Analysis
- user interaction
yes - max time kernel
899s - max time network
898s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 22:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/RwFo7tsO
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
900 seconds
Behavioral task
behavioral2
Sample
https://gofile.io/d/RwFo7tsO
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
29 signatures
900 seconds
Behavioral task
behavioral3
Sample
https://gofile.io/d/RwFo7tsO
Resource
win11-20260911-en
windows11-21h2-x64
29 signatures
900 seconds
Behavioral task
behavioral4
Sample
https://gofile.io/d/RwFo7tsO
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
28 signatures
900 seconds
General
- Target https://gofile.io/d/RwFo7tsO
- Sample261024-1zb4aaev3p
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Victim
C2
-
5.tcp.cpolar.cn:11548
Mutex
-
bdf05ca063173b2d8f0673df1a3fe649
Attributes
-
reg_key
bdf05ca063173b2d8f0673df1a3fe649
-
splitter
Y262SUCZ4UJJ
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 21 3220 chrome.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation 4a7cb44b15424525a64bc053ba3ca6c6.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes a file named after a Windows system binary 1 TTPs 4 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
description ioc Process File opened (read-only) C:\Users\Admin\Downloads\svchost.exe svchost.exe File opened (read-only) C:\Users\Admin\AppData\Local\Temp\dllhost.exe svchost.exe File opened (read-only) C:\Users\Admin\AppData\Local\Temp\dllhost.exe dllhost.exe File opened (read-only) C:\Users\Admin\AppData\Local\Temp\dllhost.exe cmd.exe - Executes dropped EXE 3 IoCs
pid Process 4168 svchost.exe 4696 dllhost.exe 2424 4a7cb44b15424525a64bc053ba3ca6c6.exe - Modifies system executable filetype association 2 TTPs 47 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\lnkfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 10 api.gofile.io 12 api.gofile.io - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 dllhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1684 cmd.exe 2352 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dllhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dllhost.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2352 cmd.exe 2052 PING.EXE - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3220 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0015-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75AEBBF1-E4B7-4874-A09C-2956E592F957}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.erf reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82B02375-B5BC-11CF-810F-00A0C9030074}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A82536D7-C8E6-4CEF-AA66-11E97EDDFC6D} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADEF4-C265-11D0-BCED-00A0C90AB50F}\TreatAs reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F057-0000-0000-C000-000000000046}\VersionIndependentProgID reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0111-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0358-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C50E1E9-DB15-4410-89C5-D27F4B727368} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0092-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppX00mtp953crf7493tv7fsd reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208F8-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A625EA4-A89F-4EB2-A45A-9AD4E37D4B00}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8E8D427-EF1B-4491-8E0D-3BAE38974C3E} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-apprep\AppX9kvz3rdv8t7twanaezbwfcdgrbg3bck0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F055-0000-0000-C000-000000000046}\LocalServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9432194C-DF54-4824-8E24-B013BF2B90E3}\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF028401-4619-4271-AFDD-F480FA925186}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXtsmg3v4j4x76mctp0h8w9ykwqt07rr43 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\feedback-hub\AppXypsaf9f1qserqevf0sws76dx4k9a5206 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{179C2D43-6376-3839-8C97-E14BE4C4DDD7} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6B9EFDD2-199B-41A0-8192-6A50CD6E521F} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD4FB40-F954-44E0-B8A5-A614481E0831}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9A197F49-176B-30F2-94E1-5C667265BA30} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B4DDD66F-48BF-33C4-B074-F0D61992E186} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0330-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\PersistentHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\AppXqmt9n48kdgabchqtfjw3a4n5as0gk0vt\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\DataFormats\GetSet\2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\Version reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64AE6F2A-2EE6-44FC-BB83-112D6002D3E7}\LocalServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE63B5AC-CA4F-46FE-9184-A5719AB9ED5B} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.asf\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8540D1F6-D74A-3FAD-8BE2-03F9CADC2B1E} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0043-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{939ABC08-6F0E-4595-A12F-F96CFCB7FF77} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.snd\shell\Open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6F5CFDA4-47D3-4A90-A882-14427237BCEE} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.imc\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{014E0FCF-0F61-4507-B3C0-8A9834BE5FEE} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40810760-068A-4486-BEC9-8EA58C7029F5}\TypeLib reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\Children reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{78400D51-3042-3BBE-BD79-E14F774801F7} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0104-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002448D-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0338-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-excel.sheet.binary.macroEnabled.12 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4FB2D46F-EFC8-4643-BCD0-6E5BFA6A174C}\2.0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.z96 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AIFFFile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\Conversion\ReadWritable reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0105-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0000-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open reg.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBA}\InprocServer32 reg.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2052 PING.EXE - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 4872 chrome.exe 4872 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeDebugPrivilege 4696 dllhost.exe Token: 33 4696 dllhost.exe Token: SeIncBasePriorityPrivilege 4696 dllhost.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3252 wrote to memory of 2700 3252 chrome.exe 84 PID 3252 wrote to memory of 3220 3252 chrome.exe 85 PID 3252 wrote to memory of 1868 3252 chrome.exe 86 PID 3252 wrote to memory of 1868 3252 chrome.exe 86 PID 3252 wrote to memory of 2992 3252 chrome.exe 88 PID 3252 wrote to memory of 2992 3252 chrome.exe 88 PID 3252 wrote to memory of 1176 3252 chrome.exe 89 PID 3252 wrote to memory of 1768 3252 chrome.exe 90 PID 3252 wrote to memory of 1176 3252 chrome.exe 89 PID 3252 wrote to memory of 1768 3252 chrome.exe 90 PID 3252 wrote to memory of 1388 3252 chrome.exe 93 PID 3252 wrote to memory of 1668 3252 chrome.exe 97 PID 4168 wrote to memory of 4696 4168 svchost.exe 104 PID 3252 wrote to memory of 3624 3252 chrome.exe 106 PID 3252 wrote to memory of 4024 3252 chrome.exe 107 PID 3252 wrote to memory of 4588 3252 chrome.exe 108 PID 4696 wrote to memory of 2424 4696 dllhost.exe 110 PID 2424 wrote to memory of 1684 2424 4a7cb44b15424525a64bc053ba3ca6c6.exe 112 PID 1684 wrote to memory of 3656 1684 cmd.exe 114 PID 3252 wrote to memory of 4872 3252 chrome.exe 116 PID 4696 wrote to memory of 2876 4696 dllhost.exe 117 PID 4696 wrote to memory of 2352 4696 dllhost.exe 119 PID 2352 wrote to memory of 2052 2352 cmd.exe 121 PID 3252 wrote to memory of 2016 3252 chrome.exe 122 PID 3252 wrote to memory of 2016 3252 chrome.exe 122 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/RwFo7tsO1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ffae1bec728,0x7ffae1bec734,0x7ffae1bec7402⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,13175462499913537076,17865620416643230981,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,3689783135916326047,543444795304126753,262144 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,10083900443087604310,5242489630526365865,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2408 /prefetch:82⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,15837354205884679587,7454987764451711172,2097152 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3092 /prefetch:12⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,16152577151311675735,15048752267597879512,2097152 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,4578004074770474263,11532748147013591841,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,9286970057388907751,9205169345693501511,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,9929551095341627086,10781093256876788034,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:82⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,6909921073902575238,4724088934555032898,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,11458834950140431232,253181498620961559,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5860 /prefetch:82⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5564,i,5484156305465112313,16373450492866625086,262144 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,16644258511289723973,3373784394312260593,524288 --field-trial-handle=2156,i,5930806532358691208,2210303851881192621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:82⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1160
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4976
-
C:\Users\Admin\Downloads\svchost.exe"C:\Users\Admin\Downloads\svchost.exe"1⤵
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4a7cb44b15424525a64bc053ba3ca6c6.exe"C:\Users\Admin\AppData\Local\Temp\4a7cb44b15424525a64bc053ba3ca6c6.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\reg.exereg delete HKCR /f5⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3656
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn CleanSweepCheck /f3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"3⤵
- Executes a file named after a Windows system binary
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2052
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4dc 0x4b41⤵PID:808
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5ea871b6-4d80-4d1f-8490-4791474f1bc6.tmp
- Size 130KB
- SHA256 0ddcda09f15476674316908618d70143494214041cc6832cf50120d5804eac30
- MD5 3068e1fafc65ce91fbfc9f3f42f6f31e
- SHA1 50767832e34a885b6e455a65cfcf240d646e3064
- SHA512 ca33145fe06aafe7cdf99beb64b44b4735fa0f037e2bd47a98151fdc8ff1e041631767b5696b93ab0013f3f5e0f3e8701bd2ff70f9ca0b47029bbe03f524db57
- SSDEEP 3072:dhd+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dhd+hFD+7t56OD9ZfSApprr
- TLSH T1AED31232AA91D8BBC9FC6541B157A304DE666CED41DE3A09444A5F8EE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9355bf31-5334-4b03-8998-6da91e6d9977.tmp
- Size 131KB
- SHA256 cf444f0c42ea737dab57778cc0484db9b09ea176d9b77c19dca38e01708d1f91
- MD5 faf8b9abdf45fedc4ae73e9daffd9ba0
- SHA1 87f610f0f21a8425d8d053da383e1fe8586d1cab
- SHA512 86d7acfd381021d1e924e360bedb290d0b987ccfc653908cd892dff01981e7220d59bcb12846a60b26ebc9d6e4896acac040c0a843ab30db79760917cace27ab
- SSDEEP 3072:1tY+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:1tY+hFD+7t56OD9ZfSApprr
- TLSH T17BD31232AA95D87BC9FC6541F147A304CE6668ED95DE2A0D444A5F8EA09FC4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\38a60e08-d2f7-4bb3-9d17-9a29bd766b49.tmp
- Size 414B
- SHA256 ca7d429169f5d30803c2753d1a20e42659f0ca2d88b3066c1ed88b374c73f0b0
- MD5 415176b95e3a21f71f82c48b0f173a1d
- SHA1 c49d3ddd96859c197fc04b38a1245e91873d23bf
- SHA512 2226d098ac682e02df7823b315fa3e09bc61c1d6b2c2a8325c9f4346cf21fda424a0c7488c3d95f6b1cff381c6ff086d6431df01d2f4cf37048099a002dc1539
- TLSH T1BAE02BB9CD35EC272CFD472810514746EB8013573A81455F363C810D8FF527A4586D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\432bb26e-b5fb-4047-8c9b-d506bb310be6.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\576ec87f-f0f5-4222-a6a5-d78f6fcdc1d5.tmp
- Size 12KB
- SHA256 d6f2a49e9a16ab0329233537c4766f67a4f9715624a23aedbf1232f5bb603b38
- MD5 6a4c4ff0e4076c6e64f850eebd087c94
- SHA1 abfa3aa7fcef496113d069b051655e7e75fa2c18
- SHA512 363914638e4dbf68e1b744aa9e5ce4a57f97e692ace5a9c0d1210114e311cff0ad4823e175fc336d12053d8a302fce0929ac60446129c28cec1bfd716893e045
- SSDEEP 192:XRPiDszv71vXPRprzli9IHsb+WNnjLQx22vT16fTVyIsnAUgE:XRPigL53X02wPn2LwE
- TLSH T1C242B72EA910393B9CDBD326F921BB57D7F5202675942E84E6FC893C25EB9CC2117407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 1KB
- SHA256 d75efb7795e54f6c5035539199ecea8adb38202b9cdebc5ff2a16b17b99ce84e
- MD5 4ebad90e98e757be3bba5578c47a9045
- SHA1 01b41ec37705773c3179a227ed0db698b7881b8d
- SHA512 3f4caf761a7310d008cf8efa6940012083208ed3615a92451f7e10950eccbbb423f6b070307e10e5416c0ec7432836558c9f332772a2de024aea4f57eef3dcd3
- TLSH T18721FEA177140770DF1092F35AC481687A7389B24847FDEB804A1DBD5710BCAB75B591
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9fafcf2d-6c0d-4352-bbdb-ba3ca345061c.tmp
- Size 998B
- SHA256 f0cbda5c001149273c0c675be681e42f13957264cb4f50f1a104b9506f3afde7
- MD5 7d92a1b2e53766875e89bee640c43e45
- SHA1 6383bedf66f6307b3a54d57f8bfe97506b911d2d
- SHA512 5426e5bb1719debdecc34c65a3f02f9e87a7bf66cd67364d259f814f8c327982396b027a48a7ec22012068ece344f164398648334208d1524ddedda6bdd4ff66
- TLSH T1BD11AB63E67EB46B003958A72E41BC0628BEA831419158F4DE5BC26C70C02A30B16193
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\af33e604-61dd-420b-9121-6ac7bcb036c7.tmp
- Size 1KB
- SHA256 2aedcaef876c57aa102f1b226fc9c6c91f014d875db4ca492f38fc2587531156
- MD5 990e16d2a9bfe8aa65872892f87ee4c9
- SHA1 fbbd28bfe04c56e1cad17b48d2cdb11aa39ae568
- SHA512 dd3f663a645255fbaa57fe0565ece78c48d49badc61f2a5889fd23f0f340336792e56440e3d00633d39cac4c94a63523cffefa6a01b8530a8286ab96f713b8a0
- TLSH T18241AAF793B4957E8A2192E4EB11AF1FCE690524032C387689D06E2793F3972E10479F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c1b3ea08-d26d-40e7-bdf4-00be5654db1a.tmp
- Size 1KB
- SHA256 d1ed30b63c3b339d809519901c42622d60c8832251aadee3ff0f5a28760deb8c
- MD5 68297b8686e19fac0230346004bce0c1
- SHA1 2ca94542b41a666d5d56e47c8cbfcac01f0b7056
- SHA512 e347ca6f7af66d39d5e9546604bcd28e49b049c510c14fe3b3e28639b2f24f12c44d79fbce13d93788d4744140ecff642ca275dbc48e8e7e0031b85bfcad571e
- TLSH T112418AF793B4957E8A2192E4EB11AF1FCE690524032C387689D46E2793E3972D10479F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e8211f7a-53d5-40ca-b96d-d76b937e6871.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e33487d0-0139-439d-a519-971c237ccafa.tmp
- Size 11KB
- SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
- MD5 c653853b21659f0f1a17088bce964c32
- SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
- SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
- SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
- TLSH T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd93a973-8083-4e2a-8498-8da4d55c8b96.tmp
- Size 11KB
- SHA256 bdf4f3e912e00eff8cfeff265e5e20d96fc2e9afa0180b46f8d6f30b8788248e
- MD5 cad3983e0700bf79c6411d0a0c37741c
- SHA1 65988594cee39bf20813a227dce9056ea72450f1
- SHA512 50dd780ffc82af47f33932774d8ef3b14468b7da16215a1ec1bed6b278eb795c45ac67a9c24bb47edc33d8d920426c0c4d23631a94776b63addbd55bfb40ce60
- SSDEEP 192:XRPiDszv71vAPRp2zli9IHsb+WNnjLQx22yT16fdVyIsnAUge:XRPigL56XX2wPn2YYe
- TLSH T10C42952EA910793B5CDBD22AF921B757D7F5102675942E84E6FC893C24EB9CC212B407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\baf17fc7-7949-49e1-80b4-715852052573.tmp
- Size 131KB
- SHA256 43d960384a49758cbf09c69a4a6abf7177274f390e71fda1ab0650817bd4e988
- MD5 9e0fa5dee322e2ed12a6afd2a7ccc47a
- SHA1 6035171c4bd2341ca695647ac183fc0b9f7f6374
- SHA512 6a464c85f3e8a1cc4953b845087f4f25e04c12dfb5b9a5cb04ecc6aaa9220572ab6d4c6d1cb095fd334e33d30b5965eaa6176675c135614804ea3b50b7dfbd11
- SSDEEP 3072:COK+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:COK+hFD+7t56OD9ZfSApprr
- TLSH T1A8D31232AA95D87BC9FD6541F157A304CE6268EE45DE3A09444A5F8EE09FC4C07A3E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c69e649e-6885-4678-9df8-728fc424b3d1.tmp
- Size 131KB
- SHA256 9f8b0df1afa4c13046c732791cb6cd44d148469354f82e8d7a782d243e47e345
- MD5 2a2f9b4f667f7926ce15e2594d1b3a73
- SHA1 fbe5c6897ddb3691f971d60cf8f554cc08050e2f
- SHA512 35c2dbca0d9a9925f66577b57fe3db55a6b6c29795ba588cb3e98d4e2741a4e533285d9ca7ef7a34ea63003bd02cc6fa6ccb3ec2524308e1e2c5dcfa4ab59fb9
- SSDEEP 3072:ptY+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:ptY+hFD+7t56OD9ZfSApprr
- TLSH T10ED30232AA95D87BC9FC6541F147A304CE6668ED95DE3A09444A5F8EE09FC4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ed3f6c0f-2e7d-467d-a064-8edff18f0f69.tmp
- Size 131KB
- SHA256 cec01b224e7ef0f17926e0547f06f2fc01712cb21573528a63c1e56164eff65c
- MD5 5784b954f456d68fb6613fa155b904b9
- SHA1 8e02b6127f1ffa2815f4b6eb53cabb58104c4002
- SHA512 6426553ee4f2e99b575c9174e881833406f490669f622ed84b3d236a9bf8592ab693d0441a11a0d065328ae43e00614cae50bf11c45df7f64959dedd854212cc
- SSDEEP 3072:pOK+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:pOK+hFD+7t56OD9ZfSApprr
- TLSH T109D31232AA95D87BC9FD6541F157A304CE6268ED45DE3A09444A5F8EE09FC4C07A3E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\4a7cb44b15424525a64bc053ba3ca6c6.exe
- Size 11KB
- SHA256 64dd2548186b3b88e285fe69c1e6816c6ca1214961258f4460965b739420cc43
- MD5 8b6323fe3dfb5da70036e2b0f6e1365e
- SHA1 2d995427cdba589747add457e0a29e93a5f00ec5
- SHA512 2e172feccaf60b392ee826dbd17cf822f8ca9823b7d773003da9a076cc84f9dcc9c5531c9cefa29f67d21d81825c32b015039c2c363e349f4938b022469073d3
- SSDEEP 192:bwuCj48DQ9jwlmhonIvT7hfRLN/Fd4gJqr9ozayN1+:bf64tbhlb7dB9FCgJQ9ozayN
- TLSH T19E32090AEBC54930CEDC0BB824B716C69570E84E8E13DF5F1DDE44BA6DB9B410E952D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\63fe395f-cd9d-4aa9-bbd3-2a34b985d71b.tmp
- Size 512B
- SHA256 66ba794a69c69dda36b02ed54a04a8a9c61d8f9bde37b60f6be6e9aaa738d6bb
- MD5 77416a44fd8f49dc5f195c2abf6df2d4
- SHA1 3b7a1c1f8bbeeb550699820a9082a15b500efdbb
- SHA512 09dd6a20122458db5af6b9ee820274bc7bb319e4543d6d35ac17290e440e97fe928152e986dbbd92027edd28db0a124443c139c939c47da2a785c4813c6808b2
- TLSH T108F0A9074BA898FBD03813B041C3890436F1982883F3C31F0C86123E78022BC2E44B06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 822215.crdownload
- Size 54KB
- SHA256 270f01d9864fb6a516bd7f0865befa0cf7a06edbb8a0e97f7c69d0b49e294181
- MD5 ec10e6cfb28eb6094bfb1ae8423cc71d
- SHA1 78dc99bc5f98230b8b536d31b7601c821b7274c8
- SHA512 dbd3bd5f5abace06ea07ab250812df3f8bc99a480bf7ed6b63c71c9e88d8fd5651bf1c978f4c5f835f9f4930459210a48d68c5bf2d16be98669e1defa9270341
- SSDEEP 1536:rKPCUbsDnyNho6JypySDxwsNMD1XExI3pmOm:ruCEsDn4o6I4SDxwsNMD1XExI3pm
- TLSH T1BF432840BFEA5A05D2BD8F3468F655150634BA63EA32EB1E4CD668EB13327C58C40FD6
- MD5 SHA1 SHA512 SSDEEP TLSH