njrat | hxxps://gofile[.]io/d/RwFo7tsO

Analysis

user interaction
yes
max time kernel
899s
max time network
884s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/RwFo7tsO
Sample261024-1zb4aaev3p

Score

10^/10

victim defense_evasion discovery execution njrat persistence privilege_escalation ransomware trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

5.tcp.cpolar.cn:11548

Mutex

bdf05ca063173b2d8f0673df1a3fe649

Attributes

reg_key
bdf05ca063173b2d8f0673df1a3fe649
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	4528	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes a file named after a Windows system binary 1 TTPs 4 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\Downloads\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1948	svchost.exe
3548	dllhost.exe
920	db74a16365f640abad0e4ea10dceaf74.exe

Modifies system executable filetype association 2 TTPs 47 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	api.gofile.io
11	api.gofile.io

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	dllhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
940	cmd.exe
3448	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3448	cmd.exe
3284	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ori\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0253-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244EA-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\AppX1sy7rwrc20ggq97a6x1mgmjat0rthy51\DefaultIcon	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0338-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0062-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000035-0000-0010-8000-00AA006D2EA4}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB1A2AE2-A4F9-11CF-8F20-00805F2CD064}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0247-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0191-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0319-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F7F24C1-74D9-4EA6-A3EA-7EDB2D81441D}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493461-5A91-11CF-8700-00AA0060263B}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0006-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0033-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXb5yxv86nkhp530y0y50yxe69c1qwad1x	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B2F73449-98EA-4866-90A0-425837FC5E23}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0326-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF53050B-882E-4776-B643-EDA472E8E3F2}\2.7	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E132-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7FAC39E-7FF1-49AA-98CF-A1DDD316337E}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0261-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020350-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208B0-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6271895B-E67F-4DEE-B68B-BF74ACE07753}\1.0\0\win32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vlc\shell\PlayWithVLC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8ACA8016-B08C-4C5A-99CA-C24488385828}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4df0ba60-eaf9-4b53-b806-8f72740a4e70}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F024-0000-0000-C000-000000000046}\MiscStatus\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F597A95C-EDB6-4FBC-BA35-22065158084B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020832-0000-0000-C000-000000000046}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\Shell\Open\Command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208CD-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC098A45-913B-4914-B6C3-AE6304593E75}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0227-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{739CBF5D-5AED-49F8-AD1C-540094411664}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8CF0278D-D0AD-307D-BE63-A785432E3FDF}\4.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F2D35B3-DB34-4966-BEA6-59C7CD203862}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024477-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEDAE97E-D7EE-4796-B960-7F092AE844AB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F491-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3050F804-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0268-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0341-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.symlink	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0238-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063095-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\Implemented Categories	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.AddInMacroEnabled	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3284	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe
Token: SeShutdownPrivilege	1340	chrome.exe
Token: SeCreatePagefilePrivilege	1340	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 5840	1340	chrome.exe	89
PID 1340 wrote to memory of 4528	1340	chrome.exe	90
PID 1340 wrote to memory of 1836	1340	chrome.exe	91
PID 1340 wrote to memory of 620	1340	chrome.exe	92
PID 1340 wrote to memory of 1836	1340	chrome.exe	91
PID 1340 wrote to memory of 620	1340	chrome.exe	92
PID 1340 wrote to memory of 1956	1340	chrome.exe	95
PID 1340 wrote to memory of 2204	1340	chrome.exe	94
PID 1340 wrote to memory of 1956	1340	chrome.exe	95
PID 1340 wrote to memory of 2204	1340	chrome.exe	94
PID 1340 wrote to memory of 268	1340	chrome.exe	96
PID 1340 wrote to memory of 4128	1340	chrome.exe	97
PID 1340 wrote to memory of 1624	1340	chrome.exe	98
PID 1340 wrote to memory of 4128	1340	chrome.exe	97
PID 1340 wrote to memory of 1624	1340	chrome.exe	98
PID 1340 wrote to memory of 2980	1340	chrome.exe	100
PID 1340 wrote to memory of 2980	1340	chrome.exe	100
PID 1340 wrote to memory of 2696	1340	chrome.exe	101
PID 1340 wrote to memory of 2696	1340	chrome.exe	101
PID 1340 wrote to memory of 5800	1340	chrome.exe	102
PID 1340 wrote to memory of 5800	1340	chrome.exe	102
PID 1340 wrote to memory of 4980	1340	chrome.exe	103
PID 1340 wrote to memory of 4980	1340	chrome.exe	103
PID 1340 wrote to memory of 2948	1340	chrome.exe	105
PID 1340 wrote to memory of 2948	1340	chrome.exe	105
PID 1340 wrote to memory of 5824	1340	chrome.exe	107
PID 1340 wrote to memory of 5824	1340	chrome.exe	107
PID 1340 wrote to memory of 5444	1340	chrome.exe	109
PID 1340 wrote to memory of 4340	1340	chrome.exe	110
PID 1340 wrote to memory of 1284	1340	chrome.exe	111
PID 1340 wrote to memory of 3448	1340	chrome.exe	112
PID 1948 wrote to memory of 3548	1948	svchost.exe	115
PID 1340 wrote to memory of 5708	1340	chrome.exe	116
PID 3548 wrote to memory of 920	3548	dllhost.exe	117
PID 920 wrote to memory of 940	920	db74a16365f640abad0e4ea10dceaf74.exe	119
PID 940 wrote to memory of 1672	940	cmd.exe	121
PID 3548 wrote to memory of 4516	3548	dllhost.exe	122
PID 3548 wrote to memory of 3448	3548	dllhost.exe	124
PID 3448 wrote to memory of 3284	3448	cmd.exe	126
PID 1340 wrote to memory of 5280	1340	chrome.exe	127
PID 1340 wrote to memory of 5280	1340	chrome.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/RwFo7tsO
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff92b3c728,0x7fff92b3c734,0x7fff92b3c740
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,13805788340820239048,915703903774317153,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15832764318994125593,10045189022658545261,262144 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,4852364337062273647,16724451279201262244,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,7735254555409594178,15353241170163896527,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,15284927627014678976,18389263300666215594,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,5388979660400925587,17243852671772171573,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5284,i,14887904185370939434,2211875237897237347,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,3399757045690478055,10423143084717647035,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,11053050838121337851,10454139909495343229,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,4121886485896480298,8619640845830159131,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,3826798063667882233,14101474350833114782,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6056,i,7129983129752968354,17386171950727013711,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6228,i,14503984459493400336,14306084230263381750,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6188,i,18377447105540378469,5331861882971382534,2097152 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14447010394996802597,3592507591462672601,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,2097938628732169908,4013239685176611626,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,11726857590494313991,9322850598677359822,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,15832114565853610212,4675411395880591993,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6404,i,1370065588451053618,2074017109220921567,262144 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=812,i,8576859980530839081,18168915239736732241,524288 --field-trial-handle=2100,i,5855013824760235888,13417162149612380996,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:5280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4616

C:\Users\Admin\Downloads\svchost.exe
"C:\Users\Admin\Downloads\svchost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\db74a16365f640abad0e4ea10dceaf74.exe
    "C:\Users\Admin\AppData\Local\Temp\db74a16365f640abad0e4ea10dceaf74.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        5⤵
        Modifies system executable filetype association
        Modifies registry class
        
        PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn CleanSweepCheck /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3284

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000500
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1960

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5435f370-7f05-43cf-afaa-76fc1d80dc4e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5435f370-7f05-43cf-afaa-76fc1d80dc4e.tmp
Size 5KB
SHA256 0abf17684b26cc4057e94a841df9edcb1f83d8e51621d36d0fd2f369470fbe17
MD5 eb841f29daddd257602284d6b8bb9ee3
SHA1 64df9c88b2b1b1d9b6b3804805debcbf400b3f33
SHA512 107a08c5fd9282510099d77588c1a0d00f80bcc0e5f4c01b56a3a7a9b793be51db6fc3d126d8efde42299dc679e13dabbf8ce099d9060d41e44539276e14fd96
SSDEEP 96:gbJ0d+OBIsu/Fl3fIUKsI8p8IzSl8h4otop5QbDuB6mGyvELc6w2QN6dRjz0j9IJ:gt0pB+fTbnpziU28Oa/cFVMdRjzU4
TLSH
T1F5C10A31B46D5CB715F2D885B5032E43CEB462EB69109E60DBDA5F1D01EB1FC2342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

662e12ed-54cd-4edb-8ebf-fc471789d858.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\662e12ed-54cd-4edb-8ebf-fc471789d858.tmp
Size 5KB
SHA256 a006c649005e16e66d17305430924739571d97d669ac72a2731caf769b36650c
MD5 467e1bbfeb09a4cbdb68a09339166162
SHA1 dfb1cde6deb7272255f8b6d5402c19839cd4820a
SHA512 b163711eb781b6904044405268d8650146f68831d2ba99a146807e2be70a0362727a67ad05ae6d87511a35fbb01f0490598fcf2df2452aaf90d18ba4b694f9a3
SSDEEP 96:gbJ0d+OBIsu/Fl3fIUKsI8p8IzSl8h4otop5QbDuB6mGyvELcz6XRjoRNC39ISyn:gt0pB+fTbnpziU28Oa/ceXRjouCe4
TLSH
T15EC10A71A86D5C7B09F2A485B1032D53CEB826ABBD107E14EEDE5E0C01E74ED1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91d71eee-5a5c-463c-a1b3-d816e5511327.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\91d71eee-5a5c-463c-a1b3-d816e5511327.tmp
Size 4KB
SHA256 5500c46954fb2f8dfd3443ddd94a0e31d1d323f8cad45a87b7c953f215f1eea2
MD5 68b24bef54117fa7534e191e07626297
SHA1 808c571daebeab47829d567b60c86300ce33d80d
SHA512 30e97db8c1c1efddbbe5dd9b92da8cf56152b55e7cd732a0fcb4b1606810f26f0bdf74f3fec1f436a62da695ede6778efe3192880e2113b276c562d0d96f4529
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5QiDuB6m8dGyvELkzAjrbuj1v4a:kC0pB+fTbnvDUDjO4w/gAjrbu1
TLSH
T1BBA12B31A4B88CB755B5C5C5B5563E43CFB462EBAC109E80D9DE2E0D11A71FC2381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23cf4dd7-aa7d-4190-8355-25bf98d040ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\23cf4dd7-aa7d-4190-8355-25bf98d040ba.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51c1e265-44aa-40e5-bc14-4ee9ed8b4f90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\51c1e265-44aa-40e5-bc14-4ee9ed8b4f90.tmp
Size 12KB
SHA256 d077e06dbbc1fbd04c821a7b44752f1d6cceeffbbebcf681d8b2aee9429feac7
MD5 4c024429717002b886c4e8528d42a931
SHA1 5b2cca76c27d726230baab117733c4ee4a16f879
SHA512 8a81e63988619ac165b04be34c946b0b34a45688c4484f568a43e1303cfe3ad3b3eba7026f42a339c082cd99da86908b84cacfe98b2429854635e1282509bd7d
SSDEEP 192:wRroXc1rv7H8vdPRpuhlB49OHsb+WNncKQmSe5xhiO80VyIsnAUgE:wRroXCTb8NXxkwxseLzE
TLSH
T11B42D62EE914B93B9CDBC629F922BB57E7F4202574902E84E6FC893C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80514378-2236-479c-96e8-1f2f60517122.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\80514378-2236-479c-96e8-1f2f60517122.tmp
Size 12KB
SHA256 1189bca8664d72965445060d73ede5aadfa5f8f9e1a86d9830858f6026969afd
MD5 95a845cd8fad136c21a770158532e5a2
SHA1 5db023d398d447aa3a1a3173a06246ab6eb81f0e
SHA512 b1e2f3a81281aa98649ae75fc2859adf79b1a2605c1e269ff89175418dc1312b87f4325065ebd628a92f830306886e0039dcc4b558197f6dcf23ebcd80fbb508
SSDEEP 192:wRroXc1rv7H8vAPRp2hlB49OHsb+WNncKQmSefxhiO8aVyIsnAUgE:wRroXCTb86Xpkwxse53E
TLSH
T1AB42D62EEA15B93B9CDBC619FA22BB57E7F5102570942E84E6FC893C14E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 1a12795ac0cc513bfe99ce9d3156beaf254387a86e70c37949633f8ff33cd2ed
MD5 bab1e3c76c81cc119189330d6b015fd3
SHA1 c4479b6842439b8c388c6cfee5269c70356d8f51
SHA512 4fd158c19e1224fc285413d04922e3e4bdcf47195f3d72f40e30baf8f875939eca97b55a39642288e69662f215fad6f4b97176007c522d61fc9ca6944bb52372
TLSH
T1DC219CE5B7210720CFD45273E4CD91787A35449688DBFDAB40C9497843127CE521FDA1
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

171fe581-14f2-40ff-8976-6959cfebd8fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\171fe581-14f2-40ff-8976-6959cfebd8fe.tmp
Size 1KB
SHA256 6dc4dfc46b9c8f9c6e5529f1b7d974861883d22895650287cc8a2b87a4b22ddd
MD5 2ec11584bd2a8987984765be2bf92aaf
SHA1 454ca244e6e14f53a88f9ff42f38243651f5abc1
SHA512 9f35353cf817e3b6480e1968253140d24344af14669430e4a8ac0e4f6c6b94fb94b53ccdc39a1b888e70bde36289c8ee277872600d96d06b82662c79342debc6
TLSH
T11241BBF783B4957E8A2192F4EB01AF1FCE690524032C387689D06E1793E3972E14479F
MD5 SHA1 SHA512 TLSH

Submit Download

1ec4b1e6-4fff-4913-9859-a9eae152093a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1ec4b1e6-4fff-4913-9859-a9eae152093a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

48b20abb-79d0-458f-900e-a6511a7e7c3e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\48b20abb-79d0-458f-900e-a6511a7e7c3e.tmp
Size 1024B
SHA256 4b7c95b2cdfbe0f5a27cdf1f65ab750c2d377eaf7d196b9b9b461505a4552d0e
MD5 9480bf7721a49ab1fbbd0a6e9b8899f4
SHA1 4d04eeb8b51f33f22773f096079678e13eb8c843
SHA512 ee56fffd237314c0c1285c5e1bd9f63582543e8aac502a77b07d41343154a4a3d71189e33e6fb3ec954f82de21b5e4136b06b14ac2c975ead96ed518cae26cc5
TLSH
T12D11CE6BEABE7477007E99671E51BC0668FEA432055168F1DA6AC2ACB0C05F30F06493
MD5 SHA1 SHA512 TLSH

Submit Download

678ec1a0-adac-41ff-b19b-6a178f196012.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\678ec1a0-adac-41ff-b19b-6a178f196012.tmp
Size 1KB
SHA256 a0d81e7b768369ece1144c4ac131347de281070535c3cdaf17bdb5332a74f85b
MD5 8d902a15ebaaba96761b75cc23bf1053
SHA1 1228171e3b5e64aa14efd7527a4bdc1078f11f3d
SHA512 f1f16227652176b3a793c20777e36d55b6fca6a30f860ea1dbcb12e2661ec6b0abb72d3d0d1627bac1c03fe804b99309f6ee515f931383d90cc0a6604d082ea7
TLSH
T12641BBF783B4957E8A1192F4EB01AF1FCE690524032C387689D46E1B93E3872E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

adc10018-99bf-4da9-9645-aacf81743b69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\adc10018-99bf-4da9-9645-aacf81743b69.tmp
Size 1KB
SHA256 9b0624d5fb90588cad5c131b8c2215728a76f6d26b93a62b3775ea1874e0905e
MD5 64b054b8e083262d3becd01bed1722f1
SHA1 66d757fbe0c451de11d79f7fb98ad7b3f5e189d0
SHA512 5249da5a206a5e9ec3e4c24a9b5e47491187c1fc2687e76ce33e964d6f8778ccae903fc0c9686927ef91e1eb43b00cadc59dd6a9c578642a3144aa08cacb2f23
TLSH
T15231A9F783B4957E8A1192F4EB05AF1FCE690524432C387689D06E2B93E3972E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

bb60363d-4394-4375-a658-eeac73b7a99a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bb60363d-4394-4375-a658-eeac73b7a99a.tmp
Size 11KB
SHA256 06788e87956f6562f8ea68536e24e8d4351fd98744fcfe1360156230280e0821
MD5 18e42a6a3eed75e9f49fd2962c04d4ca
SHA1 796a341de6acb78e8ed94a1b61ef08f7f3a34058
SHA512 e1d49fbdcc89faa772538812432ba4c94fc57a838832c5fa17ac08469a8633882da6bbd7378719b9f84c126c0645834f059b88fb1afc08ff3c1607ac0fbfdb7b
SSDEEP 192:wRrMXc1rv7H8vAPRp2hlB49OHsb+WNncKQKm2PxhiO8mVyIsnAUge:wRrMXCTb86Xpkwx82p3e
TLSH
T16C42D62EEA15B93B9CDBC219F922B757E7F5102574942E84EAFC883C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e97e7fb6-0413-4683-a737-24391e02a197.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e97e7fb6-0413-4683-a737-24391e02a197.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

aa1c3fa3-e978-4a26-9b2a-a2c31b89eaf0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aa1c3fa3-e978-4a26-9b2a-a2c31b89eaf0.tmp
Size 5KB
SHA256 b839fd012f1d14a4251c18a1c74c88e5539fecaef3ee3283b2282fce7636493f
MD5 207b561d52f086466807a594d0122e19
SHA1 5e6af0502eda327da879128a9543ad5600846727
SHA512 ca98b16b40faf389b6c374dcea2e6f3983523dd8836590c32ddac5c491291a6dc3c16b89a2ff196b94ab3eed841ad1cd4ea56568b0738259591f0e543bc10b7a
SSDEEP 96:gbJod+OBIsu/Fl3fIUKsI8p8IzSl8h4otop5QbDuB6mGyvELcz6XRjoRNC39ISyn:gtopB+fTbnpziU28Oa/ceXRjouCe4
TLSH
T12AC11A71A86D5C7B59F2A485B1432D43CEB826ABBD107E14DEEE1E0C01E70EC1383A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d20a4307-4404-4141-9715-201ac7496aeb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d20a4307-4404-4141-9715-201ac7496aeb.tmp
Size 5KB
SHA256 6f4145649fa6908cb7969c00f4457d3cdbc7b7d882bae5b1b4f4c8eb50362e39
MD5 a5ec5425b2e98dab55bbb9a65956abf9
SHA1 2c296b8d0442a69c5cad2e8742cac9cf88be66ed
SHA512 bda2e50e69f2fb01d68cb8d141edacd6108fe0027f5b8c0e129f476de68a6bea784e2f49a49da26402e9e93a538406d499dc984998de5a54e524a9ed4ad7ee9d
SSDEEP 96:gC0d+OBIsu/Fl3fIUKsI8p8IzSl8h4otop5QbDuB6mGyvELc6w2QN6dRjz0j9IEI:gC0pB+fTbnpziU28Oa/cFVMdRjzU4
TLSH
T1EBC10A31B46C5CB715F29885B5072E43CEB466EB6D109E60DBDA5F1D01EB1FC2342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db74a16365f640abad0e4ea10dceaf74.exe

Path C:\Users\Admin\AppData\Local\Temp\db74a16365f640abad0e4ea10dceaf74.exe
Size 11KB
SHA256 64dd2548186b3b88e285fe69c1e6816c6ca1214961258f4460965b739420cc43
MD5 8b6323fe3dfb5da70036e2b0f6e1365e
SHA1 2d995427cdba589747add457e0a29e93a5f00ec5
SHA512 2e172feccaf60b392ee826dbd17cf822f8ca9823b7d773003da9a076cc84f9dcc9c5531c9cefa29f67d21d81825c32b015039c2c363e349f4938b022469073d3
SSDEEP 192:bwuCj48DQ9jwlmhonIvT7hfRLN/Fd4gJqr9ozayN1+:bf64tbhlb7dB9FCgJQ9ozayN
TLSH
T19E32090AEBC54930CEDC0BB824B716C69570E84E8E13DF5F1DDE44BA6DB9B410E952D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 101904.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 101904.crdownload
Size 54KB
SHA256 270f01d9864fb6a516bd7f0865befa0cf7a06edbb8a0e97f7c69d0b49e294181
MD5 ec10e6cfb28eb6094bfb1ae8423cc71d
SHA1 78dc99bc5f98230b8b536d31b7601c821b7274c8
SHA512 dbd3bd5f5abace06ea07ab250812df3f8bc99a480bf7ed6b63c71c9e88d8fd5651bf1c978f4c5f835f9f4930459210a48d68c5bf2d16be98669e1defa9270341
SSDEEP 1536:rKPCUbsDnyNho6JypySDxwsNMD1XExI3pmOm:ruCEsDn4o6I4SDxwsNMD1XExI3pm
TLSH
T1BF432840BFEA5A05D2BD8F3468F655150634BA63EA32EB1E4CD668EB13327C58C40FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-333-0x00000000009B0000-0x00000000009BA000-memory.dmp

Download

memory/1948-271-0x00000000748B2000-0x00000000748B4000-memory.dmp

Download

memory/1948-270-0x0000000000E70000-0x0000000000E80000-memory.dmp

Download