Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NjRat.0.7D.Danger.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
NjRat.0.7D.Danger.Edition.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target NjRat.0.7D.Danger.Edition.zip
- Size 15.8MB
- Sample260905-xrb7ja1bkh
- SHA256 4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb
- MD5 18b9e23e509ff221ebb1b8a0ce4bc82b
- SHA1 bacab6a415515e94b3083c4f7ebda6a82e1d4c7f
- SHA512 26091095397f3b229439bb4838f3321de63b9084beab20391a3f85fa8038836d9d0a96a44c7de1d860b182d0b072e0c752494201eb50fd36444cfe742d310ca1
- SSDEEP 393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi
- TLSH T17EF6332A4A16705AFE27731A50EB9CF0A7A609B6B159FC5D2AC830D0C50FDDECE5184F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\D: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\D: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4924 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 5668 taskmgr.exe Token: SeSystemProfilePrivilege 5668 taskmgr.exe Token: SeCreateGlobalPrivilege 5668 taskmgr.exe Token: SeShutdownPrivilege 2308 unregmp2.exe Token: SeCreatePagefilePrivilege 2308 unregmp2.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6140 wmplayer.exe Token: SeCreatePagefilePrivilege 6140 wmplayer.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe Token: SeShutdownPrivilege 6060 chrome.exe Token: SeCreatePagefilePrivilege 6060 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 5668 taskmgr.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe 6060 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5668 taskmgr.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 6140 wrote to memory of 4660 6140 wmplayer.exe 94 PID 4660 wrote to memory of 2308 4660 unregmp2.exe 95 PID 6060 wrote to memory of 5664 6060 chrome.exe 97 PID 6060 wrote to memory of 4924 6060 chrome.exe 98 PID 6060 wrote to memory of 5608 6060 chrome.exe 99 PID 6060 wrote to memory of 5608 6060 chrome.exe 99 PID 6060 wrote to memory of 4432 6060 chrome.exe 101 PID 6060 wrote to memory of 4432 6060 chrome.exe 101 PID 6060 wrote to memory of 4764 6060 chrome.exe 102 PID 6060 wrote to memory of 4764 6060 chrome.exe 102 PID 6060 wrote to memory of 2660 6060 chrome.exe 103 PID 6060 wrote to memory of 2660 6060 chrome.exe 103 PID 6060 wrote to memory of 4216 6060 chrome.exe 104 PID 6060 wrote to memory of 4216 6060 chrome.exe 104 PID 6060 wrote to memory of 724 6060 chrome.exe 105 PID 6060 wrote to memory of 724 6060 chrome.exe 105
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D.Danger.Edition.zip1⤵PID:4532
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3212
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff86365c728,0x7ff86365c734,0x7ff86365c7402⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,2264689237694387629,386867503898634549,524288 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:112⤵
- System Time Discovery
PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,3604535454364902585,16567879306468126477,262144 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:22⤵PID:5608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,9872401278752225179,9032105091206575490,524288 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:132⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,2584844597384711454,3180389556089461520,2097152 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,8616846679519613749,9798804419557930958,2097152 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,14884422809082321645,1293046809048087369,2097152 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,10578959964500965622,4311040449185234647,524288 --field-trial-handle=1840,i,12684918855108107900,13589249597893901435,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:142⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 353ee31a59d578d9a659bf3859886ab4eb415b7a9ef9d34c5ad2b56fbd28759a
- MD5 89443807defc82ba2cace86dad98c583
- SHA1 76e723908ff1d4d91d6d7bdac6f30ef38ea66d02
- SHA512 c5babd4827f456f0c59f6d550573e8175c75535b40831ae9abacde2b1fdecb7b2a05f7d981b50f76ca60bddab5f5366f614285407b701a1332408215c691658e
- SSDEEP 192:iRkGb4MCv7sAPRp2X964Hsb+WNnpH0rQUVMkwraNVyIsnAUgR:iRkknOBXUbwJ0EUCLabR
- TLSH T11432953EB964297B6CDAC329FD617B53E7F5102221942E84F6FC592C24E7ACC2227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 a7950f9d2abc0622e7580d0cace8af20147b5bac9b941a011c58b10b0c2d7704
- MD5 b6ae8696fff1bbb14258396f84094800
- SHA1 fa8fcc384413489f5ebda685bd9a1142f098ec9e
- SHA512 355736061491ccc84ca7abe730d790fc04b8d57780e548bead54bbc0a7b5c46d45aaa79a66f057b35fb5028b9414b1f0b3aed9f5258112b398a9e25288a21536
- SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN9VjCxBRqXP:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSU
- TLSH T1EA32E827A48E9A3F0FD8D91CD8136F4BADF5025262380D3496FB9D0803E57CA115A5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 4aa5b2de1fed40a5403fd7df946eb0a8271241afb13ed49b0af589567468e3fd
- MD5 912e53d2bab300f76cc3db4d2e9658a9
- SHA1 49dacb7d9071b4bf1280091336ce06e8fe046ea4
- SHA512 96560412a6a7872ce7478cc23b99c5f9eddb80329db54f0b4f0aa50a1c42538a4d78360974a0eb5a38ba665972467ef6761c8563f52622e07cef0493e588aa61
- SSDEEP 96:fDC6C1d+cAOIt5aDVmufj747uOcgSl8h4otop5GmpDGEB6SXGyv9JtFiO0AuSwkF:rC31LA/TE57LuiU2DPO+tFGSwQtDmXUl
- TLSH T119C1187178BC2E625DF69958F5877A43CEA4A017A962AF848DED4B0C11D74EC1342A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 02c8a774ccfa91450e30a81193d24e5ef2b46b1bf68778a6db9c438b8bf43bbc
- MD5 706ebe85d68f6137d16e45b8f6ba0ef3
- SHA1 0cdcf3947a71737b8b07b0ca260063c652243e10
- SHA512 b6232cca2e46fd0fb6e6217a2c3c413f914de37e3fa4cd5a89ed32bd66648cac4ecfe0a41a4e82201cb79cc119a12958b94acf64816946d3149da207374a5727
- SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5GmCDGEB6/dGyv95SRohbb2Jv4a:gC0LA/TE57cDUDWPUweSmhbKl
- TLSH T1EDA10971B4A85EB75C75C684F9827E83CF68A117A9226F80D8DC1F0C10EB0EC1382A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 65b464501a68d05ed33f54ef817ae3ecf17633d2137480f34bce071abe55cfb0
- MD5 36cce883d69f69e0b2f3105e956625fd
- SHA1 cf6e2d0a6650fe523720dce78034386cb99c5cf8
- SHA512 6399d3bb0fa5db963954b80f650e6c08a2433b6407af009519b4e2aa8e02430c490a43c3634f7dcbc7f2204c1643265de2c67f934bbfa3c544c8a1bcbb7cdeba
- SSDEEP 3:0GTltl3allkltlsl7pl+e/lls4XYaltMlmlVlPLrsI1Xlldl0lcNklltlwzl4hRu:0G0+1E3+e9XYaltkSPsI10cAe
- TLSH T190539B14E3645667D404437664D507C36335F05D1D5B970B5019763C1C022D92CB11D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 0bf40e22fe025d6d085e2a96437819c8c5f09cd859dfd0bcbe729bc54842e5e0
- MD5 726e7e319b2c5348078356d24cc0b3a7
- SHA1 313cbe7d586b146f8dffa4e7047a7bcea4143602
- SHA512 7c1cd572040746648b675fa3c770cd972976a61136ff27282c4006bc3e62da9cb9d72c4bad8db5c221a0c9a27a51f72bda848f6015a35850cd61e66d56b9b033
- SSDEEP 768:S0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba6:8ZP2tFP3vqY8+qEMsTaBacgR
- TLSH T120257437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D0B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 e634f48750b2b509f052d9168e7741876c5070bdf34f0e3373723c7bc79cdf14
- MD5 b879e3ebb66488b787ae3fd2dc20ff83
- SHA1 7b669cf70e030dfcaac58c4d0acdc5119a910436
- SHA512 58e7989097f2451a33e30c8d95bbe796de8f6aa0f8b2c0cde32e4b619a6ef8b4401fdbb47b85ef7d004b89109ef77cf087692d273295abf608cff0ebe3c7f4b7
- TLSH T19C217C574A0AE4B1CE6287F359CC8A2773BAB7CA5354D015B38AE01E894113F633D17D
- MD5 SHA1 SHA512 TLSH