ratonrat | 6b9e5ae9bcc80f07e54616919bbf9d4f0cd74b56efcabe7e499360075ad2d608

Analysis

user interaction
yes
max time kernel
116s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
b8754abbbf7d68836ec7b52b02ab8bdf.jpg
Size 66KB
Sample260908-qxtkfacl2t
SHA256 6b9e5ae9bcc80f07e54616919bbf9d4f0cd74b56efcabe7e499360075ad2d608
MD5 68bfcf5943911af1f5e9162d68a72ced
SHA1 937cc0d273586f0a2f34550553211ab99946e2d0
SHA512 cea7ccf61f55fb8755bc3eb38bd091f8475b160559b14df4671eb93f603cfa98c9958d014be651151089261a7f6a7267c255df1e83aae14fa753bf01f1d28940
SSDEEP 1536:5gjdwuNL1Oyk9FcpIb6MJ9whaafbfTry2hhUPfEtqbL:2jdfOyk9Fc2b6MXwoafzny2hhUPfzbL
TLSH
T1436302560CC34C18D68B3FF2725224C5C7DB1A85C599217DA8015F3FAF6CEDB926E282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence ransomware stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

magi1402-45475.portmap.host:45475

Mutex

QJhTgz60T4EL3Xoqw92elzB

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
password
t.me/junk_code
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001c82e-586.dat	family_ratonrat
behavioral1/memory/6984-594-0x000001FBB1610000-0x000001FBB1760000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6180	powershell.exe
1276	powershell.exe
6180	powershell.exe
1276	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	2704	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
6984	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	api.gofile.io
49	api.gofile.io
54	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1480	timeout.exe
4820	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333483564236802"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6920	schtasks.exe
2228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3628	mspaint.exe
3628	mspaint.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
2460	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
6180	powershell.exe
6180	powershell.exe
6180	powershell.exe
2460	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
1276	powershell.exe
1276	powershell.exe
2460	ratonfsdfsdClient.exe
1276	powershell.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe
5208	ratonfsdfsdClient.exe
2460	ratonfsdfsdClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5208	ratonfsdfsdClient.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe
Token: SeShutdownPrivilege	5152	chrome.exe
Token: SeCreatePagefilePrivilege	5152	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3628	mspaint.exe
3628	mspaint.exe
3628	mspaint.exe
3628	mspaint.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 6444	5152	chrome.exe	94
PID 5152 wrote to memory of 5824	5152	chrome.exe	95
PID 5152 wrote to memory of 5824	5152	chrome.exe	95
PID 5152 wrote to memory of 2704	5152	chrome.exe	96
PID 5152 wrote to memory of 1328	5152	chrome.exe	98
PID 5152 wrote to memory of 1328	5152	chrome.exe	98
PID 5152 wrote to memory of 2484	5152	chrome.exe	99
PID 5152 wrote to memory of 5848	5152	chrome.exe	100
PID 5152 wrote to memory of 2484	5152	chrome.exe	99
PID 5152 wrote to memory of 5848	5152	chrome.exe	100
PID 5152 wrote to memory of 2740	5152	chrome.exe	101
PID 5152 wrote to memory of 2740	5152	chrome.exe	101
PID 5152 wrote to memory of 7064	5152	chrome.exe	102
PID 5152 wrote to memory of 7064	5152	chrome.exe	102
PID 5152 wrote to memory of 6316	5152	chrome.exe	103
PID 5152 wrote to memory of 6316	5152	chrome.exe	103
PID 5152 wrote to memory of 7068	5152	chrome.exe	104
PID 5152 wrote to memory of 7068	5152	chrome.exe	104
PID 5152 wrote to memory of 6968	5152	chrome.exe	105
PID 5152 wrote to memory of 5052	5152	chrome.exe	106
PID 5152 wrote to memory of 4440	5152	chrome.exe	107
PID 5152 wrote to memory of 5052	5152	chrome.exe	106
PID 5152 wrote to memory of 4440	5152	chrome.exe	107
PID 5152 wrote to memory of 6020	5152	chrome.exe	111
PID 5152 wrote to memory of 3396	5152	chrome.exe	112
PID 5152 wrote to memory of 6020	5152	chrome.exe	111
PID 5152 wrote to memory of 844	5152	chrome.exe	113
PID 5152 wrote to memory of 3396	5152	chrome.exe	112
PID 5152 wrote to memory of 844	5152	chrome.exe	113
PID 5152 wrote to memory of 6564	5152	chrome.exe	114
PID 5152 wrote to memory of 6564	5152	chrome.exe	114
PID 5152 wrote to memory of 4700	5152	chrome.exe	115
PID 5152 wrote to memory of 4700	5152	chrome.exe	115
PID 5152 wrote to memory of 1904	5152	chrome.exe	116
PID 5152 wrote to memory of 6780	5152	chrome.exe	117
PID 5152 wrote to memory of 1904	5152	chrome.exe	116
PID 5152 wrote to memory of 6780	5152	chrome.exe	117
PID 5152 wrote to memory of 4372	5152	chrome.exe	118
PID 5152 wrote to memory of 4372	5152	chrome.exe	118
PID 5152 wrote to memory of 5456	5152	chrome.exe	119
PID 5152 wrote to memory of 5456	5152	chrome.exe	119
PID 5152 wrote to memory of 1568	5152	chrome.exe	120
PID 5152 wrote to memory of 1568	5152	chrome.exe	120
PID 5152 wrote to memory of 3020	5152	chrome.exe	121
PID 5152 wrote to memory of 3020	5152	chrome.exe	121
PID 5152 wrote to memory of 2960	5152	chrome.exe	123
PID 5152 wrote to memory of 6920	5152	chrome.exe	124
PID 5152 wrote to memory of 6716	5152	chrome.exe	125
PID 5152 wrote to memory of 3500	5152	chrome.exe	126
PID 5152 wrote to memory of 3500	5152	chrome.exe	126
PID 5152 wrote to memory of 5468	5152	chrome.exe	127
PID 5152 wrote to memory of 5468	5152	chrome.exe	127
PID 5152 wrote to memory of 3592	5152	chrome.exe	128
PID 5152 wrote to memory of 6984	5152	chrome.exe	129
PID 6984 wrote to memory of 4876	6984	ratonfsdfsdClient.exe	130
PID 4876 wrote to memory of 7104	4876	cmd.exe	132
PID 4876 wrote to memory of 1480	4876	cmd.exe	133
PID 4876 wrote to memory of 2460	4876	cmd.exe	134
PID 2460 wrote to memory of 6180	2460	ratonfsdfsdClient.exe	135
PID 4876 wrote to memory of 4820	4876	cmd.exe	137
PID 2460 wrote to memory of 2228	2460	ratonfsdfsdClient.exe	139
PID 5208 wrote to memory of 1276	5208	ratonfsdfsdClient.exe	143
PID 5208 wrote to memory of 6920	5208	ratonfsdfsdClient.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\b8754abbbf7d68836ec7b52b02ab8bdf.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb8,0x134,0x7ff936a4c728,0x7ff936a4c734,0x7ff936a4c740
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,9065911132627578891,4355731226775056571,262144 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,14042433808311093401,11575723155140361511,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,7848967140747494241,9401011491400848190,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,14373767720649412493,2987082277995296120,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,13458777204185528899,4149743138592844070,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,483274787481958262,8427512555120323086,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,17065239972596268399,4786638231367972429,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,18398853770547353950,12848044014033793224,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:6316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,10968014695740602076,10114056379849810373,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,10593094693780300612,2824576703821960856,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:6968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5396,i,18283240235304362759,5306274148023027460,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5408,i,17618749648578005029,8477226446321577695,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5724,i,11128692370045106252,7125754619735895246,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,5533397629679969849,10047483556287802447,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5804,i,9648702714590810078,6102717668822962257,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5376,i,13470142248336369782,5577386330549116765,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5636,i,1995254549272963359,699158384388680393,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5600,i,18197792937074918164,282283777233749566,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,3037445708005263549,1268088360992310108,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:6780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6140,i,14928256639466569381,18350672890880819362,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,5994245334024665531,5403301605951194701,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4604,i,16911619121748977644,16619070233690694905,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5696,i,10027122383111432106,3601080283051894311,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:9
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,6005840730635850958,8332389774758122419,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,9495917754202957273,6530429105261784496,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,15778101251192867113,7578901827284043964,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5884,i,10094402174680109875,7121491156715604961,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6180,i,11294374850272788789,6368819701428389366,2097152 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,2198086085329815751,7809580081581756542,524288 --field-trial-handle=1920,i,1588281362378639801,11117909738982742770,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
  2⤵
  PID:3592
- C:\Users\Admin\Downloads\ratonfsdfsdClient.exe
  "C:\Users\Admin\Downloads\ratonfsdfsdClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_o1CXyJUtEKK5wC9oBzk3XqqtQxJLJt.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:7104
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1480
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6180
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ratonfsdfsdClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe\"" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3324

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "ratonfsdfsdClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonfsdfsdClient.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d836d77-7cf0-4f45-ba96-be49befbff31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d836d77-7cf0-4f45-ba96-be49befbff31.tmp
Size 11KB
SHA256 1de90e3023d4c152bd857f1ed5b91dd0e925238b0b5f8510a7fb8376d920e212
MD5 3e0282daeb62807260b3f3ab4e3d73a6
SHA1 4dee2cefab6ad2791187ba03e643d430c8b488e9
SHA512 58ef33200e257346d21dd5a3364d3904d6c016a6b6b700a2719b1a683f6f0aede172d0e9d2721689cfb453e62e9f47d5d6975694b17ea247ba843f556d5e13b4
SSDEEP 192:9R3KRIEv7FTvAPRp2c9CHsb+WNn0C0EslrMkwDSwVyIsnAUge:9R3KCg5T6Xfkw70hlrMLe
TLSH
T11E32C76EBA20697B9CCBD21AF9517B93E7F9202172D42E84E7FC892C15E75CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 24adeef68f0a45205bc63a4f97866e02162137ac25a4ba0a0e97adcf2f540909
MD5 d8121a8277018cd8093d9c02d1bd5ccf
SHA1 cf99ea14db0ba3dc861dbe755310edc8a6537174
SHA512 a44f966204f991416d77a5c95d47faa92250c95198f8fb03a9dcef639de0c1d5d005aa53019f92e640448053023eb1072e4dd128a8741a973bdb38099a651c83
TLSH
T14E2110D9A5EC1421C34402F054C9B1BF75360DC0B4173EA7808ACABC360078690DD180
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4d753f51812b724d9a6f3855459d905166db80a2a05ef0ef3a3df00d1998b087
MD5 8bc36635c2078ebbdc213fc561dbdda0
SHA1 9b16f99b4bb0b895f0efad8d58b3309bc4d6a1ca
SHA512 e72adb6382a2c2a44d813cb722efa6df18c72bc468710592f4da83669028f90990d6eaaf666257ece8f6ae8a50dac1053d767f5777ee0eedecb0d3f312ab62e9
TLSH
T126519EF7C3E4956D891592F4DB116E2FCD6D0A24431C3C66C9D4AE5B63E2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d25320ba7eb2e5d5a4babfcd41ccfeccd95ac03ec0737c64cfa3ebb81240e11f
MD5 7b04ae8de1161034ba2a1821100e7614
SHA1 65b940059e3640752af766b121683cac22b0ab57
SHA512 1c3dc7c79d23972f151e734ffbed29fe235de0d0f7e00ffe95cf2c9b0b77a1e0a1a0d67accc71e612d6d3d83ea98cdb025c4aacd10bf9953a10d02c5291abb8b
SSDEEP 192:9R3KRi1Ev7FTHAPRp2c9CHsb+WNnrHtpslrMkwDSwVyIsnAUge:9R3K+g5TCXfkwLt2lrMLe
TLSH
T1AD42C66EBA11697B9CCBC21AF9517B93E7F9202172D42E84E7FC892C15E75CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d956ea75853002a32558d017edff3d3eb9cb6ccfcb0a3dc2e72a679e23cb5c25
MD5 44e7185749f53ddc68ba0e3fd7de8ba9
SHA1 53e29ae2fe4c2d52ed740c9d732045e0202a7d6e
SHA512 c58efd16020600fb952bc51cbc5a847ad23c6206f451f2ea3684737436dc14e1cfa86744bd1bed42c2f5a8a199af35617542fb0b172b13230dfaa7843599cf8d
SSDEEP 192:9R38RilGEv7FTHAPRp2ala9CHsb+WNnrHeAO2aoslrMkwDStVyIsnAUgvU:9R38kGg5TCXKkwL42GlrM4vU
TLSH
T12B42D56EA910697B9CCBD21AF9517B93E7F9202272D02E84E7FC8D2C04E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9f308cbd8fb5ca55c8dde51b2ebf2ab14cbb73de4f4763590d3839f0a26a1aa4
MD5 2c6bb8ca0eacea7d88882f1a4f20f150
SHA1 9d94ec26282464e26fd78c66a10925d5d39d4b43
SHA512 2b566cc45765c021a25f25322cd5268ee4ba79d563a54398e22e423740a531637c8d5d5ba2cca4f1a3ef364855ceecc2a73518e8fcb2e7d214f69af65f116df9
SSDEEP 192:9R3KRilGEv7FTHAPRp2ala9CHsb+WNnrHeAO2aoslrMkwDStVyIsnAUgE:9R3KkGg5TCXKkwL42GlrM4E
TLSH
T14142C46EA911697BACCBD219F9117B97E7F9202276D02E84E7FC8D2C15E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 903bbd19db512ecfdebc05bcb84849e3cc7bc0ae6b78357d9a30b044306090d4
MD5 e207eaacab21596bcd935d5517d6d5d6
SHA1 af85b89bd42e00b7e08d123f2667be42a95a9ae1
SHA512 b9894d4ac3129166d7912232f492c1531681feafcb65e8017a21e9b8798e606bc33830e6e4ec8e089abb2239f14375c1bbd061407bf4a1e803c1a036ccdcb064
SSDEEP 192:9R38RilGEv7FTHh7PRpAala9CHsb+WNnrHeAO23HslrMkwDS5VyIsnAUgvU:9R38kGg5TBjXQkwL428lrMivU
TLSH
T10A42D56EA911697B9CC7D21AF9517B97E7F9202276E02E84E7FC8D2C05E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a11367d73ee6c793eb6f06de5a776728cc724907de1574904765df3888834d78
MD5 21fca10b016403e69bc77d518fef45ad
SHA1 57d77a4b7b261dd0528b5c93943824a2cfb1c8b5
SHA512 50cb843f87e8d173f131ec722044a36908ab8ce4aed5f612e663e1036e48a8573e87745963f1f79b8a2c1a80ba376829fbc0d8b9f9be9d2220b7b4b3278384cc
SSDEEP 384:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmXODdc+ErU3d9Hoh1X4GudkYw:BLbC7KxkXqKf/pUZNCgVLH2HfgsPsOZG
TLSH
T15E52F767648D9A3F4FC8DA4CDC126F4FACB5025762A84D2493FB5C1803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 837c61643953f266acc5b363e9e973b70bb9baaff055a6d8e9619c426fc1eb68
MD5 0ed4ad2bf7fa1e1a99ee0f9e89af2ba4
SHA1 8a2d30b91f9c486f9b7ba85c58f2b61771d08eb0
SHA512 7e3ef7a1ff7376c868d818dcc6df53d952b6365f99deaafc38b2e71a624ebd79a5acd35772917598264b004a1986704e840f60a783cf39faf9acd6839b730ec2
TLSH
T18AA0025456E04C11ED044671A0A12B9236954C543993471365E28694CA5B3C44181505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59798b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59798b.TMP
Size 48B
SHA256 bec3560664e3256173c35cfc2b443db13e0596f79485d2082de763706b41bc11
MD5 556fd5f8074385ed686c781db83b2b01
SHA1 f0e58506335017aed0c874e2ba424c80ccfcf37c
SHA512 daa72314aca5cfc481368e84225cf5c324f6017cbbd4037ba8d4cd9e6c5d3b0dd8cc7d2a4200b38961e5e4878cb9d9fc02359f5c9bbaffac064e92b3b0a854c1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6b688d1f03943b7dc1a0ceeb114b867e182425f76c9366555d1147a3c1a2869b
MD5 bced07606692780ce42e7dcc1bc7e2d6
SHA1 4478b33a56fca2696ee3a6163e20a40320cd15b2
SHA512 0f36380b6caccd8dd2ba86fce6ef8fce15394895dd61e534eaa0cd27a38b45b13eb6429ee1b8f848edfa729b082aa8c561292ef76fed2144501343d55ca492ff
SSDEEP 3072:mCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquha:mCZqyXOplXaHla
TLSH
T1ECD31232794EB8A5CCBFD5A6100EDFD4DE78D5B94394581CC64BFBC09797AE20A06C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 975b7d6fc1e48d553b039724bae87b045d8cf867a5ec09cf35e55deb03158733
MD5 ae5863d40f0179555fbc76fb743a96c4
SHA1 3d53cd1486ab5721b5f0505c1c3250a6f66bdffc
SHA512 12310daed76a4469d28d20cdaaa58497eb4fde35ed1b536c1f3fff912d78fc83cd21c6fa0b6aa63a4192a2211d07f3add9422556d7dd1332748dbb4d1341dbe3
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5VVDWB6xGyv1T52qbKv4a:MkC01N2c6AGDDUDzG1U52qbU
TLSH
T19CA10936582D9C7788B2C549B5522E43EEB87127F921EF94E6ED4A0C11B70FC1381557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a14b97cfe8add3af81da4d87cced567556c656c62ec9f144d155a977fc664d43
MD5 f931436036be6f8fea85a9177ed03e19
SHA1 0cbd792d4052c540d665fade9d91631b14e22c08
SHA512 ff6c785b311a1738915c0f9a06484316d1efa36ad702d4918dfdbce4c6b9cd91d4b2fceb38050c1b2342e315c5e32069f11e7ccb4dd692fff1fa87b4c7b272c3
SSDEEP 3072:LCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquha:LCZqyXOplXaHla
TLSH
T1B8D31232794EB8A5CCBFD5A6100EDFD4DE78D5B94394581CC64BFBC09797AE20A06C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 6de265894393604974a2a5d81358b61b0b175496c234cc7840bceae5ed326aa3
MD5 ec9626762f4bb265accfed9309917779
SHA1 e735937b951a3e64697df12e341e49b86fdde8be
SHA512 8fba4625eafd09f86ceeeb410e9cd14fd48f097644751edf6b358c8067cdd907a5a8bab622d9cc8f75b487e3b0521527e0dafc7bdfd25deea5b38d1e06ba8677
SSDEEP 3072:MmCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquha:MmCZqyXOplXaHla
TLSH
T168D31231780EF495CCBFD655210A9F94DEB8E5BB8258690CCA4EFFC093979E50A1B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\stuff.dll
Size 11KB
SHA256 db4f07306bbddcc664051ee53db6f37f343f01bab6da7276cf1b600adcdfdf72
MD5 eb03b793d6b1097db7140fb35b180d1a
SHA1 a0217992399a54f32eb7b2bbfdfc9386bbf9bab9
SHA512 0a720886062f2edd6b21c3127c1f7c5c13f343072f80abb20ea25e5862c8e1d69a8de972b889f17da68ef692458ce1c46be38da97bc88255e6614414e9519b26
SSDEEP 192:MMHv3q/MgUd1q1BKX80YzCjD/WxM078iZW6LvEXzKSf5V0ux/qM8Z:Mwv51q1ymQoM078eW6AXzKsVrxtG
TLSH
T1E232181D5704D22FDABD0B3CB8A297652732F695A513EB8F2CC8A4BD695B3A406013E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_p33iuvaa.x2r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p33iuvaa.x2r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5152_1158835232\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_o1CXyJUtEKK5wC9oBzk3XqqtQxJLJt.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_o1CXyJUtEKK5wC9oBzk3XqqtQxJLJt.bat
Size 543B
SHA256 4a89562eee16ae4fe79b3b6126144e8470da1eb7143931437b675d4cca198951
MD5 36a698bf6963c507da0ff43dc02fbea2
SHA1 4d70bc94dd8c912f9192844fae09208044184b5e
SHA512 2d610c7d78b3bd103d1dfd6ca4abd271ea865c39ac6e19406b1813e75cc72a23668b5f02cae68a53f2ec907855732ecb14c9c48a3c751744b99992ce8a85f9d5
TLSH
T153F05056338DCB1D5011A5368E7E32CCE0ED44E3FE4570423A18CC4A9BA243B96D7AD3
MD5 SHA1 SHA512 TLSH

Submit Download

ratonfsdfsdClient.exe

Path C:\Users\Admin\Downloads\ratonfsdfsdClient.exe
Size 1.3MB
SHA256 62db0c35b8cce439d6deac5aa93460c5cb481c82d6fdb08c2909c035f69c4794
MD5 21348de98700da44bbc74a9f2a7914dd
SHA1 90ae7e562bdea76e6828f39e3e93d1aff257c69c
SHA512 c94ffb774330c11ccc96a806b5d0b2e968ee226ddb703726a901ef12ccf8cc68ea2c81b6a0074b6f072e7699889974a3d51c482bcea580162d9928b2b9f82c37
SSDEEP 24576:c3T9UXSrtv94TP0lRRkxYcxMNnyFoBOkA6s4u1fZm:ydsclR0BxMsaRw4u1fZm
TLSH
T1B355DF5C33F98A18F2BF4BF8AA70545A0771FD579852D7AC18E664DE04B2F44EA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-713-0x00000178BBA10000-0x00000178BBAC2000-memory.dmp

Download

memory/2460-697-0x00000290255B0000-0x00000290255BA000-memory.dmp

Download

memory/2460-716-0x0000029025AB0000-0x0000029025ACA000-memory.dmp

Download

memory/2460-715-0x0000029025AD0000-0x0000029025B02000-memory.dmp

Download

memory/2460-698-0x0000029025680000-0x0000029025734000-memory.dmp

Download

memory/3628-1-0x00000246E0750000-0x00000246E0B66000-memory.dmp

Download

memory/5208-730-0x0000020959590000-0x00000209595D2000-memory.dmp

Download

memory/6180-686-0x0000027EFA4F0000-0x0000027EFA50E000-memory.dmp

Download

memory/6180-683-0x0000027EFA870000-0x0000027EFA972000-memory.dmp

Download

memory/6180-690-0x0000027EFA7A0000-0x0000027EFA7C0000-memory.dmp

Download

memory/6180-689-0x0000027EFA7D0000-0x0000027EFA81C000-memory.dmp

Download

memory/6180-688-0x0000027EFA510000-0x0000027EFA51A000-memory.dmp

Download

memory/6180-687-0x0000027EFA6C0000-0x0000027EFA772000-memory.dmp

Download

memory/6180-678-0x0000027EFA530000-0x0000027EFA5BA000-memory.dmp

Download

memory/6180-681-0x0000027EFA050000-0x0000027EFA072000-memory.dmp

Download

memory/6180-682-0x0000027EFA040000-0x0000027EFA050000-memory.dmp

Download

memory/6984-638-0x000001FBCBF10000-0x000001FBCBF1A000-memory.dmp

Download

memory/6984-594-0x000001FBB1610000-0x000001FBB1760000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads