njrat | hxxps://gofile[.]io/d/RwFo7tsO

Analysis

user interaction
yes
max time kernel
900s
max time network
864s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/RwFo7tsO
Sample261024-1zb4aaev3p

Score

10^/10

victim defense_evasion discovery execution njrat persistence privilege_escalation ransomware trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

5.tcp.cpolar.cn:11548

Mutex

bdf05ca063173b2d8f0673df1a3fe649

Attributes

reg_key
bdf05ca063173b2d8f0673df1a3fe649
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	4568	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes a file named after a Windows system binary 1 TTPs 4 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\Downloads\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2800	svchost.exe
5972	dllhost.exe
4076	698a3e54231842f3a5421cd7f6a2a604.exe

Modifies system executable filetype association 2 TTPs 47 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	api.gofile.io
7	api.gofile.io

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	dllhost.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\svchost.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2824	cmd.exe
2772	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2772	cmd.exe
4564	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4568	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE68179B-08EC-4A2A-B8E0-69131A68D2C5}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DropTarget	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0288-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0337-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A2703AE-70A3-4757-A2AE-D141F9248A3D}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\Enqueue\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BCC737-B171-4746-94C9-0D8A0B2C0089}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C03CA-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FBD703B-FECE-4348-B93D-6E92AC097F17}\Version	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0283-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CRTXFile	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\ActivatableClassId	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5104D3E9-5038-517E-9CF6-28C106CEE038}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gpp\shellex\ContextMenuHandlers\PlayTo	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F3BE369-0B78-4511-91E5-08F9FC5CAE0D}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C19-CB0C-11D0-B5C9-00A0244A0E7A}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0107-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{33D9A760-90C8-11d0-BD43-00A0C911CE86}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0221-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.URL.webcal.15\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SPCFile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04082FC6-E032-49F2-A263-FE64E9DA1FA3}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5512D116-5CC6-11CF-8D67-00AA00BDCE1D}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0118-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.apprep.chxapp_cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\AppXpzkxgsbx9mzsg8kedsrg63eqxykxrtcx\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208F8-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244BC-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7339A62-0E31-4A5E-BA3D-F2FEDFBF8BE5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB476970-9BAB-4861-811E-3E98B0C5ADDF}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-283421221-3183566570-1718213290-751554359-3541592344-2312209569-3374928651\Children	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-cxh-full\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSGraph.Chart\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.it\shell\PlayWithVLC\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.qcp\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\AuxUserType	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C172B-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6911A8C8-1743-4AAF-988B-55FF9AE94329}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\Win32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0153-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-appinstaller\AppXxfctf2rqj6c7b4wrvys6zq1bskprrn19	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C100BEE2-D33A-4a4b-BF23-BBEF4663D017}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0332-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\msimn.exe	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\AppXdn5b0j699ka5fqvrr3pgjad0evqarm6d\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0088-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:InternetGatewayDevice:1\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EABCECDB-CC1C-4A6F-B4E3-7F888A5ADFC8}\DataFormats	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0173-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CDB00-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7895C94C-5A3F-11D2-B742-0000F87572EF}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88511855-6FE6-5694-83A7-991E29033DE5}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\svchost.exe:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4564	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2640	3504	chrome.exe	81
PID 3504 wrote to memory of 4568	3504	chrome.exe	82
PID 3504 wrote to memory of 536	3504	chrome.exe	86
PID 3504 wrote to memory of 3252	3504	chrome.exe	83
PID 3504 wrote to memory of 5024	3504	chrome.exe	87
PID 3504 wrote to memory of 536	3504	chrome.exe	86
PID 3504 wrote to memory of 3252	3504	chrome.exe	83
PID 3504 wrote to memory of 5024	3504	chrome.exe	87
PID 3504 wrote to memory of 4384	3504	chrome.exe	85
PID 3504 wrote to memory of 4384	3504	chrome.exe	85
PID 3504 wrote to memory of 4016	3504	chrome.exe	88
PID 3504 wrote to memory of 4016	3504	chrome.exe	88
PID 3504 wrote to memory of 4996	3504	chrome.exe	91
PID 3504 wrote to memory of 5640	3504	chrome.exe	93
PID 3504 wrote to memory of 1252	3504	chrome.exe	94
PID 3504 wrote to memory of 2292	3504	chrome.exe	95
PID 3504 wrote to memory of 5908	3504	chrome.exe	96
PID 2800 wrote to memory of 5972	2800	svchost.exe	99
PID 5972 wrote to memory of 4076	5972	dllhost.exe	100
PID 4076 wrote to memory of 2824	4076	698a3e54231842f3a5421cd7f6a2a604.exe	102
PID 2824 wrote to memory of 5864	2824	cmd.exe	104
PID 3504 wrote to memory of 3248	3504	chrome.exe	106
PID 5972 wrote to memory of 2420	5972	dllhost.exe	107
PID 5972 wrote to memory of 2772	5972	dllhost.exe	109
PID 2772 wrote to memory of 4564	2772	cmd.exe	111
PID 3504 wrote to memory of 3844	3504	chrome.exe	112
PID 3504 wrote to memory of 3844	3504	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/RwFo7tsO
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe1fc728,0x7ffcfe1fc734,0x7ffcfe1fc740
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,1064205464682878495,17473117037111665521,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,11360526843319463251,11751087311862394637,262144 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,16898750171286568954,17788643149486330275,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:13
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,16190160944204150996,15738412196356142507,2097152 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2940,i,5065896949794991995,8630012602530083093,2097152 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,16298736204192471861,8478897535498284776,2097152 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,17508909521828778298,1970769807830580697,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,10501639572839266899,8977050996061952226,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,16506671023627202011,6131935909086202254,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,9030316940263615814,13266160410721043977,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,1093383686685677036,14655879858745963213,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5556,i,2713016518425950960,13799286433182688539,262144 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,12244458877169505055,2763390879602394166,524288 --field-trial-handle=2052,i,17715024687966506817,17010803642057225373,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2972 /prefetch:14
  2⤵
  PID:3844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3884

C:\Users\Admin\Downloads\svchost.exe
"C:\Users\Admin\Downloads\svchost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Users\Admin\AppData\Local\Temp\698a3e54231842f3a5421cd7f6a2a604.exe
    "C:\Users\Admin\AppData\Local\Temp\698a3e54231842f3a5421cd7f6a2a604.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        5⤵
        Modifies system executable filetype association
        Modifies registry class
        
        PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn CleanSweepCheck /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004DC
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3bd801d8-00b5-4394-9e21-e8b50d144597.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3bd801d8-00b5-4394-9e21-e8b50d144597.tmp
Size 130KB
SHA256 b83b247f841a192c07ba617ba6f75b5c4004c780a1a816c2a6b2b55f6d50cfb8
MD5 d9aba0253707a52a8f24a76eb2572729
SHA1 085a2cedb72be75766109428f585d9f7fca4b903
SHA512 f18151baf35b0aea8a29f5619fa4b6c94029be24e2895146b6c2299e5f5123eb61f8794bf5126d4ab584ee37bc95d1409d8ec1951e97751c4dbbb3beab3ac285
SSDEEP 3072:RH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:3t4fLJ0L6nGJxi3bzqapJjk
TLSH
T141D302F0D6A06C7ACBF7EE4145756E948F71D5C289CDBE2409F9881816CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df98174-b83f-4463-8d27-58ac99c6ac21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5df98174-b83f-4463-8d27-58ac99c6ac21.tmp
Size 131KB
SHA256 a98704d3dc35a54166976bf09e7c3773ebcfcfb0f17a74390a6d5d15a8ca670b
MD5 6502002a5c8558a3210ede2998ba68bc
SHA1 2db3abd9d8fc724f21d94e37638594381e12ab86
SHA512 b2a1a4217019f44ce7ec519b3e91158b158f5508e54970320131ba216da760e85dc1e17d562d79664bcde36c42c6f074ab64079e545f5f0f0ea3b5b0353c7a3c
SSDEEP 3072:7IH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:7At4fLJ0L6nGJxi3bzqapJjk
TLSH
T188D302F1D1A06C7ACBF7FE4145756E908E71D5C6898DBE2409F98C5806CAE384A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e4b6f07-7c1a-46ad-a967-088b6e410e32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e4b6f07-7c1a-46ad-a967-088b6e410e32.tmp
Size 17KB
SHA256 de13521758ef1bfcb2d2450b3cf0a7a99cd0970c06b92340bd4289551bfc2ad6
MD5 b0928f3b5aacd381a50cb79484995d2d
SHA1 ba2f982a9d1dd6c557ee7a37adadea8daab8b737
SHA512 af3e8c9148f12d0e4fb4988464bd2a8f2df2e47ea7c5f1cab56fe717533c7f2da51919aeb6a09e6a8b95119e5735947b80bbd19844feb7e8ffa58cbd1ddf81e1
SSDEEP 384:Q2j8z7KxkXqKf/pUZNCgVLH2HfgslO07pLuLceSe/XOD8P+ErU3fKHGFwjj9B:Q28z7KxkXqKf/pUZNCgVLH2HfgsI07p+
TLSH
T1E47209676C4C997B0F98CACCCC267A4FADB5024B65E9886443FA5C2903D4ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54fddec1-5e9a-4af1-a2ad-a19c1237df29.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\54fddec1-5e9a-4af1-a2ad-a19c1237df29.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8506f4b4-ab0d-49c0-bcde-b86f53f71b25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8506f4b4-ab0d-49c0-bcde-b86f53f71b25.tmp
Size 12KB
SHA256 9b2c289b04392108d0a0e71a53f4901b02564fbb51217b7efc66ed9165723d17
MD5 4c40ac359a1898876c39a879d800aac4
SHA1 08065309ba7f44f4ab7075552d8184648ad699e4
SHA512 ed43617cf22ae68ee9f4c7f30cc473179c999cda31261c8387504982b657eacc6e10cdc1d362489b7bfe81380f081d17d8b85ababc69020d4a5495487f7c99ca
SSDEEP 192:iRM2FmefJb4JCANv7bpAPRp2XRlt9/Hsb+WNnezQp9eTC8HZ75kyVyIsnAUgE:iRM2kwAfPUX+5tweceG8HRNE
TLSH
T1D942D62EA9046A7B5CDBE22AF9657717D7F5202264D02E84EAFCC93C11E7ACD2127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f9c7b17-5dda-4f29-afb3-2c285b5b72c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8f9c7b17-5dda-4f29-afb3-2c285b5b72c7.tmp
Size 12KB
SHA256 37eab73b26eb0808d8ab9df6307e1aa3c4a2c684b6fb5684d9d0e6616c3e6133
MD5 13892e8f1d278fc823dedf3404994450
SHA1 0bf14277f9469ece50593846c47c8f7f9ab7b9df
SHA512 0352ae127aab2851d0be8052a1cfb61949a3b23f88b093456fd5afac6dfa8e41aa7671eb931f51359421f98d6c0732916ac557e1a8ee6b138fead3fcdc3b0027
SSDEEP 192:iRMmFmefJb4JCI1Nv7bpAPRp2XRlt9/Hsb+WNnezQqK2jC8HZ75kyVyIsnAUge:iRMmkwApPUX+5tweM228HR1e
TLSH
T14142D52EE908697B5CDBD22AF9657727D7F5202264D02E84EAFCC93C14E7ACD2127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 1ec6948f5195f08994ffb8735176317f412efaf03aa13ff1fff85d57d9beb43d
MD5 0bc3fe1caef4022328f75c8e388fe86a
SHA1 4cec4e8f497634f0439b7c7c655fecb3287fa042
SHA512 b04ef21311757d620980234ac684f9397dbe8e25659f7d6be86f338862d556591f11d03dd88f65951f2744b2d3ef649205cb3f80d0e7e140c2b942fad6c46c06
TLSH
T1BF21CBA177240B70DF1052F36AC481687A3349B14857FEEB81490DBD6B10BC6B75B591
MD5 SHA1 SHA512 TLSH

Submit Download

4173ec1d-e32a-448e-84a1-b3688d9edb77.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4173ec1d-e32a-448e-84a1-b3688d9edb77.tmp
Size 2KB
SHA256 9fb9cf24e7660db1df88f682d129f5b164417965bbbc1935983e0f1cc2b6114e
MD5 ddd5a9f5945dc52d49f0d1dc1c441cda
SHA1 4dd09e30f2c64b1275cda64d8a11de23002bd818
SHA512 54171a23aa2e157954d149e4f03c47496d274ef19956bee191a4649c21ff7b80a0d3cbe001b38d9d14e2983a89136e38c1144e97db6f2854af66d8b6aebf8916
TLSH
T16E51ABF783B4957D8A1196F4EB156E1FCE690524032C38A688D4AE1B97E3972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

8380f8d3-89d8-42cc-9925-f1381b51b796.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8380f8d3-89d8-42cc-9925-f1381b51b796.tmp
Size 2KB
SHA256 c19ed3b966bea47de7db261892373d3617689c5caec3690d02bdd6134eb7c12e
MD5 af0bd75ec3b82bf35d899485cfacd671
SHA1 dabb92a1d4a2cac66afc3d755f53f67fdab57fcf
SHA512 744b70426cc2e13a08e4413395bbed7414919af7ddeb68f3a93d051ba08534357e6474e0e672b12a0ff3dc3a3316f4b89fd5e7ba34ff09705b3960bd2ebe2c3a
TLSH
T1DD419BF783B4957E8A1192E4EB156E1FCE690524032C38A689D4AE1753F3972D14474F
MD5 SHA1 SHA512 TLSH

Submit Download

99e404fc-03ae-4a77-aa1c-7a64f8df7488.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\99e404fc-03ae-4a77-aa1c-7a64f8df7488.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bef451ef-877b-4b94-a58a-8c7fd6981dbe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bef451ef-877b-4b94-a58a-8c7fd6981dbe.tmp
Size 2KB
SHA256 59c76b46992d04a264414a7b1a1479b012c07a9d53dcc368ec171beaf4caed8f
MD5 eb136c8518c3a69969974061bff5a130
SHA1 26f3117b0084a25a51fcb5b83bfaa045c6f71584
SHA512 bd3b8986d9e08607f87b0c345054502d7bd11a592d0f0216bf27af4082c9c587dc5a3463a88a46ff46693179af7afa0366a407edfefa4df13ef470ba89a207e7
TLSH
T17451DDF783F4857E8A1196F4EB156E1FCE690524032C38A688D0AE1B93F3972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

d46ad73b-c097-4dd7-a963-cb2f3dc0e6ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d46ad73b-c097-4dd7-a963-cb2f3dc0e6ca.tmp
Size 1024B
SHA256 2ba52760e2d64436324c1b5d13abe6e7fdd7d7e5baf467eaf077c2e831231993
MD5 6d1a4b288e600c2af3ddc5fe67f9ed22
SHA1 29227d13aa3673a1024d6e7b6a50a37fedd047ed
SHA512 9ab476076bf4deb989b64f1a48d7e4dc11c7264a9c3dd00d87615bbb66acc8e3a31ca95a3a85c35682e06c4baee66fdb4bb1bdd3c76dc7bdb347c1b3bb7ff06d
TLSH
T10A11AF63DABDB46B01BE58BB1E55BC0A3DBBA83143D164F1CB5BC27DA0815E30F06052
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e5fe5e8388de4f51446921bcccea3ae9c8255caf85a64647fc2e46fb75f55865
MD5 4d799c635497050bc6e428a4001e448c
SHA1 314e3eab09bd904f264a9be422b6cc4113c054bf
SHA512 2aeebcccd1a5f7ce2b70ee7550f0fb47db63366628a64129aa345034c099dc751c5a0bc87aed88921768c38eea876eec3522a71212ad25c1aebf7f1b68561335
TLSH
T1BBB0121691456313C51103F011A0905432608F34E512138641E11D11C8333A04017108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 a774d1053a14c227662c2fb148ba3cb06e438365784faa1e894841f1b45224fc
MD5 ce753fba4a49d3c388c1356514eda523
SHA1 7c7883dcc557e249efafa0849af16166c54aaa43
SHA512 cd7ddfb0c78b7511626f19c87b5519592467b00708c4fb2c9d2b2bceb207363ba8ddc4e7dc251544809647b39241a18ea8b735e6df4d98c71344a1a0fec88ad3
TLSH
T13CB02280E302A302C02303B020E080ECF020CF28C2830B2382E22A33CC282B00022020
MD5 SHA1 SHA512 TLSH

Submit Download

a04c87e3-90e2-4f22-84c1-dbd7494b54eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a04c87e3-90e2-4f22-84c1-dbd7494b54eb.tmp
Size 414B
SHA256 04072f8b540046a07611ff23961171b54cd16ef0159ccb55d40e521925e7de34
MD5 f1b0acc1ea2d511251bc923caece8062
SHA1 f90ed1c0514a6f9b157f1c241b3fcfb152df4097
SHA512 704e70e77acacf34a9cbd0f230537a24086dae8d91c09cc15e443ed87d8771f2f17a52ebad66c8befaa0d287abe44fb72701a3c559e187ac40dd40bc9439f116
TLSH
T188E0AB69C821FC3708F9071C50500749D68023433751491F7B3E91188FB063A16DAC6C
MD5 SHA1 SHA512 TLSH

Submit Download

e4c0ec44-f2c2-4a80-ac2a-fb050a62545b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e4c0ec44-f2c2-4a80-ac2a-fb050a62545b.tmp
Size 13KB
SHA256 f154530c24345ae5a3af170338d6b6d3a4126fa3fd7b08e945a0a2a166c9ca0e
MD5 fded935dffa12ac9ccbed9bb3fe6fb8e
SHA1 20b320142a895264e4c41194ba26c3d9b92bfec1
SHA512 d09b53f10a5fa9a49fdbab4ac26c536db3d0955e8b349a41602e023fda60d343be94d5e82706e81c254cfa9365a47cefe347eb926209549925965230b521e96a
SSDEEP 192:iRM2smefJb4JCANv7bpwPRpqXRlt9/Hsb+WNnezQp9e7C8HZ75kmVyIsnAUgE:iRM2JwAfPcXy5tweceO8HRHE
TLSH
T1C252E72EE904697B5CDBE22AF9557B17D7F5202264D02E84EAFCC93C14E7ACD2127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a15c3c2d-1d61-47dd-9431-9e438049ddbb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a15c3c2d-1d61-47dd-9431-9e438049ddbb.tmp
Size 132KB
SHA256 3e2156d936817bb100991a4091d383cb71bf44dc7641b85f3b2473a304ee3c09
MD5 593c8a167b93cdf678256ec322ac4cbd
SHA1 68cd7b4f6c75c505c5fe707a34417062d8c0ce95
SHA512 1d78225eef2e7cc7306610d0216b8eaef84dac7200a802cc04577d301b146c1e40814dcf0be7de993913835cbd741f88eb3e84d3a2af549167d2710e12e49491
SSDEEP 3072:/IH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:/At4fLJ0L6nGJxi3bzqapJjk
TLSH
T107D302F1D1A06C7ACBF7FE4145756E908E71D5C6898DBE2409F98C5806CAA384A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6eca3a6-8fb7-4d1a-8985-e9bc26945cc3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a6eca3a6-8fb7-4d1a-8985-e9bc26945cc3.tmp
Size 131KB
SHA256 64ddfe7e1a8dfefdde5d632b078ec42ecc0222be0269896fbf6c9b1b1e0d0da7
MD5 1b2be96dd919ac30088910d7262af5ff
SHA1 7b62d54021e14b069f11559779c73835d0452fa8
SHA512 c63e823b725f1b2c2f4395e13c9bc95ade13bdec3f81feffb894290aee1e6ce8c8ab99d662c089c3b40ff58d3c515b31413ed21a0b82b2e34359763452e43507
SSDEEP 3072:tRH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:t3t4fLJ0L6nGJxi3bzqapJjk
TLSH
T112D312F1D5A06C7ACBF7EE5145756E948FB1E5C289CDBE2005FA881806CEA344E13E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df33b665-d96a-4a78-8664-1a8ffd22cb13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\df33b665-d96a-4a78-8664-1a8ffd22cb13.tmp
Size 131KB
SHA256 3c85236a8c89dcb5fd073aa8e5eddcbe45fb605617963e56728045acf9de6cee
MD5 cc373248d6cb84f4ee3766964be03fb5
SHA1 2894abba935ee11104e7b0908fc07a799231cf1a
SHA512 b0d34c8818351052f103a94154765ebe8610d2250a57315cdcd24fab47bd3b11871a1d1665edcda2e568d442e0bcc1d7b9746ee7d88dca81652030d7c987eb72
SSDEEP 3072:QRH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:Q3t4fLJ0L6nGJxi3bzqapJjk
TLSH
T148D312F1D5A06C7ACBF7FE4145756E948FB1E5C689CDBE2005FA881806CAA344E13E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698a3e54231842f3a5421cd7f6a2a604.exe

Path C:\Users\Admin\AppData\Local\Temp\698a3e54231842f3a5421cd7f6a2a604.exe
Size 11KB
SHA256 64dd2548186b3b88e285fe69c1e6816c6ca1214961258f4460965b739420cc43
MD5 8b6323fe3dfb5da70036e2b0f6e1365e
SHA1 2d995427cdba589747add457e0a29e93a5f00ec5
SHA512 2e172feccaf60b392ee826dbd17cf822f8ca9823b7d773003da9a076cc84f9dcc9c5531c9cefa29f67d21d81825c32b015039c2c363e349f4938b022469073d3
SSDEEP 192:bwuCj48DQ9jwlmhonIvT7hfRLN/Fd4gJqr9ozayN1+:bf64tbhlb7dB9FCgJQ9ozayN
TLSH
T19E32090AEBC54930CEDC0BB824B716C69570E84E8E13DF5F1DDE44BA6DB9B410E952D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c6795d6-161e-406a-9960-f9d082bb6252.tmp

Path C:\Users\Admin\Downloads\8c6795d6-161e-406a-9960-f9d082bb6252.tmp
Size 15KB
SHA256 7c84f5a3d0fe72f892fc7dff4a0b3df57ec028bf6c60fd4b2e8010e1886f7a33
MD5 d14a82e7b689280b4e25b76b2f205869
SHA1 893151b471dd2eeefedbd2e5f4012789aecc5b63
SHA512 339609f5d80c4a8cb56d4ef41027641011668c152cefeccd871ace1d745df18c9a65da19efd97278efb8af90c4e7fba80f6183cf568d6a04da7d272d568a1230
SSDEEP 384:r5YgICUpEMbl+zJ1M3KhhUNbS5t7t2Nho6Jq:rKPCUisl+t1ManUU5n2Nho6Jq
TLSH
T150621E8A7F9A998AD37C8B75A1F21538457409A3F452BE1F8CD6ADE363266C31804DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 222655.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 222655.crdownload
Size 54KB
SHA256 270f01d9864fb6a516bd7f0865befa0cf7a06edbb8a0e97f7c69d0b49e294181
MD5 ec10e6cfb28eb6094bfb1ae8423cc71d
SHA1 78dc99bc5f98230b8b536d31b7601c821b7274c8
SHA512 dbd3bd5f5abace06ea07ab250812df3f8bc99a480bf7ed6b63c71c9e88d8fd5651bf1c978f4c5f835f9f4930459210a48d68c5bf2d16be98669e1defa9270341
SSDEEP 1536:rKPCUbsDnyNho6JypySDxwsNMD1XExI3pmOm:ruCEsDn4o6I4SDxwsNMD1XExI3pm
TLSH
T1BF432840BFEA5A05D2BD8F3468F655150634BA63EA32EB1E4CD668EB13327C58C40FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\svchost.exe:Zone.Identifier
Size 162B
SHA256 b38a8bc6ff5f4255797592d9c88698fe9dc8f18bc0a472be4b5b5fb440a1d0ce
MD5 bb08491f9cb44588f434ca2903b65783
SHA1 e9987b174429f2113e3080c8ddb6dfde0727b345
SHA512 ec993be485070ec7333cc7a1a8ef464cdd27d9de143a96cea830d62a54165cf36b917f0802e97c03ca9b1146af4355530dca4c95495aac2636d7933ca830dded
TLSH
T161C08C978490C469970836C4126940CCBB8F550888AC9A94B406E0AF6C47A28C2E1A7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2800-167-0x0000000074921000-0x0000000074922000-memory.dmp

Download

memory/4076-229-0x0000000000020000-0x000000000002A000-memory.dmp

Download

memory/5972-186-0x0000000074920000-0x0000000074ED1000-memory.dmp

Download

memory/5972-238-0x0000000074920000-0x0000000074ED1000-memory.dmp

Download

memory/5972-185-0x0000000074920000-0x0000000074ED1000-memory.dmp

Download