njrat | dfa4cb57e1b03f86c17f3b6c3bad3a947fa109bc318eeda3f8186e5d2a5b7dfe

Analysis

max time kernel
305s
max time network
312s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
njRAT 0.7D Horror Edition.exe
Size 86KB
Sample260920-qqdkmsxfrc
SHA256 dfa4cb57e1b03f86c17f3b6c3bad3a947fa109bc318eeda3f8186e5d2a5b7dfe
MD5 69222ca198bbd0c1ac6caa90d7b68454
SHA1 3c5661c971cb8644ae70c12c908e577ab050c0ef
SHA512 51b932e7de92b8d1c0b0624fd69574c01082bf991e84d61198d75a3fb1d3eaa0b8a1bf0518cd91d08ae45741c0d8aafd7129a0f02425b91633f6bc2ca132154e
SSDEEP 1536:e5psDnXN+5Sk9lDfwsNMDjXExI3pmSmKD:0sDnU4OlDfwsNMDjXExI3pm4D
TLSH
T16E837201BF9E8D05E17D7AFC68A586610734ED13A521C61B08F5B99BEAF62C7CC00ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware bootkit defense_evasion discovery execution njrat persistence spyware trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1604	5a8b3339165d468096b86298517c0520.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5a8b3339165d468096b86298517c0520.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dwm.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\dllhost.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\shell32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\csrss.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\ntdll.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\services.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\lsass.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\spoolsv.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\user32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\smss.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\wininit.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\kernel32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\gdi32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\advapi32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\ole32.dll	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\winlogon.exe	5a8b3339165d468096b86298517c0520.exe
File opened for modification	C:\Windows\System32\svchost.exe	5a8b3339165d468096b86298517c0520.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe
4084	cmd.exe
1168	cmd.exe
4556	cmd.exe
2416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	njRAT 0.7D Horror Edition.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4480	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4292	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343845838326753"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5164	reg.exe
5420	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe
5864	njRAT 0.7D Horror Edition.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5864	njRAT 0.7D Horror Edition.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: 33	5864	njRAT 0.7D Horror Edition.exe
Token: SeIncBasePriorityPrivilege	5864	njRAT 0.7D Horror Edition.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
4480	AcroRd32.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4492	OpenWith.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 3364	5864	njRAT 0.7D Horror Edition.exe	89
PID 5012 wrote to memory of 5812	5012	chrome.exe	94
PID 5012 wrote to memory of 800	5012	chrome.exe	95
PID 5012 wrote to memory of 800	5012	chrome.exe	95
PID 5012 wrote to memory of 4292	5012	chrome.exe	96
PID 5012 wrote to memory of 5852	5012	chrome.exe	97
PID 5012 wrote to memory of 5852	5012	chrome.exe	97
PID 5012 wrote to memory of 1724	5012	chrome.exe	99
PID 5012 wrote to memory of 1724	5012	chrome.exe	99
PID 5012 wrote to memory of 2544	5012	chrome.exe	100
PID 5012 wrote to memory of 2544	5012	chrome.exe	100
PID 5012 wrote to memory of 2104	5012	chrome.exe	101
PID 5012 wrote to memory of 2104	5012	chrome.exe	101
PID 5012 wrote to memory of 3312	5012	chrome.exe	102
PID 5012 wrote to memory of 3312	5012	chrome.exe	102
PID 5012 wrote to memory of 2132	5012	chrome.exe	103
PID 5012 wrote to memory of 4700	5012	chrome.exe	104
PID 5012 wrote to memory of 4700	5012	chrome.exe	104
PID 5012 wrote to memory of 548	5012	chrome.exe	105
PID 5012 wrote to memory of 548	5012	chrome.exe	105
PID 5012 wrote to memory of 3720	5012	chrome.exe	108
PID 5012 wrote to memory of 3720	5012	chrome.exe	108
PID 5012 wrote to memory of 2672	5012	chrome.exe	109
PID 5012 wrote to memory of 2672	5012	chrome.exe	109
PID 5012 wrote to memory of 3492	5012	chrome.exe	110
PID 5012 wrote to memory of 3492	5012	chrome.exe	110
PID 5012 wrote to memory of 1308	5012	chrome.exe	111
PID 5012 wrote to memory of 1308	5012	chrome.exe	111
PID 5012 wrote to memory of 6068	5012	chrome.exe	112
PID 5012 wrote to memory of 5876	5012	chrome.exe	113
PID 5012 wrote to memory of 6068	5012	chrome.exe	112
PID 5012 wrote to memory of 5876	5012	chrome.exe	113
PID 5012 wrote to memory of 3448	5012	chrome.exe	114
PID 5012 wrote to memory of 3448	5012	chrome.exe	114
PID 5012 wrote to memory of 1260	5012	chrome.exe	115
PID 5012 wrote to memory of 1260	5012	chrome.exe	115
PID 5012 wrote to memory of 3880	5012	chrome.exe	116
PID 5012 wrote to memory of 3880	5012	chrome.exe	116
PID 5012 wrote to memory of 5608	5012	chrome.exe	117
PID 5012 wrote to memory of 5608	5012	chrome.exe	117
PID 5012 wrote to memory of 2628	5012	chrome.exe	118
PID 5012 wrote to memory of 4384	5012	chrome.exe	119
PID 5012 wrote to memory of 2628	5012	chrome.exe	118
PID 5012 wrote to memory of 4384	5012	chrome.exe	119
PID 5012 wrote to memory of 4448	5012	chrome.exe	120
PID 5012 wrote to memory of 1236	5012	chrome.exe	121
PID 5012 wrote to memory of 3280	5012	chrome.exe	122
PID 4492 wrote to memory of 4480	4492	OpenWith.exe	127
PID 4480 wrote to memory of 4848	4480	AcroRd32.exe	128
PID 4848 wrote to memory of 2708	4848	RdrCEF.exe	129
PID 4848 wrote to memory of 5076	4848	RdrCEF.exe	130
PID 4848 wrote to memory of 5076	4848	RdrCEF.exe	130
PID 4848 wrote to memory of 4032	4848	RdrCEF.exe	133
PID 4848 wrote to memory of 4588	4848	RdrCEF.exe	135
PID 4848 wrote to memory of 5288	4848	RdrCEF.exe	137
PID 4848 wrote to memory of 5160	4848	RdrCEF.exe	139
PID 4848 wrote to memory of 5160	4848	RdrCEF.exe	139
PID 5864 wrote to memory of 1604	5864	njRAT 0.7D Horror Edition.exe	141
PID 1604 wrote to memory of 1168	1604	5a8b3339165d468096b86298517c0520.exe	143
PID 1604 wrote to memory of 4556	1604	5a8b3339165d468096b86298517c0520.exe	145
PID 1604 wrote to memory of 2416	1604	5a8b3339165d468096b86298517c0520.exe	147
PID 1604 wrote to memory of 3820	1604	5a8b3339165d468096b86298517c0520.exe	149
PID 1168 wrote to memory of 5548	1168	cmd.exe	151
PID 1604 wrote to memory of 4084	1604	5a8b3339165d468096b86298517c0520.exe	152

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\njRAT 0.7D Horror Edition.exe
"C:\Users\Admin\AppData\Local\Temp\njRAT 0.7D Horror Edition.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\SysWOW64\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Temp\njRAT 0.7D Horror Edition.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\5a8b3339165d468096b86298517c0520.exe
  "C:\Users\Admin\AppData\Local\Temp\5a8b3339165d468096b86298517c0520.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5548
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCU /f
    3⤵
    - Executes a command shell one-liner
    PID:4556
  - - C:\Windows\system32\reg.exe
      reg delete HKCU /f
      4⤵
      Modifies registry key
      PID:5420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKLM /f
    3⤵
    - Executes a command shell one-liner
    PID:2416
  - - C:\Windows\system32\reg.exe
      reg delete HKLM /f
      4⤵
      Modifies registry key
      PID:5164
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKU /f
    3⤵
    - Executes a command shell one-liner
    PID:3820
  - - C:\Windows\system32\reg.exe
      reg delete HKU /f
      4⤵
      PID:2680
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCC /f
    3⤵
    - Executes a command shell one-liner
    PID:4084
  - - C:\Windows\system32\reg.exe
      reg delete HKCC /f
      4⤵
      PID:1680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8769ac728,0x7ff8769ac734,0x7ff8769ac740
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,11888366866314723306,15559704709277171454,262144 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,6428206071685324344,8391345409409915259,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,4440455053362316630,14474385479558106497,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3308,i,11382680705631667761,1222115838525237057,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3368,i,13229048566477313389,6827359960142838589,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,4607434812904434327,5794198173386395455,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,833598347497369323,8876818232306315873,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,14509270281765349315,914146484005540132,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,1918587988650574748,3551656474727076777,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,5095610097005719452,14295676849044931647,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5444,i,17943505270288446911,13876220163628474919,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5992,i,2205983274226749877,16203097096474894065,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5736,i,5706043844323244717,2149469554930856721,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6264,i,11266814958366664593,403346218844198755,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5452,i,10256936038410335345,2978581936020367728,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6272,i,14105355536059059069,16347923599950363210,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5564,i,17259023407474114802,7501009430997190410,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,10406537971551691993,17533241790753815513,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,7190327140770116441,2677458269725979699,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,15930752597925484071,11507998434021364398,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4716,i,2945980221301447506,11981387621728070525,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4700,i,9434434497910033063,4724719646239929724,2097152 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:9
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,4127734824182250706,7039353074671126759,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3608,i,14498342065377588449,8283843029680286738,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,12743668150724103647,7447852574939574150,524288 --field-trial-handle=1864,i,17840565487063103471,7061386444379187735,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\PingUnblock\PingUnblock"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A1E36F9D4B9150383E30CE4E19DEEE6 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A387A3A08EC02DA8A63A34F2D4C61515 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A387A3A08EC02DA8A63A34F2D4C61515 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21B7D19DF91CBCDCDE2A69F2033BD945 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12F7A97CDD641EF194536D25A6B265E8 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=89191F3D00827F9F1CFADB726163085E --mojo-platform-channel-handle=1840 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=15788CF00C66B28EE073D7F407777C8E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=15788CF00C66B28EE073D7F407777C8E --renderer-client-id=8 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
PID:1120

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:260
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1704

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3544

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 7598af7ba644616f9c894979111e22d002205f0af859151ae2eed6979d00e5ee
MD5 2120f6cd852e71453dbe7eb2b8f8dc16
SHA1 d11424afffeec8be8c13ecb4297b87823931a196
SHA512 eb81ba4988286939e5cec05b8b9cf5b1d9dd619626ea3dd7c4410327a77a80d59eb46c642999f91d398a60b6a6f89f5b0a8949503be16ca2910d8f1316801a9b
SSDEEP 384:yeSdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:J+eUZsLQCZsL3hUS4
TLSH
T11553CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c6b438003da7313c397000bf729d77033273ad5010eef3874750b43c957498a1
MD5 0581f0851bd4cbf2e322d7fbc06b135f
SHA1 225eb30943384c7b84ab463ca3a5053f1ad459b3
SHA512 4c6f09c45fb94cfbf60929e5fd70790382fbc758d2297e4f73c98820cd9d9b8d7d5d0971300c2038371c5c60727afe5ba26ab4f17de08c0de79a85c2e1a8aa55
TLSH
T191C092D80D6E3614E33872B07AA515857158193E9523567AF1F8E0D8D8AB3AD46C1E42
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f349584997d5d72ba2ad4756c1a376fc48d86a7436872b2f1077302db42e0c99
MD5 b10c9c133ea9f695ef70f4cbfe65f516
SHA1 0599c3d97cef65e332e032f7d9ad11be2084bf4a
SHA512 1482a22be2f8e5d060aa93400ab0920195a3ef1a645e00c2ae8c13be28262a864a2c5d7f6e8175733723bc39ccc646d0605176ed54fca6831a56145445c55cae
TLSH
T1C0818BB7C3D8D67D881156F4AB256F1FCD290A24522C3C67C8D8AE5B53E28B2D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 97c2522125c04b93bf2eb97c2787b393b7c1b3a74bab0b9dd508d721cf4cd686
MD5 646736f717a6e0b90198738b0620303a
SHA1 2d0d1c14a9cb19a598f0cb042597cc995b15405a
SHA512 06a6f9652bba293d10c8402fbad0df55e63550b9025f1a98dc675690c8059fceddbea6fd0dd19794cdb9e05085fa9d2870e3312b733a4a45bb196529dd057c6d
TLSH
T1E6F0C9F7E2BBB86B10BA42B61D00B8052AB1A83002026CE4CF9A82ACA0D00E31F16403
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 830174a6e80a36b25f39bdd9aaccaa0cafcbf2cc2bce5ab18aa742bd2ffb9145
MD5 702b5b8275593668de8a2d5d1c346d21
SHA1 0919f4e376b70e008ab63dff6bcd96365d8b76b5
SHA512 3b86dc7f1911c0729d87be67688c784435fd1c42bc57f7d991a8670397ac7b1e82b2461bcb873a8d81db92883c18b8abc2d91591812c72dd6d4ca1475f7a1436
SSDEEP 192:ER6PAKchv7sAPRp2P9bHsb+WNnxn0LL2qq3WkwxCTVyIsnAUge:ER6PUxJX4Bw90P2/mRC1e
TLSH
T1BD32A42EEE14B53F9CDAC22AFA657B97D6F5102171842E84E6F88A3C20E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15f976f58df8ad9a6eabfd095637c4cc9ed6d107124d10e65867b9d98c1bb5ae
MD5 7388a9a72b606f2c41475468bc41c3e8
SHA1 bebaaa16e436fcc0cf808b77dde680e2ce09b454
SHA512 cf5030d58a2e27a19ec8818d51fa13608f84e34a7f0355211e033d89d7ffbfcdaeaea45397956118f8c92b57a0d99468625b47e1534183ef51b2cfcaba4be76f
SSDEEP 192:ER6PAKcUv7sAPRp28o49bHsb+WNnrprZ32qQL2qq3Wkw1CTVyIsnAUgE:ER6PUQJXLBwNh2qq2/mVC1E
TLSH
T10E42A42EED10793BADCAC22AFA657B9BD6F5102171841E84E6F88A3C20E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3012cd4533cc53a9c0ec5eb7f96eb621970915605007a8a02831e1fe88098c4d
MD5 e2eb4c729faa52498f95793c0a87bc70
SHA1 8bcd82f87e690cfe5f0303d07c3f625d82791e24
SHA512 09baf91df852068ae23ccf91fb53c186978e2aaad7ed8ca7b1ba931bb4b3bd10edb894adf0a288800faddf796935778ca87543a005cf9e89d1f1484f802691a6
SSDEEP 192:ER6PAKcyv7snPRpj8o49bHsb+WN/j/UrprLRYjvL2qq3WkwJCcePyIsnAUgE:ER6PUeEXGBwi5YjD2/mpCPE
TLSH
T1A742952EFD10793BACDAC229FA657B9AD6F5202171941E84E6FC8A3C20F75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0cacccac84f48c03a54e0a71ab990a52bdd239cd967ec0f5fbdf64df66ec696a
MD5 0ea3713e1579df90f32d9d3c397c5715
SHA1 ff5acdae1e980512ecb843fe4b50a50ecbb54bda
SHA512 8498e60234916600a40216772a10f36dcbb2d2123db67fb9465a939afc761a0085a0f36f009c29814c13beb4e4184a0e1e55e48f8fae01d1f27c6a3715f42ef0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d8f56cc751040a25725561dd628465e8d3086c97aa062622f51e71ec6b169938
MD5 1db779217643fec3161aa1e9fe5fae32
SHA1 c3db844247f1b202fc4fe2c4123eed98a831623c
SHA512 a8b2b42ea398f6cd391c9ce72ae71f51f11fe4b242f8729e986a76926536e1a8d2f0cfb1b32aeb712d02dd3de269190cbcc056b2ab375ac6d51ecbc7edff3663
TLSH
T1CBA00210C3E55452FD617371B06105513695585C1F529343B4A504648A5B6DD4245D50
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5bfd48.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5bfd48.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 135KB
SHA256 70c9928bdc5ffc77324e2195524a57afe5478760657dd0f6faf78ed33b2fb30c
MD5 3cfc0d8bb2f809a4bc7df30425ad55f6
SHA1 fbab33a9b3f64a0269d3528861f8b56f5ad7f716
SHA512 a00a2010f38928787736e0c9f62163dff1d13ee8cc85d84708cc113e5a03f90fa6f18f487ce281b2b9913b5f972c42db6ea60a36a01e457a0e7c1d9302f22835
SSDEEP 3072:AD7MZaNxsMVFTBSq/8rL12M03p8B5lL5xZ0ZaFdGCKbf/sxbqEb:AYaNxrFA7YMi05l50uluk4+
TLSH
T1AAD31292FDA2AD5E44E9C16963FFC4038C13C992E2DF4ED55CF6254608A6E6E0723C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 171KB
SHA256 43429e37560a06b259116e8d14f96e5aece2fc301a6aad12df150e9b9daed08a
MD5 4d45dcc2aae8af0319bcf1441047ce44
SHA1 1845010bf741bfbb07eedc6f1dcc0d04c1539ebe
SHA512 91321ac7f85061485f0e5bf1c2175a43ee50b32cd6b0596fe676f4a3b420eb136972a9c90c4e9ca504c23a15dd83bbc1e742041eeaad2b23ca290ec3d9376eca
SSDEEP 3072:FQqQYqB/o362+o6D7MZaNxsMVFTBSq/8rL12M03p8B5lL5xZ0ZaFdGCKbf/sxbq+:F4/o76YaNxrFA7YMi05l50uluk4+
TLSH
T1FA0412B2BDA79EAD84A5885563FB9543CC02C883D5CF8ECDACF838550455E6E1B23C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e1d54f082f3ae06a2388c1450888bd799b8ae499321cbe1798822b24c07435e6
MD5 4f1970e0bc854d3782e634060b7a9c5e
SHA1 f88ca218c12484b63f187cb7b38f5d9c4b3ffe62
SHA512 c3ed4e4462588aa53970bbc4e1eb3075ec9b272407ad4e4f30b26e850cfe6544e4f0d4b391c70a7c8354a06676a9a012e203da671f65d32c09dce9df83885c8d
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok598DtwB6vGyvQH4jYr0bblDv4a:qC0xJPz8/CkqDUDASfr4jYr0bb1
TLSH
T1E9A1F931B8699DB794B6D585B2422A03CF64B197E621AFC0B5DD1E1C14F70E81792A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\O5T26W67\microsoftwindows.client[1].xml
Size 97B
SHA256 4f1db8808154491680958b914c842a3fc2ec54d9028247f59ecf41b78ba4b2a7
MD5 a12b939a25347c5745e0f192ae6f8d71
SHA1 d48bb30b25598b06a8965243f60079393810237d
SHA512 a89c4461879ebc95ef534ba9526a8f6a9d7dcf91102242c6b175cff2464a354a553292b3c31daea56395f8295a4b16d48615208f0a442c42c83ce4f63af33ed5
TLSH
T137B0122235454C583B4586FA2E4E11E431EE0082A306747438E4BC46B585D27D415CE0
MD5 SHA1 SHA512 TLSH

Submit Download

5a8b3339165d468096b86298517c0520.exe

Path C:\Users\Admin\AppData\Local\Temp\5a8b3339165d468096b86298517c0520.exe
Size 11KB
SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
MD5 5870c114ead5c7fe9c360e763f315824
SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
TLSH
T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_779526211\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Contacts\desktop.ini
Size 412B
SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
MD5 449f2e76e519890a212814d96ce67d64
SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
TLSH
T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Documents\desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
MD5 3b960da228cc489b622697659c885d64
SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
TLSH
T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Music\desktop.ini
Size 504B
SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
MD5 06e8f7e6ddd666dbd323f7d9210f91ae
SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
TLSH
T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Pictures\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Saved Games\desktop.ini
Size 282B
SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
MD5 b441cf59b5a64f74ac3bed45be9fadfc
SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
TLSH
T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Searches\desktop.ini
Size 524B
SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
MD5 089d48a11bff0df720f1079f5dc58a83
SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
TLSH
T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\desktop.ini
Size 504B
SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
MD5 50a956778107a4272aae83c86ece77cb
SHA1 10bce7ea45077c0baab055e0602eef787dba735e
SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
TLSH
T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\AccountPictures\desktop.ini
Size 196B
SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
MD5 2971c89bfb3b06e591694b9a78e467b9
SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
TLSH
T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
Size 174B
SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
MD5 8f91870452433a5555c9d453f714698c
SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
TLSH
T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
Size 174B
SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
MD5 e0fd7e6b4853592ac9ac73df9d83783f
SHA1 2834e77dfa1269ddad948b87d88887e84179594a
SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
TLSH
T17FC0801892E9311041718D12FC749001DBB1B8216C17CF5E07C0518B04A0605E631747
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_48.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
MD5 1d41d647faf0c99af43c89459acc8e9f
SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
TLSH
T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
MD5 bbe70a516ccc8b65668330f36fc864a1
SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
TLSH
T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
Size 196B
SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
MD5 08e1b7b2fd872cdcc42af67707dc2a98
SHA1 512644da4aa90a3919bc29f65e878e9870874f67
SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
TLSH
T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Size 302B
SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
MD5 99d72adf4e683fa1e6f1a435ff5be9b3
SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
TLSH
T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
Size 432B
SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
MD5 f107d0270e21a2fe91099fdc15918d44
SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
TLSH
T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 174B
SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
MD5 548b310fbc7a26d0b9da3a9f2d604a0c
SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
TLSH
T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
Size 418B
SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
MD5 93c8b5c191bdcf8aca86d7463d77e6c8
SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
TLSH
T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
Size 298B
SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
MD5 819c27ae07898f1a5efda4e146dbb174
SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
TLSH
T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
TLSH
T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
Size 520B
SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
MD5 af5909700768a888173cbd32998cf3da
SHA1 194ed60ed8923749078816fc2c69614d975ba325
SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
TLSH
T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
Size 520B
SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
MD5 7a985a80859ee46e35031543cf0d142f
SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
TLSH
T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
Size 520B
SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
MD5 a882cf89da04eb72950e65080a5cf857
SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
TLSH
T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

RGI6E9B.tmp

Path C:\Windows\Temp\RGI6E9B.tmp
Size 24KB
SHA256 04a0fbd0b5c3e4f7e3558a3871fe3f3cce5013a330941c3e72b4cdb19c81f2ad
MD5 033649d7b623b2f8cd29854ccb6d6a4b
SHA1 9772f7b7b11625fc3dea7598cdf5b6d0fc511ae6
SHA512 90df8c97c8d8062970d76af2235c3ab78208c95c332bbc04e72e2782cb926ab12dbb1098914f453eb7b095ee7dc50f80d4cb96c5931a51a25efb5d91a3c50989
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
TLSH
T1CAB2BF295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-814-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

Download

memory/3308-1271-0x000001C301A10000-0x000001C301A30000-memory.dmp

Download

memory/3308-1298-0x000001C301DD0000-0x000001C301DF0000-memory.dmp

Download

memory/3308-1312-0x000001C3146D0000-0x000001C3146F0000-memory.dmp

Download

memory/3308-1263-0x000001C300210000-0x000001C300310000-memory.dmp

Download

memory/3308-1272-0x000001C301E10000-0x000001C301F10000-memory.dmp

Download

memory/3568-1164-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/5864-3-0x0000000075202000-0x0000000075204000-memory.dmp

Download

memory/5864-136-0x0000000075200000-0x0000000075821000-memory.dmp

Download

memory/5864-1-0x0000000075202000-0x0000000075204000-memory.dmp

Download

memory/5864-5-0x0000000075200000-0x0000000075821000-memory.dmp

Download

memory/5864-4-0x0000000075200000-0x0000000075821000-memory.dmp

Download

memory/5864-2-0x00000000011A0000-0x00000000011B0000-memory.dmp

Download

memory/5864-0-0x00000000011A0000-0x00000000011B0000-memory.dmp

Download

memory/5864-201-0x0000000075200000-0x0000000075821000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads