njrat | hxxps://www[.]mediafire[.]com/file/fg4adg0g068zx17/VIRUS_shadow[.]rar/file

Analysis

user interaction
yes
max time kernel
85s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/fg4adg0g068zx17/VIRUS_shadow.rar/file
Sample261003-ry4bpssvbz

Score

10^/10

bootkit victim defense_evasion discovery njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

28.tcp.cpolar.top:10588

Mutex

0142361c52dce97ca26729e3ae908113

Attributes

reg_key
0142361c52dce97ca26729e3ae908113
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	MatrixMBR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	PEEKABOO.COM
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	MBR2.exe

Executes dropped EXE 9 IoCs

pid	Process
116	Payload.exe
1880	Payload.exe
3464	PEEKABOO.COM
4528	MBR2.exe
1748	TROLL5.exe
4712	TROLL2.exe
3252	MatrixMBR.exe
5056	GDI.exe
1424	MBR.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0142361c52dce97ca26729e3ae908113 = "\"C:\\Users\\Admin\\Desktop\\VIRUS shadow\\Virus 63h\\Payload.exe\" .."	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0142361c52dce97ca26729e3ae908113 = "\"C:\\Users\\Admin\\Desktop\\VIRUS shadow\\Virus 63h\\Payload.exe\" .."	Payload.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\MatrixMBR.exe	MBR2.exe
File created	C:\Windows\System32\MatrixMBR.exe	MBR2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{1C704C4C-A22D-4FA2-BE8E-B97A082498FA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	Payload.exe
116	Payload.exe
116	Payload.exe
116	Payload.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	764	7zG.exe
Token: 35	764	7zG.exe
Token: SeSecurityPrivilege	764	7zG.exe
Token: SeSecurityPrivilege	764	7zG.exe
Token: SeDebugPrivilege	116	Payload.exe
Token: 33	116	Payload.exe
Token: SeIncBasePriorityPrivilege	116	Payload.exe
Token: 33	116	Payload.exe
Token: SeIncBasePriorityPrivilege	116	Payload.exe
Token: 33	116	Payload.exe
Token: SeIncBasePriorityPrivilege	116	Payload.exe
Token: SeShutdownPrivilege	1424	MBR.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
764	7zG.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2316	3796	msedge.exe	87
PID 3796 wrote to memory of 4164	3796	msedge.exe	88
PID 3796 wrote to memory of 4264	3796	msedge.exe	89
PID 3796 wrote to memory of 4264	3796	msedge.exe	89
PID 3796 wrote to memory of 4264	3796	msedge.exe	89
PID 3796 wrote to memory of 1348	3796	msedge.exe	90
PID 3796 wrote to memory of 1348	3796	msedge.exe	90
PID 3796 wrote to memory of 3040	3796	msedge.exe	92
PID 3796 wrote to memory of 3040	3796	msedge.exe	92
PID 3796 wrote to memory of 3040	3796	msedge.exe	92
PID 3796 wrote to memory of 1464	3796	msedge.exe	93
PID 3796 wrote to memory of 1464	3796	msedge.exe	93
PID 3796 wrote to memory of 1464	3796	msedge.exe	93
PID 3796 wrote to memory of 1164	3796	msedge.exe	94
PID 3796 wrote to memory of 1628	3796	msedge.exe	95
PID 3796 wrote to memory of 1164	3796	msedge.exe	94
PID 3796 wrote to memory of 1164	3796	msedge.exe	94
PID 3796 wrote to memory of 1628	3796	msedge.exe	95
PID 3796 wrote to memory of 1628	3796	msedge.exe	95
PID 3796 wrote to memory of 2044	3796	msedge.exe	101
PID 3796 wrote to memory of 2752	3796	msedge.exe	100
PID 3796 wrote to memory of 2044	3796	msedge.exe	101
PID 3796 wrote to memory of 2752	3796	msedge.exe	100
PID 3796 wrote to memory of 4472	3796	msedge.exe	102
PID 3796 wrote to memory of 4472	3796	msedge.exe	102
PID 3796 wrote to memory of 4472	3796	msedge.exe	102
PID 3796 wrote to memory of 4032	3796	msedge.exe	104
PID 3796 wrote to memory of 2696	3796	msedge.exe	112
PID 3796 wrote to memory of 2672	3796	msedge.exe	113
PID 3796 wrote to memory of 2696	3796	msedge.exe	112
PID 3796 wrote to memory of 2672	3796	msedge.exe	113
PID 3796 wrote to memory of 2672	3796	msedge.exe	113
PID 3796 wrote to memory of 5016	3796	msedge.exe	114
PID 3796 wrote to memory of 4392	3796	msedge.exe	117
PID 3796 wrote to memory of 4392	3796	msedge.exe	117
PID 3796 wrote to memory of 4392	3796	msedge.exe	117
PID 3464 wrote to memory of 4528	3464	PEEKABOO.COM	136
PID 3464 wrote to memory of 1748	3464	PEEKABOO.COM	137
PID 3464 wrote to memory of 4712	3464	PEEKABOO.COM	138
PID 4528 wrote to memory of 3252	4528	MBR2.exe	142
PID 3252 wrote to memory of 5056	3252	MatrixMBR.exe	144
PID 3252 wrote to memory of 1424	3252	MatrixMBR.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/fg4adg0g068zx17/VIRUS_shadow.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe280dc188,0x7ffe280dc194,0x7ffe280dc1a0
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,3791513345672200446,11409285263841452297,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,5367454540695651826,1258031263107101663,262144 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,9457563883201034122,15720732590146404292,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7371459201821120354,13897619276623087924,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5100797841859678020,11002245307659322944,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11656307813278229561,17832466948248821251,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,10087897323210101716,10456781243865216840,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,8155039414801832111,5267458906261162811,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,444126642064039697,2933716466897646109,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5272,i,16996253074991230381,9820289007265915063,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12355153798183105724,12900076502186376214,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12355153798183105724,12900076502186376214,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,7674258920229223839,8473294522019483043,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4376,i,777357877971084983,3885324359274929573,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4819153177530704768,17776033543566973704,524288 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4348,i,13950857227084926333,7149538421326796462,2097152 --field-trial-handle=2336,i,8444320171223355605,17213915639245253915,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\VIRUS shadow\" -ad -an -ai#7zMap19990:82:7zEvent26051
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3932

C:\Users\Admin\Desktop\VIRUS shadow\Virus 63h\Payload.exe
"C:\Users\Admin\Desktop\VIRUS shadow\Virus 63h\Payload.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Users\Admin\Desktop\VIRUS shadow\Virus 63h\Payload.exe
"C:\Users\Admin\Desktop\VIRUS shadow\Virus 63h\Payload.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880

C:\Users\Admin\Desktop\VIRUS shadow\PEEKABOO.COM
"C:\Users\Admin\Desktop\VIRUS shadow\PEEKABOO.COM"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\Desktop\VIRUS shadow\MBR2.exe
  "C:\Users\Admin\Desktop\VIRUS shadow\MBR2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\System32\MatrixMBR.exe
    "C:\Windows\System32\MatrixMBR.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
      "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
      "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- C:\Users\Admin\Desktop\VIRUS shadow\TROLL5.exe
  "C:\Users\Admin\Desktop\VIRUS shadow\TROLL5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Users\Admin\Desktop\VIRUS shadow\TROLL2.exe
  "C:\Users\Admin\Desktop\VIRUS shadow\TROLL2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x414
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ae7fc0e-7df7-487b-9b19-9d44d916bb9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ae7fc0e-7df7-487b-9b19-9d44d916bb9a.tmp
Size 22KB
SHA256 c0e1c1e84e6e80c0b604c5549317ec2bcaa08db589efb1264b7084af7dcbc53b
MD5 52a10422b0eb918bdbc669a7323895ab
SHA1 84a171e0c60689726bae77144086f69f5188e607
SHA512 4c2168e0ce51c1c32946069a1317f9c8cb6449968e566f2bf7eedcd331b6ecf69f23384cec7006b3c03a5a2d7506fe428273d72ff01603128039eaf78731f72e
SSDEEP 384:yZcIlsN6wEYpuHpI799iX5F+JO99KzvKASB9tdsjkLstgOIwZOyDoIoX:AlCrjaiJOAtSIjkLsXsJIQ
TLSH
T188A24A75C8A45DFB84B2E9C5A546F6036EB8503BC6985E1CD9F9B73C309F9F80316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb29521835d0887aef733d211fa43d2903333bb5e86e2580dbfe7db3b16bb1ca
MD5 ae441104cfb514988d8468c296b33f4c
SHA1 1de1bdd3ad0b87ba57d165cd0d5b72d99a1a48f2
SHA512 4178d6169908ca49fae4773c8986a0c9d71a515b2fb4d7ce8fb9bcc8b10c415ac00698c7add7cc45f427547535401a518211221bcfe6dfc2bdc0f71f62b0105f
TLSH
T150D0C028AD78EFF4F021113C0330400031CF88138642210A58610D174C302C30380DF0
MD5 SHA1 SHA512 TLSH

Submit Download

1e9b62f1-7cbf-49bb-99c7-7bd833792741.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e9b62f1-7cbf-49bb-99c7-7bd833792741.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2ca9ba66-b4d0-4f5f-81f9-82189f904569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ca9ba66-b4d0-4f5f-81f9-82189f904569.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76cbc6d5-5eb2-48a5-af3f-bdc3a7f1324b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76cbc6d5-5eb2-48a5-af3f-bdc3a7f1324b.tmp
Size 27KB
SHA256 9dad1ae3ce502826dc886d0f8b1bc5bc320a37c56ee55ad51dfe57e1dae37111
MD5 9d91ac5b5bd24aff788710cc13ad8073
SHA1 99f71fa0024cdf6241064a7b8ade8fa92ab13f40
SHA512 9802667e456313a31204b9b7180b20cd695aee8a4d9c0ce837259f1d73cd20a3d2bdfef023c268fe696f986913f458561e5bbab7c3307d3b97b6118af796fccd
SSDEEP 768:ZX30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72qrolZM/:ZX30AbSWvS299u1jaLmLZ12BM
TLSH
T1F5C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4447FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de323f1e7ece08ab_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\de323f1e7ece08ab_0
Size 258B
SHA256 31d11e9117f823395a206a7d1813b5b1ec698b7c6a1b9f0fbda04a79e4a4d933
MD5 6fa3cd2715b7fb252e646f0ddd991146
SHA1 ecb266c47be9a32b136fe20819af6ca7d2c827ad
SHA512 07843582992057fe4dc3b24988f5541f1d6e8df9ad00403bce7ff334f6f0784c79dc6ea6229f0a0b1053c8f134e69558f8663b7fe75dfa55f87f0328caa32c68
TLSH
T1D3D05EB398DD8885CD3B85B5D5FB1258822A88E0884DF2C145D0D4637B202BAA580949
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5d11a5826df3fea7ed529e1624593c44cbbb0de805ccc09f9059172cb2f5841e
MD5 ad59179fde81dcc3370822b1ce63ddd0
SHA1 622b911fda294996e76961ec9384e8254e4a6626
SHA512 67d22ad096e91ba51f23f1d27879384e5cbad35d6f5a37ffe09e91f762863a2f777dd64280ae4ef0c29a9789f4a6f8271254fcc23d1a95cfdc4a1ede3e3adaf3
TLSH
T16971A663F1E08055FBD83DB897EA2693317CDAC1DA83DF421058D43DB84EB94AA351E8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e653c044-940b-4cfc-bd4a-ef9cea8fdb21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e653c044-940b-4cfc-bd4a-ef9cea8fdb21.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

00f53bbe-5b8c-4cbf-b9c4-6f61cc081093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00f53bbe-5b8c-4cbf-b9c4-6f61cc081093.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

7c51386d-10ad-454e-ba5e-1d76268280e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c51386d-10ad-454e-ba5e-1d76268280e1.tmp
Size 6KB
SHA256 4589547dc709e577819ed77a0e30667971e4068a3a74d6d0b45e052be9339b43
MD5 c5704f8b09aa2d8b4c467a9ca3c357d7
SHA1 e366e260d1dc2e9117a15adfd565a71bef665b15
SHA512 d811d90fb296cd991a056becc370aecbdde06a5f8eb2ca23417f2f47049887cffc5e1b29619435f4c1a682b7a06aefce70107f385844ac0bf213da877ba10749
SSDEEP 192:DhCptFyYe+Y14CHMVYyMdgx/34V5YY4qmG/b1K:DhCptFyYe+Y14CHMVYyMdgx/34V5YY4p
TLSH
T1DFE17BF3C2D5D52E89015AF45A14AE1BCF1D0B1983283C2A8CD5EE87E3E3472D16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc377dbe-a034-4215-a25f-52f36e392d98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc377dbe-a034-4215-a25f-52f36e392d98.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 16b182ab3f795b2eac0b37c147ef94bda9f4f3bf599b52d6c652af77ce02dc14
MD5 83f0effc3672bca7e4b5720cfe0cb90e
SHA1 a2e98de9df3e1ff99790192841655b292320b290
SHA512 412db47113449f9fbb8d88e6df46720a61729f9498648c5659cdb698f70ba379ceefbef8e60665594a4d55d21ac5f8d77c40d15d3b02928d343dd8b950920717
SSDEEP 96:Kh4rk4iqqOI6FViYOK67i+OmAYdOIPPZY/DRT/zIveCiLzK6qitzmJhW3K6gKr6U:AdXsnJ
TLSH
T10991FE85317B02903C7D2A4D41B5966A02A131F33618FB3B7BB945A65E2FE094DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a567b9f5-97a3-46e9-b6ab-ae49f61c32fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a567b9f5-97a3-46e9-b6ab-ae49f61c32fd.tmp
Size 9KB
SHA256 0da0a868806ea77e20046cfeeefc5c40d5a71d9ca297ed362e6d1df18b7531b9
MD5 1aac47d424c4240cef45acc320a840c0
SHA1 cac35806a377a11a46c429b07c9c4ccc4779a1aa
SHA512 9ed1940406a61f22f04cf256d0efcb944510734a6a5b89b096dad51afb93991f6606893b9cdfae847bf1ae3e24d58d0b6f1f316e46d617cc4d7ee7089e0255fd
SSDEEP 192:sxZgRRW9/fissFHoIdp8jHW6+WNm44/Y3R8I8IgrJ:sxZgO9/fisyHZKHbW/f9
TLSH
T12022B9126E38A57B8CC7E21DBA25BF53E5F9503255D51E5CBAFC851C04E66CE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb72a190-d1dd-42ec-81e6-3225f9ace41c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb72a190-d1dd-42ec-81e6-3225f9ace41c.tmp
Size 11KB
SHA256 b56929982d528696a1c3238aecb0f102118422d58b93c07bb4d56d91f4fe74c8
MD5 fbe5811fe3a0c5e60b0b8a8d997d5373
SHA1 ea60c32aa6d65140720b9d325adf5b9bd11b3733
SHA512 b164918f89ac2b8c08cd81eb81b743330024921eaab21e8e0bdc1080339b185be046c32cb4a06887315768de754d631f695034b8261e5b04eeb8b3a642e6dc16
SSDEEP 192:sxZgRkr9/fisSFWWpVj5Idp8jHW6+WNP2T/wXY3JtK8IgbNJ:sxZgA9/fis0WWvjSKHbPHXID
TLSH
T1A932B7127D34A57B8CC7E21DBA257F13E6F9503295911E58AAFC891C05EA6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfd92462-6ac5-48e5-b97d-7e91169f3b5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfd92462-6ac5-48e5-b97d-7e91169f3b5b.tmp
Size 18KB
SHA256 8bc7ac189063438e45cd608dac0bf49444bdb81f23b4db6356cdf0511954dd5b
MD5 5c2f28f4aa4e6c076d99171ce6935c78
SHA1 d57c20bf24d26cd8bef9300b65096d4312a4a6aa
SHA512 5468beeed5ec47f7128797037df16b6a02898dded0c7a04db165bae6f41dcbe58cf9d5d5ff788a97ca52484abcc82351d05e5d5df71b5c9f73d674667590d5be
SSDEEP 384:UZcIhsN6xEYpuHTbr99iX5F+JO9RRtgOIwZOyDoIoX:ShFKjaiJORRXsJIQ
TLSH
T116827D329CB85D7A5DF7D118F14735039F789027DBD8AF58D9EE671C01EA598130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edfc18cf-c790-46f4-83e5-6eea09c1fbc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edfc18cf-c790-46f4-83e5-6eea09c1fbc8.tmp
Size 8KB
SHA256 52f71de74455eda31165e8b58cebeb876b7420b7188243cfbb81cc41bcf70152
MD5 827686637ebd0d4c801258dbdda88b3b
SHA1 4f7db06b7a5c7a187b2df152b15f67314f6b9a71
SHA512 ae0c5fb3f4b38b61aae7eb8f3c7d59c860f9ad27b0fa7df6b804f5b49705a391a03da0ce79965cf67983200aff09bca25662c68af6b0e79dc5989b200e478bc4
SSDEEP 192:LON96AmwprQmiUyTN6siX5FbyhjkQJiRXurU6:LON96ipdG6siX5F+JwREU6
TLSH
T1D602EA35EC786C7B8EF3AE15B5877613AFA5116BDA946F44CAE82B2C01D764C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe42a700-c863-4f29-a50f-dcd69f2930f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe42a700-c863-4f29-a50f-dcd69f2930f2.tmp
Size 8KB
SHA256 c0cde3adf0a2854549236b4f745d6e1dd26da46ef636b8a8d8280ab444686446
MD5 44081dbab7a36c87b03e7b0d1759f0bd
SHA1 88863509f1b950995a5703ac7a9a5f624ab56589
SHA512 bd7d16a34593c6727a493d5d6a3f7de505d2384624013431a07b8ce748afd76887a06f57125e86c511eee773076892fe058ef33aa40a38005b957528125937e2
SSDEEP 192:LONL6AmwpAQmiUy38NfsiX5FbyhjkzEe+fflRRPqeU6:LONL6ipAYufsiX5F+JOQRRU6
TLSH
T13C122A35E8B8AC7F4DD3E564B18735139EA4512BDB886F54D9EC3B2C02EB59C530A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ecc4759f9ffbe731839e94957e0113e9ca990af821d9f80ace3f127b6da637d5
MD5 74d7f1f67ab4a9652e5b8a591d042dc7
SHA1 69f17d71c87b9733137e12d6cade245a65619337
SHA512 c066a811aded18313c3ba3f8353fd07fa27de96de0f1d207a2d5e95edcd0e6267898c4fb9f019474ea0a134a7156d797b04e905f32026021b5e9ec03109f098c
TLSH
T1C5412659A6E91104B3B76F5A9FF7A86E483ABD732F0BD49D50010D4E0B22B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63h 1.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\63h 1.exe
Size 11KB
SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
MD5 5870c114ead5c7fe9c360e763f315824
SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
TLSH
T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63h 2.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\63h 2.exe
Size 11KB
SHA256 ce8c71661f7b8b6f0c32dd0cb079fe8f8bdbc63f769dc38ea9ab698d4a9c60fd
MD5 410635d6c7e0cf69f0f2786be600bae6
SHA1 72d96f76dfeceeaafd5093dcd54a6bb7dbf41ceb
SHA512 0775629a833cffffe87ffd604c2334ca11cf79f8d6c28bf43d3ea8e3d1d70a3914af4a58ecebd597b96252740d353df74ec7e142c5d573dd0c9bce361b360058
SSDEEP 192:elv7OJmKbpVwr0nyM5rnF3HRq1eb7vptT5avt2rXbEILcOmtP:eBOppVw4yMNRxaeb7DT5It2rXLcOO
TLSH
T107321B4AFBD6C434C169073925B7CF26AA70F4554A33EB9E2DDD417B6F6674402102F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PEEKABOO.COM

Path C:\Users\Admin\Desktop\VIRUS shadow\PEEKABOO.COM
Size 921KB
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Payload.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\Payload.exe
Size 55KB
SHA256 b6b1bd5cc42381299e7edb715fe6918b24e538d3c8c0070bfcaecd834d7656d3
MD5 dc45bc8bfa1b11028038edd8dd28e048
SHA1 f49ab181e1be062b530287a42abfa1d6b98dcd90
SHA512 a1f949f1dc4042b5eb5a2bc6d63370644ce0bb0a958d27f654ed331d6d9441fc47f3719145b681ecf40f4b3ccdfa756fe708e0a554c7156fa2087939b614ce1e
SSDEEP 1536:2kZMDnE4uNhty4X+SChDVwsNMDsXExI3pmvm:JMDnlIk4XohDVwsNMDsXExI3pm
TLSH
T165432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\Desktop\VIRUS shadow\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VIRUS shadow.rar.crdownload

Path C:\Users\Admin\Downloads\VIRUS shadow.rar.crdownload
Size 2.9MB
SHA256 5ba40ab0e5903b377fdb0f39c9670ed425d6cb6a34746f2f41579f9f1a2f5f14
MD5 3c511ad0b19881741a37c29397118ea2
SHA1 e4721b4e7a0aba8e66a06b96360ff90b0906d094
SHA512 df686a569e9b3bf90dde2119da5955f1f63d622fed03c9c5e667c1f11365c3e396ae9f34e46276e531d8b433d21121b17a1779d8d24274dc34028d0ba648e159
SSDEEP 49152:i/tMDq8zIqaYnojObIrIMtxvAvw54aH84O3ks7MgEmRPjbpFhFJ0ujkVavZGocH3:Q58zIhYM0mIIxOwRb2ks7A4HhFJZv4Bx
TLSH
T1B0E533AB76C633018CF387A310E455021605BD8F6AB287CB1B976EB70DF6B64D23DA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-426-0x0000000000640000-0x00000000006F8000-memory.dmp

Download

memory/1748-427-0x00000000057A0000-0x0000000005D44000-memory.dmp

Download

memory/1748-428-0x00000000050A0000-0x0000000005132000-memory.dmp

Download

memory/1748-429-0x0000000005150000-0x000000000515A000-memory.dmp

Download

memory/3252-443-0x0000000000990000-0x00000000009D6000-memory.dmp

Download

memory/3464-393-0x000000001B070000-0x000000001B154000-memory.dmp

Download

memory/3464-392-0x00000000002D0000-0x00000000003BC000-memory.dmp

Download

memory/4528-418-0x0000000000760000-0x000000000079A000-memory.dmp

Download

memory/4712-432-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5056-462-0x0000000000780000-0x0000000000788000-memory.dmp

Download