njrat | 282fa168e8142d2fad5ad2624f0469386f7d7271e4b3a4f3dc9463cf9cbf979a

Analysis

user interaction
yes
max time kernel
128s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Payload.exe
Size 55KB
Sample261031-ppsshads7m
SHA256 282fa168e8142d2fad5ad2624f0469386f7d7271e4b3a4f3dc9463cf9cbf979a
MD5 661214919a5b94ad7912f55c298e658b
SHA1 925e26bdca262501a95adeedb0994b0a587b4dce
SHA512 8d97886e4ad930bdd65adae82a30378b6ce821a9be58187abfe3d1d3daa3bd87fd9d1c03849731ab2fa4e5bcaceb85cad84f25a47b04cf191e371076a9ff5ed9
SSDEEP 1536:XF+dIDnrNZtLy9CIDKwsNMDFXExI3pmem:V4IDnRekIDKwsNMDFXExI3pm
TLSH
T1F3431844BFEA4A01E2BD8F3468F655150A34AA23F532EB1F48D568DB17327C58C80FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery njrat persistence trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	406d16b0f3af40ffb9541a4ab63306fc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	MBR2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	MatrixMBR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	Payload.exe

Executes dropped EXE 7 IoCs

pid	Process
4824	406d16b0f3af40ffb9541a4ab63306fc.exe
1064	MBR2.exe
2276	TROLL5.exe
1252	TROLL2.exe
812	MatrixMBR.exe
1512	GDI.exe
2980	MBR.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\MatrixMBR.exe	MBR2.exe
File opened for modification	C:\Windows\System32\MatrixMBR.exe	MBR2.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Payload.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{909A6CB0-4149-4881-9740-40601AEC1AC4}	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
820	chrome.exe
820	chrome.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
4384	Payload.exe
820	chrome.exe
820	chrome.exe
980	chrome.exe
980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeDebugPrivilege	4384	Payload.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: 33	4384	Payload.exe
Token: SeIncBasePriorityPrivilege	4384	Payload.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: 33	4384	Payload.exe
Token: SeIncBasePriorityPrivilege	4384	Payload.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: 33	4384	Payload.exe
Token: SeIncBasePriorityPrivilege	4384	Payload.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe
820	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4768	820	chrome.exe	89
PID 820 wrote to memory of 3968	820	chrome.exe	90
PID 820 wrote to memory of 3968	820	chrome.exe	90
PID 820 wrote to memory of 2100	820	chrome.exe	91
PID 820 wrote to memory of 4684	820	chrome.exe	92
PID 820 wrote to memory of 4684	820	chrome.exe	92
PID 820 wrote to memory of 2744	820	chrome.exe	94
PID 820 wrote to memory of 3772	820	chrome.exe	95
PID 820 wrote to memory of 2744	820	chrome.exe	94
PID 820 wrote to memory of 3772	820	chrome.exe	95
PID 820 wrote to memory of 3948	820	chrome.exe	96
PID 820 wrote to memory of 3948	820	chrome.exe	96
PID 820 wrote to memory of 4420	820	chrome.exe	97
PID 820 wrote to memory of 4420	820	chrome.exe	97
PID 820 wrote to memory of 1296	820	chrome.exe	100
PID 820 wrote to memory of 1296	820	chrome.exe	100
PID 820 wrote to memory of 3376	820	chrome.exe	101
PID 820 wrote to memory of 3376	820	chrome.exe	101
PID 820 wrote to memory of 3004	820	chrome.exe	102
PID 820 wrote to memory of 4784	820	chrome.exe	104
PID 820 wrote to memory of 4784	820	chrome.exe	104
PID 820 wrote to memory of 1920	820	chrome.exe	109
PID 820 wrote to memory of 1920	820	chrome.exe	109
PID 820 wrote to memory of 3092	820	chrome.exe	110
PID 820 wrote to memory of 644	820	chrome.exe	111
PID 820 wrote to memory of 3840	820	chrome.exe	112
PID 820 wrote to memory of 3492	820	chrome.exe	114
PID 820 wrote to memory of 3492	820	chrome.exe	114
PID 820 wrote to memory of 4328	820	chrome.exe	115
PID 820 wrote to memory of 4328	820	chrome.exe	115
PID 820 wrote to memory of 4212	820	chrome.exe	116
PID 820 wrote to memory of 4212	820	chrome.exe	116
PID 820 wrote to memory of 1340	820	chrome.exe	117
PID 820 wrote to memory of 1340	820	chrome.exe	117
PID 820 wrote to memory of 4444	820	chrome.exe	118
PID 820 wrote to memory of 4444	820	chrome.exe	118
PID 820 wrote to memory of 2924	820	chrome.exe	119
PID 820 wrote to memory of 1104	820	chrome.exe	120
PID 820 wrote to memory of 2924	820	chrome.exe	119
PID 820 wrote to memory of 3672	820	chrome.exe	121
PID 820 wrote to memory of 3672	820	chrome.exe	121
PID 4384 wrote to memory of 4824	4384	Payload.exe	122
PID 4824 wrote to memory of 1064	4824	406d16b0f3af40ffb9541a4ab63306fc.exe	123
PID 4824 wrote to memory of 2276	4824	406d16b0f3af40ffb9541a4ab63306fc.exe	124
PID 4824 wrote to memory of 1252	4824	406d16b0f3af40ffb9541a4ab63306fc.exe	125
PID 820 wrote to memory of 980	820	chrome.exe	127
PID 1064 wrote to memory of 812	1064	MBR2.exe	128
PID 812 wrote to memory of 1512	812	MatrixMBR.exe	129
PID 812 wrote to memory of 2980	812	MatrixMBR.exe	130

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\406d16b0f3af40ffb9541a4ab63306fc.exe
  "C:\Users\Admin\AppData\Local\Temp\406d16b0f3af40ffb9541a4ab63306fc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:2980
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xf4,0x124,0x7ff9689cc728,0x7ff9689cc734,0x7ff9689cc740
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,342766568403275425,3199593898646663270,262144 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,13062691464297678222,9022022520762158965,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2464,i,10012580088593738312,1581160770357253485,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,528135004705564508,18072283432802138712,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,15355318849146792520,5377451511177121033,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,14548533954398859070,17829309130249152321,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4520 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,14418233673502270677,4505383010632796815,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,4710947939102986009,7108737341572348604,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,1644348311561347123,9482139909600094707,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,18376556039712396781,6100773675237452629,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5612,i,16367649878176193245,5805770770065902470,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4032,i,11857829231772961956,17438074512613787293,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,4128537574209148598,590454713890311631,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,15252426575788582973,11512553556414514511,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,4679919637152163740,1172647423757598604,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,12338052423420465545,4880195874903426109,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6116,i,14222630329700261518,2431631219891181987,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,13024213856504952341,1571500827068535239,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6220,i,18423753521839762815,8572242686784653286,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,8327660839893425367,17098637422657061436,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,5996222683931473325,12637805140163948371,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6724,i,11942936696839231449,18319616839365272138,524288 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4540,i,14157369511428146730,6040910535864064518,2097152 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6076,i,9140645223335430719,11330513295898223912,262144 --field-trial-handle=2080,i,4195924006629371876,18228865250009088921,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x49c
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c7ad8dc-231a-4504-b672-3dc8a0246ddd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2c7ad8dc-231a-4504-b672-3dc8a0246ddd.tmp
Size 270KB
SHA256 4ddbf0c9b2bb6aa47e80cae32d523e9924b8f1fdd50aa34811eb4906ae6273b0
MD5 f4ea0368143d6278b86c6eec8c0f3b2b
SHA1 007d6076da2ae1671a99e2cdf2029b37ee38d723
SHA512 ed852946bf90418def34aa3599fc6c40470e514244fff665f4000777dabefecbce13952b4c8243ca8af5ae60050acff931b50bd28c49c7abbc1c0d00f6853899
SSDEEP 6144:j3sqzGvzBd27+LSc+hFD+7t56OD9ZfSAppr8i:LqB+IPyFSXD9ZfS4+i
TLSH
T1D8441272BA4E48BB88FD864121177701CD6A9FC946C87E4C58C55FC6B28F89D4A33E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3efa4142-0812-4fb7-8782-9ab65700cfcd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3efa4142-0812-4fb7-8782-9ab65700cfcd.tmp
Size 12KB
SHA256 c206a4b79c7076034bba1de0d7f52b00123a7e629d998522cae95a2735f13a9f
MD5 5843c57b6f8b67e8e3ffb22c13e7c603
SHA1 2c3fa84fd3fb09e8b9cb3034e8573a92f44ad7ce
SHA512 f9301b4debde7d12e4ada743a375fe580bb8de73354d05c1d2820e88d4830d668194d8b5f969915ffb8f8c49542d83c50013c268934825c3426045cc6ad0c86f
SSDEEP 192:xROznpL0ArFE8Gvv7D0spAPRp2kGc9+Hsb+WNnGcN7Hc82Y6Hr3YkwUaZ6VyIsnH:xROzntPr0nvjUXdUwDH2XHzY0a88
TLSH
T11552D62EED20793B6CDBD22AF9167717D3F5102524942E88EAFC8A3C14D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

496769e2-32c2-43ea-acd0-41e330edd5b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\496769e2-32c2-43ea-acd0-41e330edd5b1.tmp
Size 13KB
SHA256 e51ee4dd57f255d6f97a9726c7d5a779c1df830b7655b1911f0466faf9ff0516
MD5 8288a8d3b604b40ef67dc8ed3265080a
SHA1 414bd273871a6b419a5f49c591826ec35ce5c87b
SHA512 4ca66806948fd29c8a314a3eb4f61f6abd12ece016fadc4f54666b7ef31cf3931593d1075848defb3da92117655799f4d190a68d5c8a79a26bb9ab9e61e0df28
SSDEEP 192:8ROvcBznpL0ArFE8MZvv7J0spAPRp23VMD9+Hsb+WNYxLVc+K0cH/A46Hr3YkwUd:8ROvmzntPrGnFjUXTUwiDOY3HzY0aDe
TLSH
T17252B52EE920693B6CDBD22AFD167717D3F5102520D42E98EAFCCA2C15D75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f6a9d9e-51e7-4b4f-85ba-4bdc122c0dc9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f6a9d9e-51e7-4b4f-85ba-4bdc122c0dc9.tmp
Size 14KB
SHA256 4580a9437e9623cce9619759067e34fa53b6c7cb59875c4e741866979301be26
MD5 596db9fe932a121435c4e91c1c50fae9
SHA1 67475b75588b5b47a17d71fd4b4c71718eb35c7b
SHA512 3d33f07422f2b0fe19ce3a578b595d5465574eba3926d79ab67afdf7d9a333111eec40a02f1d77460a153e199c93a15948fdef7613e1a2d969e44304e269639c
SSDEEP 192:8ROvcBznpL0ArFE8MZmv7J0spgPRpW3VMD9+Hsb+WNYxLVc+K0cH/A96Hr3YkwUz:8ROvmzntPrGSFjIXzUwiDOYsHzY0a3e
TLSH
T14252D62EE820693BACD7D22AFD16771BD3F5106520D42E98EAFCCA2C15E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 77KB
SHA256 cd5b9997fa362be16ddb41e19a029a16e7e114a67b46e9833ac0fa7b09c8d51f
MD5 3d4ac487074103ee43a5bf024eb8b068
SHA1 f7f6302e816f76b3843e351bcf7e1138ecaea1b1
SHA512 98527e717843ab3dc3cb5458dee78f63c087f52eddb12b94c376a27cc003a5c98801296726acc079113e74c8e5044f32f2f7358479503104686dabb17a90f25f
SSDEEP 1536:cuIOAq5It8HIZTg/jyJU30LEvnBSRj9gmasW5fQUrhCfTuqRJm:G7t8WTg/O+kLin4VuJUk
TLSH
T1FE730260014D5DABF124EE16827981C663D96BA9BF28F6DEE217032F30F8105A7DCC6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 388KB
SHA256 b7ccbfa90835f098561734c35e689802fe65614b99fd58405fd9f299a913cd72
MD5 6f15407ae730ad73c4b6f01842119eca
SHA1 52e82275453ed21138b6c65f25bce04ce79d3583
SHA512 f01ed208a8e9e45ce37b5aff48341cf0a61271cbf109107383c810e8dd98c954c0ed64e8404fc10c41e3a44aefe62527493555b7e398c6e096585a912257c5ef
SSDEEP 12288:zmKQHSO0KH+9tgcGZuLOdNJ/ECaC5rYpvn:iF1Hqtg5ZuLOHZhX58Zn
TLSH
T12C8423410AE33E81A334535A6D1D3CB0727D38A624FD2BA10386F950DCBE4ADE617B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 111KB
SHA256 fa409a1bf980add1242d20bfc8c2b3026bd9c712f9accabfc429467146eb1eb5
MD5 e5679827377bff7374347205fcff2081
SHA1 c211caffa6b83577aefc8cf67bcead5184a7534f
SHA512 eac0b010429356c75c05befc006447125eb0e1d9c5706f6a9ba5392428b70b2fc191f3a70c37e00fc16dfa6f4b37825a3407ae592c2d8aad0ea3167884fbed20
SSDEEP 3072:aRGYdZmN+PSILKI4WxUvEKOEP14GAs0Cogu8UJSQX:3KEsPSIL14cKOAPAs0CdVuX
TLSH
T1B6B313FA57DF213EE999371311039520226CFE3BD4324AB7B0A29C06905FA54E8DDFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 23KB
SHA256 02f6325f882759e2a34fac9202a6850ceb63b6a40dd3bd86906b9a8b9ea643c7
MD5 ccedf92af34b93ac813df5d3cd6d98c1
SHA1 96998bed7baba33dcbf9de8770fc805ede34199e
SHA512 e700b0219425fc806d27873944ccee67b839a25c2ab1eb5cb51e119bf11174f1b6e89b34e8bbf204b8fcdf7f96f3d13a4b4b33d07f74f16bf1f7fc2ef8677deb
SSDEEP 384:jVrOol+GBABuYxtJIMaW4lmTSsZIXkeXIHD6OCBDWL0Ti1zcpZbQWaWDS5:5rOo8QAUYpIthlmVI0HpGDwcqccWaWDS
TLSH
T108B2E0752FABBD5F1F814114803E8623E045B9E60CCDC6EB65FA8975CE2F318586D125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2f57b65dcff82fc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d2f57b65dcff82fc_0
Size 4KB
SHA256 ebc79103865550bd40e59f27938a602031f6db128c655cf0918ef3d6fb49ce52
MD5 6836b7bfe181bea1378fc1997b62d790
SHA1 12309c2f3f50d1de4b413c08996296d961826a7e
SHA512 503463ba1c11f64a0910867a382e80a78e74d58bbbf8aefbbe4b30235ec4e0b6f3e7dbf78f7f86670d81d790242af061659de53d13ee48edc95f632f45ab17ee
SSDEEP 96:dAkOIf3uNKV3PpKHL4udaadxLdu12ExyO6cyWoi4y2Enh:CJIPdpcawTu12SyoyWoi4y2E
TLSH
T10F913B7202617C5BFF628AF07D6AA4892DED50BB52CC917C38CDC2B4D5A480EDB09132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 8d679840370505c7aa8b4955fbccb6db02d2063bf43a8f6261b5ef943ff89fd4
MD5 640d8847efd28a686116e7330ac63b59
SHA1 73ff081aca53093c0c26586234dbf8427b849380
SHA512 3e529cc8f5cfba6efd2a10262a146b33221811416457673746b60efbead99e209108e881cff504b37b17e58cba9836883a4bbfca9cf33ddd5997d633530ea1e0
TLSH
T1D1018B4D9343E51EDBE881F538E1A01476DF834C119A7FC9F755483815D295D422E8C6
MD5 SHA1 SHA512 TLSH

Submit Download

067052ca-f2c7-47f7-8439-72793a0401dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\067052ca-f2c7-47f7-8439-72793a0401dd.tmp
Size 6KB
SHA256 e724d9ac341176a23a696d2a965bdc7cf8984a90861d6ac7861ff57584d8baee
MD5 bbae57dc2d7358162b655fbc4b5aa61e
SHA1 9363f30192df17c2305f0d3727a04c8bfaeec595
SHA512 a31a795fb4418bdb8e73e7d18bb8580203ed7a0d78e9c9c1d6d47440f8432dd63db53a0bdd736805a8edeb08c32ed5c9a010da698a0046b9f7c65d76b3258685
SSDEEP 192:DvSA7J4qcq0JHRaifUntVs/Q7mrSaPbvafPwNPl:DvSA7J4qcq0JHRaifUntVs/Q7mrSaDCU
TLSH
T194D18CF7C3D8862DC85156F49B216F1ECE2E1A28431C3D27C8D8AF4B93E2A71D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cf3e29d-2d0e-4218-ab4b-ad6187d3908d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5cf3e29d-2d0e-4218-ab4b-ad6187d3908d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dark_logo

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\dark_logo
Size 19KB
SHA256 2a75f05e036dff74335b5228ba2b9d2e2091bb2e8ec3d0408ed25340b19e7d8c
MD5 594e87479efc8462f43bb77f9cc54afe
SHA1 926b1cde3c97d71ff466657e9749e89a9c565a96
SHA512 d364182734800bc6aaead3716a676fd246f385cd2e423b9172cd4d1ae28b44334709f0eccbf95784b458d10fcb2ec8bbb3ce56562f37842154bc544c583f291e
SSDEEP 384:r1fZbLtZE45oRuuSW8MahLEOT8jPg/H7AApJMRnM6VTIjvWyFTxY7r5w9:n/D3oRVSYILbwg/0S+DTWWKxYG9
TLSH
T19792E17171B6D16B66F0E83260744ECD84BA219C0F0F5B7A18A69D0460FE61ADD4A1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 3f9a027f397064fb49b821f8e009f3edf75966884dd19d1000dee885677a79b2
MD5 be5c32c322029a722612b49bc11897e7
SHA1 879ed955cc36a2bfa3802ac27c6ab2284f212c45
SHA512 696ef997e5c90fc22fa183d6fa556f3db1afbd16cd0729ac261533fa2054885515a0de770d248184290f2cfaceff5475ec925f04797776d07ca3682e9963dd78
TLSH
T1B5B0120AC0462301C44503701162E0643260CF34F212138641E01D15C831165405F118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 c03161de199a4bd5387b943e9e0e37a49a72469e8e7efbd769cfb27171286fd4
MD5 ee6fe237f1ca97ae619615ab8d825db1
SHA1 98f0c8c84a0694502c4462e0539d2135f83fff86
SHA512 c36d4878e222da2546ea3b8416ea59aa489a14099750dee14c83dd8b732f9bed8e43e0872f20e1bc03427eb55becc2928a1ee70f7a825c579a6637a2ffceba87
TLSH
T194B00295C3027252C09203B036A9D6D8B562DF26CA2B1226A2E05F76DE27A754535160
MD5 SHA1 SHA512 TLSH

Submit Download

a23dae34-051f-4e51-ae98-f398b9809f76.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a23dae34-051f-4e51-ae98-f398b9809f76.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5c30ebf-e0e4-4fff-aee1-f7e564f22e80.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b5c30ebf-e0e4-4fff-aee1-f7e564f22e80.tmp
Size 414B
SHA256 96a57a0780d2df1ba5a4a7c690f14e2d231470f4b72341b462e4559b0a260d12
MD5 9223412aacbd8185dfe24e1331ab8982
SHA1 79ac0e9fa89fbc130c75b05e37e03dc69eeed995
SHA512 c5cd80713790edb5413a28b984a24e3926426c8fa875de100b70fe565f36cc8540afa23263842da7692bb78d9cc07c888d5bd869545fd53260f1f748f85f096b
TLSH
T168E02BE9CC22EC3718FD176964140349E74013572780850F3A3C951C8FB067B45C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

bfa4f46e-8823-468b-8410-94764a5f34cb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bfa4f46e-8823-468b-8410-94764a5f34cb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e16bb785-1a21-4f30-9859-ae4b366f1849.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e16bb785-1a21-4f30-9859-ae4b366f1849.tmp
Size 269KB
SHA256 bfeef86cff1080589a1f108fdd92cff170c7c0cce7bb33655f1aee697fa2f3f4
MD5 41f2cb415927e760df42ee21bd64a02b
SHA1 67a533a75fec27aee34471792830bc606f33f90c
SHA512 acfb7e98fa1e8fed9247e7ff92475841bed09bab4214af973da2e2689bf44c4f9d9a1ecd79a876502422df00c9096f677d9ddbef33c2f888cd07083d12c74580
SSDEEP 6144:CsqzGvzBd27+LSc+hFD+7t56OD9ZfSAppr8i:iqB+IPyFSXD9ZfS4+i
TLSH
T127441373B64E54BB88FD924121276B05C96E9EC806C87A4848C24FD6B28FD9D4737F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e73b3e95-76c7-4c6d-856e-660a436e5801.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e73b3e95-76c7-4c6d-856e-660a436e5801.tmp
Size 269KB
SHA256 4143ad699583b954f7bd6867383b30c281a67a05caeb51ed0accaabc8e338cfa
MD5 8d5655c1767c48dfb6f4564fffffe149
SHA1 d6dc04b059e3b5ae6e191fe036d5c9c7a3f26dc5
SHA512 349056e10225a26a6ec4856a5c2f951daa553341c416ab67ef670441365e9f93446a333987d3bb96b3f6657180306c5456ce050990cc14b53aeb987ac0a1973a
SSDEEP 6144:9sqzGvzBd27+LSc+hFD+7t56OD9ZfSAppr8i:RqB+IPyFSXD9ZfS4+i
TLSH
T16D441373B64E54BB88FD924121276B05C96E9EC806C87A4848C24FD6B28FD9D4737F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f47400e8-7360-4705-afd2-04b2a9c83941.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f47400e8-7360-4705-afd2-04b2a9c83941.tmp
Size 130KB
SHA256 46c47d69074046fddd415bb0bf0e9b2af0d25497a32754c5c028833821ca001c
MD5 4352946896838751e80a20c5cdfaacc3
SHA1 d8c1f081896f193e867bb4832e49b6df5883b247
SHA512 1c60f4b2ef91f8eef34064a591100abdd0c0ef4c2b55bb1e185693e6baae3a3f1e31c13411e6a17fbc0197d91e3158312030b76e7d57b313fe3ad778ec6cc292
SSDEEP 3072:s+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:s+hFD+7t56OD9ZfSAppry
TLSH
T12FD31232AA51C8BBC9BC6541B157A300CE666CED41EE7A09444A5F8EE09FC4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

406d16b0f3af40ffb9541a4ab63306fc.exe

Path C:\Users\Admin\AppData\Local\Temp\406d16b0f3af40ffb9541a4ab63306fc.exe
Size 921KB
SHA256 deaf30953149d0bef45a11bd89f4ef69f77115e50380c7ef3607c37ff4f40a1d
MD5 03c3e9290329eec39c6543006f9ac9f1
SHA1 78e676fc850fb5d4e1c75b813f15b841fdf7705d
SHA512 b2c5b1b060a0349bc92cc5a8b286f149b5cf6b40264e7b613b76c911e4acc6352ed0fdd9d945fae9c025963cae02f3f2cbef8a62bff844764a66481119c6321d
SSDEEP 24576:QCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATg:1F+LL+fIWybB8
TLSH
T13B15239832772A1FCCE72737E5E739A463AE323D0937229D04A5F37D1E415C05726AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/812-333-0x0000000000D60000-0x0000000000DA6000-memory.dmp

Download

memory/1064-302-0x0000000000110000-0x000000000014A000-memory.dmp

Download

memory/1252-337-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1512-358-0x0000000000C90000-0x0000000000C98000-memory.dmp

Download

memory/2276-318-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/2276-319-0x0000000005140000-0x000000000514A000-memory.dmp

Download

memory/2276-317-0x0000000005730000-0x0000000005CD4000-memory.dmp

Download

memory/2276-316-0x00000000007E0000-0x0000000000898000-memory.dmp

Download

memory/4384-221-0x0000000075130000-0x00000000756E1000-memory.dmp

Download

memory/4384-230-0x0000000075130000-0x00000000756E1000-memory.dmp

Download

memory/4384-0-0x00000000012D0000-0x00000000012E0000-memory.dmp

Download

memory/4384-220-0x0000000075130000-0x00000000756E1000-memory.dmp

Download

memory/4384-65-0x0000000075132000-0x0000000075134000-memory.dmp

Download

memory/4384-231-0x0000000075130000-0x00000000756E1000-memory.dmp

Download

memory/4384-52-0x00000000012D0000-0x00000000012E0000-memory.dmp

Download

memory/4384-1-0x0000000075132000-0x0000000075134000-memory.dmp

Download

memory/4824-279-0x0000000000160000-0x000000000024C000-memory.dmp

Download

memory/4824-280-0x000000001AF00000-0x000000001AFE4000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads