c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31

Analysis

user interaction
yes
max time kernel
18s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
PEEKABOO.exe
Size 921KB
Sample261024-rem6dacs2n
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	PEEKABOO.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	MBR2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	MatrixMBR.exe

Executes dropped EXE 6 IoCs

pid	Process
4048	MBR2.exe
4768	TROLL5.exe
4296	TROLL2.exe
3244	MatrixMBR.exe
2184	GDI.exe
4728	MBR.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\MatrixMBR.exe	MBR2.exe
File opened for modification	C:\Windows\System32\MatrixMBR.exe	MBR2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
832	chrome.exe
832	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	4728	MBR.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4356	832	chrome.exe	88
PID 832 wrote to memory of 2164	832	chrome.exe	90
PID 832 wrote to memory of 2088	832	chrome.exe	91
PID 832 wrote to memory of 2088	832	chrome.exe	91
PID 832 wrote to memory of 4692	832	chrome.exe	92
PID 832 wrote to memory of 4692	832	chrome.exe	92
PID 832 wrote to memory of 2312	832	chrome.exe	94
PID 832 wrote to memory of 2312	832	chrome.exe	94
PID 832 wrote to memory of 3528	832	chrome.exe	93
PID 832 wrote to memory of 3528	832	chrome.exe	93
PID 3572 wrote to memory of 4048	3572	PEEKABOO.exe	95
PID 832 wrote to memory of 4652	832	chrome.exe	96
PID 832 wrote to memory of 4652	832	chrome.exe	96
PID 832 wrote to memory of 2996	832	chrome.exe	97
PID 832 wrote to memory of 2996	832	chrome.exe	97
PID 3572 wrote to memory of 4768	3572	PEEKABOO.exe	98
PID 3572 wrote to memory of 4296	3572	PEEKABOO.exe	99
PID 832 wrote to memory of 5092	832	chrome.exe	103
PID 832 wrote to memory of 516	832	chrome.exe	104
PID 832 wrote to memory of 516	832	chrome.exe	104
PID 832 wrote to memory of 1828	832	chrome.exe	107
PID 832 wrote to memory of 1828	832	chrome.exe	107
PID 832 wrote to memory of 4276	832	chrome.exe	108
PID 832 wrote to memory of 4276	832	chrome.exe	108
PID 832 wrote to memory of 3788	832	chrome.exe	109
PID 832 wrote to memory of 3788	832	chrome.exe	109
PID 832 wrote to memory of 4260	832	chrome.exe	110
PID 832 wrote to memory of 4260	832	chrome.exe	110
PID 4048 wrote to memory of 3244	4048	MBR2.exe	113
PID 3244 wrote to memory of 2184	3244	MatrixMBR.exe	114
PID 3244 wrote to memory of 4728	3244	MatrixMBR.exe	115

C:\Users\Admin\AppData\Local\Temp\PEEKABOO.exe
"C:\Users\Admin\AppData\Local\Temp\PEEKABOO.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\MBR2.exe
  "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\System32\MatrixMBR.exe
    "C:\Windows\System32\MatrixMBR.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
      "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
      "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
  "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
  "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87834c728,0x7ff87834c734,0x7ff87834c740
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,12462165649327821169,11962320442895360567,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,17219719935125258426,6477352262566812460,262144 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,4653378909572405839,12697994794410501159,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,11609977261343996126,3357222899462056827,2097152 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,7430190196855545915,8633763490517730293,2097152 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,2544805629283547856,13789739041877210445,2097152 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,937205344572678405,3734522120978744681,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,16815494137866534240,12743970918441036373,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,3669132629184268792,6137973457909460621,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,17114363160253586507,17285555840828313474,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,15304538747527644475,12950366777030703894,524288 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5360,i,2379431043337723811,11825977093825511393,2097152 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5676,i,2915692900977852264,10324618069333092946,2097152 --field-trial-handle=2108,i,1123648731740500043,15664402929334421874,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5660 /prefetch:2
  2⤵
  PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x294
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15d65ea6-0265-44a5-874e-246b1bbf057e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\15d65ea6-0265-44a5-874e-246b1bbf057e.tmp
Size 414B
SHA256 6d39207eb3eb514f4da94c1075e8fe238ab4eab8a551aedb0754af1b51440c0e
MD5 772bd7f6a514c36126f2af08658822d5
SHA1 31a863fc6c71b79e743581592b1051062c319bb6
SHA512 7e50be378ee74490d8e0b51e077390e86f2912b754f0c0fe53a6fd3203ba523687bfd2b1d1db8f2d1fee66327d210431a952fb302bdeff06ea394c84be3c4204
TLSH
T171E0E5A9C925EC372CFC571860544746FA80131B2681551F3A3C81098FB527A458681C
MD5 SHA1 SHA512 TLSH

Submit Download

7487bcf2-a524-45a2-a056-037ec4a81efb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7487bcf2-a524-45a2-a056-037ec4a81efb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7a53fd5d-ade5-4431-b1b8-171e474e2b8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7a53fd5d-ade5-4431-b1b8-171e474e2b8f.tmp
Size 11KB
SHA256 17a219d979024e65b2f56ae2e872e5d1e2dd5354c84a22986ac30a59b93d4334
MD5 78b5176a0144856a1c35e7df81736ec2
SHA1 4300df7892b033ed1c5dcafc3f0d64a713122fde
SHA512 7c265bad2f3287339e9e39d355c6a9bbe75696d9ad7821e10b30c99e9d21c13228cdab3d982a48d8b7f411031286432ec69864ef3becc7eeb8fb270ae67e1129
SSDEEP 192:qRqqDrPv71vAPRp2Z9IHsb+WNnrf0MaegWIaVyIsnAUge:qRqqfH56X62wL01qe
TLSH
T1FC32A529AD10753B5CDBD32AF961BB57D7F5102635982E80EAFC893C15EB9CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29ae52b7-e8b8-418e-85ac-9c9d3aa3ea4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\29ae52b7-e8b8-418e-85ac-9c9d3aa3ea4d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d2892b51-f6ac-42ca-b129-40715fe4467e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2892b51-f6ac-42ca-b129-40715fe4467e.tmp
Size 13KB
SHA256 1e1b7acce04e100a0900a73b0697bb31fc43af67e01a1938f3e0b483fccf4f5a
MD5 5f720c8f4f5c1710fe644127c11e9823
SHA1 493957eb15ee25fb386b98814e42628032007777
SHA512 b87e11924de10588489da66fbde77e1ce827dda7291ac797cd4507cc9c7fd53ba5749f3ab4d65532b0e9f0b76631274cdc4c9d00fef842585de7fff15eba716c
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3FVHGoVt7ShW2:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEl
TLSH
T19A520A27A44CAA3F0FD8CA4DDC12AF4FADF501576668492457FB9C18039A7CA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc9077de-04d2-4922-a45f-4d177d345be3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc9077de-04d2-4922-a45f-4d177d345be3.tmp
Size 269KB
SHA256 9b01ec35583f967d9db593614fef3a6ad363aaaebf7ab1d6ce4e12d17b1c1c29
MD5 3a996ec2180b34f6869779bdc4472ab7
SHA1 edadb684cb9ffbbba64bc395f0526a1137414aa0
SHA512 788a6dc6a532a8e00d2e17db39a73377a225f20f319c8924073f79aeecc3013b48f29f7180f82df842473794f950983ea18087b25b35764588762e4b1d55ba91
SSDEEP 6144:wmHCsUfw5u7eC94LUX4rY7Q/Cn+hFD+7t56OD9ZfSApprX:wNs2w5Ee5HranyFSXD9ZfS4R
TLSH
T1284423F1DF6A186B1EFC4607B21773094F7AD8E5998C2549808B6F4B309FB890667623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f86e575e-eda0-401c-a74c-7cfb96d0bbf2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f86e575e-eda0-401c-a74c-7cfb96d0bbf2.tmp
Size 130KB
SHA256 bd8344376ca74e6b59d7984da61c5a48c9fe42534be28c908086ac0f3d8dc926
MD5 cdf9ed792824b8955afad94ee7c310ab
SHA1 b02f5cdbd2eda6d6963061dcb4ffadf66f86e7b6
SHA512 ab30583d7d3095fc329013c7ab6d47fd40ff60e60e24c49c4dcc9d9af91d1cc60508a666bf0e02fff88bd3473f7024c4522b77182cdedd45c3d143d967d842fb
SSDEEP 3072:d6R+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d6R+hFD+7t56OD9ZfSApprr
TLSH
T17CD31232AA91D8BBC9BC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C06B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e05f45ce-a0d3-49bf-8d3f-9d15cdd56405.tmp

Path C:\Users\Admin\AppData\Local\Temp\e05f45ce-a0d3-49bf-8d3f-9d15cdd56405.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir832_572387230\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-405-0x00000000000F0000-0x00000000000F8000-memory.dmp

Download

memory/3244-383-0x00000000008F0000-0x0000000000936000-memory.dmp

Download

memory/3572-0-0x0000000000220000-0x000000000030C000-memory.dmp

Download

memory/3572-2-0x000000001B070000-0x000000001B154000-memory.dmp

Download

memory/3572-1-0x0000000002520000-0x0000000002530000-memory.dmp

Download

memory/4048-29-0x0000000000B60000-0x0000000000B9A000-memory.dmp

Download

memory/4296-384-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4768-55-0x0000000000780000-0x0000000000838000-memory.dmp

Download

memory/4768-61-0x00000000055F0000-0x0000000005B94000-memory.dmp

Download

memory/4768-63-0x00000000050E0000-0x0000000005172000-memory.dmp

Download

memory/4768-72-0x0000000005280000-0x000000000528A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads