-0x00000000077F0000-0x00000000077FE000-memory.dmp

Download

memory/3036-39-0x00000000077C0000-0x00000000077D1000-memory.dmp

Download

memory/3036-38-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/3036-37-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/3036-36-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/3036-35-0x0000000007C10000-0x000000000828A000-memory.dmp

Download

memory/3036-23-0x000000006E9F0000-0x000000006EA3C000-memory.dmp

Download

memory/3036-31-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/3036-32-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/3036-33-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/3036-34-0x00000000074B0000-0x0000000007553000-memory.dmp

Download

memory/3036-2-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/3036-21-0x000000007FAB0000-0x000000007FAC0000-memory.dmp

Download

memory/3036-3-0x0000000002980000-0x00000000029B6000-memory.dmp

Download

memory/3036-4-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/3036-5-0x0000000005500000-0x0000000005B28000-memory.dmp

Download

memory/3036-19-0x00000000062D0000-0x000000000631C000-memory.dmp

Download

memory/3036-18-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/3036-6-0x00000000053E0000-0x0000000005402000-memory.dmp

Download

memory/3036-16-0x0000000005CC0000-0x0000000006014000-memory.dmp

Download

memory/3036-8-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Download

memory/3036-42-0x0000000007900000-0x000000000791A000-memory.dmp

Download

memory/3076-196-0x000000001BB90000-0x000000001BC74000-memory.dmp

Download

memory/3076-195-0x0000000000D20000-0x0000000000E0C000-memory.dmp

Download

memory/3304-271-0x0000000000160000-0x0000000000168000-memory.dmp

Download

memory/3736-17-0x0000000000D30000-0x0000000000D40000-memory.dmp

Download

memory/3736-20-0x00000000747D2000-0x00000000747D4000-memory.dmp

Download

memory/3736-0-0x0000000000D30000-0x0000000000D40000-memory.dmp

Download

memory/3736-1-0x00000000747D2000-0x00000000747D4000-memory.dmp

Download

memory/4344-221-0x0000000000440000-0x000000000047A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads