njrat | 282fa168e8142d2fad5ad2624f0469386f7d7271e4b3a4f3dc9463cf9cbf979a

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
119s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Payload.exe
Size 55KB
Sample261031-psc68ahd87
SHA256 282fa168e8142d2fad5ad2624f0469386f7d7271e4b3a4f3dc9463cf9cbf979a
MD5 661214919a5b94ad7912f55c298e658b
SHA1 925e26bdca262501a95adeedb0994b0a587b4dce
SHA512 8d97886e4ad930bdd65adae82a30378b6ce821a9be58187abfe3d1d3daa3bd87fd9d1c03849731ab2fa4e5bcaceb85cad84f25a47b04cf191e371076a9ff5ed9
SSDEEP 1536:XF+dIDnrNZtLy9CIDKwsNMDFXExI3pmem:V4IDnRekIDKwsNMDFXExI3pm
TLSH
T1F3431844BFEA4A01E2BD8F3468F655150A34AA23F532EB1F48D568DB17327C58C80FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery njrat persistence trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Payload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	21258ddde9884fed887434ac0f107f62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	MBR2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	MatrixMBR.exe

Executes dropped EXE 7 IoCs

pid	Process
5728	21258ddde9884fed887434ac0f107f62.exe
4664	MBR2.exe
2692	TROLL5.exe
2964	TROLL2.exe
404	MatrixMBR.exe
1824	GDI.exe
1040	MBR.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\MatrixMBR.exe	MBR2.exe
File opened for modification	C:\Windows\System32\MatrixMBR.exe	MBR2.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Payload.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{6DE989C6-BB29-4948-85E9-CAB89885B1A9}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
448	Payload.exe
2668	chrome.exe
2668	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeDebugPrivilege	448	Payload.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: 33	448	Payload.exe
Token: SeIncBasePriorityPrivilege	448	Payload.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: 33	448	Payload.exe
Token: SeIncBasePriorityPrivilege	448	Payload.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: 33	448	Payload.exe
Token: SeIncBasePriorityPrivilege	448	Payload.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3388	2668	chrome.exe	88
PID 2668 wrote to memory of 3360	2668	chrome.exe	89
PID 2668 wrote to memory of 1772	2668	chrome.exe	90
PID 2668 wrote to memory of 1772	2668	chrome.exe	90
PID 2668 wrote to memory of 1248	2668	chrome.exe	91
PID 2668 wrote to memory of 1248	2668	chrome.exe	91
PID 2668 wrote to memory of 3860	2668	chrome.exe	93
PID 2668 wrote to memory of 3860	2668	chrome.exe	93
PID 2668 wrote to memory of 5460	2668	chrome.exe	94
PID 2668 wrote to memory of 5460	2668	chrome.exe	94
PID 2668 wrote to memory of 6132	2668	chrome.exe	95
PID 2668 wrote to memory of 6132	2668	chrome.exe	95
PID 2668 wrote to memory of 3436	2668	chrome.exe	96
PID 2668 wrote to memory of 3436	2668	chrome.exe	96
PID 2668 wrote to memory of 5336	2668	chrome.exe	98
PID 2668 wrote to memory of 1668	2668	chrome.exe	102
PID 2668 wrote to memory of 1668	2668	chrome.exe	102
PID 2668 wrote to memory of 5744	2668	chrome.exe	106
PID 2668 wrote to memory of 5744	2668	chrome.exe	106
PID 2668 wrote to memory of 6036	2668	chrome.exe	109
PID 2668 wrote to memory of 6036	2668	chrome.exe	109
PID 2668 wrote to memory of 3588	2668	chrome.exe	113
PID 2668 wrote to memory of 3588	2668	chrome.exe	113
PID 2668 wrote to memory of 4364	2668	chrome.exe	114
PID 2668 wrote to memory of 4844	2668	chrome.exe	117
PID 2668 wrote to memory of 2596	2668	chrome.exe	118
PID 2668 wrote to memory of 5312	2668	chrome.exe	119
PID 2668 wrote to memory of 5336	2668	chrome.exe	120
PID 2668 wrote to memory of 5336	2668	chrome.exe	120
PID 448 wrote to memory of 5728	448	Payload.exe	124
PID 5728 wrote to memory of 4664	5728	21258ddde9884fed887434ac0f107f62.exe	125
PID 5728 wrote to memory of 2692	5728	21258ddde9884fed887434ac0f107f62.exe	126
PID 5728 wrote to memory of 2964	5728	21258ddde9884fed887434ac0f107f62.exe	127
PID 4664 wrote to memory of 404	4664	MBR2.exe	129
PID 404 wrote to memory of 1824	404	MatrixMBR.exe	130
PID 404 wrote to memory of 1040	404	MatrixMBR.exe	131

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\21258ddde9884fed887434ac0f107f62.exe
  "C:\Users\Admin\AppData\Local\Temp\21258ddde9884fed887434ac0f107f62.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:1040
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe6a83c728,0x7ffe6a83c734,0x7ffe6a83c740
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,7864593375891050675,382233264666864983,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,16973497225908135932,2140656303016163246,262144 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,6081476550714521187,4278944658998976488,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,5073299066620320307,6506581547171675601,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=1768,i,10197427917390672597,10306328912107094380,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,4644214220546621908,877208349422369204,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3968 /prefetch:2
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,4390261741022172545,8445400386699908370,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,18209820126448730132,848950112909870213,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5556,i,16604011235633676862,3437029301891825894,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3392,i,16960594987942520442,3909993396342262122,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3484,i,9390314343396391481,1022522201031726218,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,12099679609033784898,17262194333948993765,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,9314979187748329651,9144818328409601596,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,8196323323218256553,1166105199819879631,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,10284752751412482341,5485788260693852495,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,11255641287979834408,10549536939819885511,524288 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6164,i,4204286436461236272,15533784090650580713,2097152 --field-trial-handle=2080,i,4031680845151238043,8503778824592707192,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x410
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9e41b6e6-9186-46a8-9424-3e4fca16641b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9e41b6e6-9186-46a8-9424-3e4fca16641b.tmp
Size 270KB
SHA256 88199dbf3f6dcc7ef82edd4be6fb622abcfc65e013a54e9e50367749c0a2fc3c
MD5 49f96e29d9833dec6b12d4b8daf29c43
SHA1 3e25b67ac54fb8462f8ddbf24134ecfaaae89c5b
SHA512 4d4fc4cd1e0ae11bf3ed0266e7d56fe0e0dfe17540611888c83b2fb739a9e909f9d290a0800ca60ae61f6f38bcbcfbc1210bf625dd18702cb01160298e903fbf
SSDEEP 6144:BzfCHCm1cB8O+NMTVsUi+903/99mtP+hFD+7t56OD9ZfSApprB:pCHpGaUi60FYhyFSXD9ZfS4D
TLSH
T1D6442321AE5A39B7C3BC52825C9BD7118AE2E8E94196ED8851840FDB104FECD0717F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c64b4c0-3e7e-41c6-b9dc-772b6e819cf2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1c64b4c0-3e7e-41c6-b9dc-772b6e819cf2.tmp
Size 414B
SHA256 bbd450b2af5c421a0437cac25b0ed8ce05ba53b5facdf06fe983760e3103fbe8
MD5 ba98646ec38a671d1459118a29a8fbc4
SHA1 3eb48bb9dd92b25d475f4759a4092b5e297f7813
SHA512 c2b3518df710e5de1e895bca54778d686095e255b48c3eb174941ada7ec68f2d88740a0b5359d604012d54f730ec28762e886ee3a642073ee8896fc01bf52633
TLSH
T1CDE0E5F6C862BC7B18FD6A2E50108B87E645135A2781851B3A3D410A8F78A36418581C
MD5 SHA1 SHA512 TLSH

Submit Download

218d2122-2642-4bc4-9e9e-1425979b4e7d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\218d2122-2642-4bc4-9e9e-1425979b4e7d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6961cf37-3085-43d2-9d13-c8f27587a79f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6961cf37-3085-43d2-9d13-c8f27587a79f.tmp
Size 13KB
SHA256 dd72a9cfea30f6fdd2b65274342d3ce46262f2f69c77c6281357df5d8d99eda7
MD5 1f543d0e55ddc9e0a3794689df6eabca
SHA1 01b5b22b8c086df4e8d64d5648a70670cd235be3
SHA512 74d05259c2edc54070fc432ef4d0724d616923ca01d4b1c6e1feb4e1861c2ab59d29abfbd951bf07742dc0e3857c2a5b206aa31ccb179a1af491af1ae7cfe5d8
SSDEEP 192:IRjkcBz9pQ5Wh3qv7npAPRp2oftNWbMoS96Hsb+WNnIHocD73c8U4cj2Im2yDn7W:IRjkmz9Wgm7UXy5SswmvX82f2yp8
TLSH
T11352C72AB9107D3B5CE7E329F912776BD7F1106924942D80EAFC893C14E7ACD6217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

805745b6-3afc-4b5e-ba36-b9bfbc52f858.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\805745b6-3afc-4b5e-ba36-b9bfbc52f858.tmp
Size 14KB
SHA256 901b010daeb6ea274c61fe3c7a80ab66d9e0f2d9f359db170ce9e4e457d4fb6d
MD5 db075d43da853135c6d4559ac8b0abcf
SHA1 067de6deb60cd5cce92ae39f459e38fd005df7ba
SHA512 08e11ffa2f4263569d5ba08568253ce4d864b099637c774638438af5579c8d8c2c67bf5f1a82e3d92af8cb1d16f75e4f0c123b8461c21c1f20f03a0d625df72f
SSDEEP 192:IRjkcBz9pQ5Wh31v7np1PRpEoftNWbMoS96Hsb+WNnIHocD73c8UtcV4Ym2yDnUM:IRjkmz9WgF7rXM5SswmvXT4P2y8e
TLSH
T17762B62AB9102D7B9CE7E229F912776BD3F1207524D02E94EAFC893C24E76CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

918571fd-999d-4ca1-9042-34dc6f559b5e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\918571fd-999d-4ca1-9042-34dc6f559b5e.tmp
Size 13KB
SHA256 f7afe1c07de63b6c5e7b1c237a51113f0f0a0fcb812ff4fee04e27e5ec7e6e9b
MD5 53a71ccba7676ec8180c42695a07cbcb
SHA1 4bd7a9d6b175a7d1c0811e7c5ea67d5e93690f13
SHA512 2d241f424ef880586a6bc7643a0f8db00146b254eddca7e402bfafc2e2b6bf157aac27a9a5eb8777f854511c3f596a7458a1fb06932351c639975b86797180ac
SSDEEP 192:IRjkcBz9pQ5Wh3qv7GpAPRp2DAbS96Hsb+WNnHocD73c82Pm2yDn7VyIsnAUgtaJ:IRjkmz9WgmCUXfSswHvX2O2yp8
TLSH
T18A52B52EBD10793B5CD7E32AE9127B67D7F1106624942E80EAFC893C14E79CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 20KB
SHA256 85d26115281299a69682eea212327e5520eb2a0290459f7c643c811416e94f4a
MD5 c9afc5cb2c438aa9bebab66fa5920925
SHA1 ee405ac8edf97ec6bfdf61d2a5d453234c2dcbab
SHA512 ae37824a9169781bdcc8b6785a212679784776b74304a8ee47c24925e4dcf53f8c586580fed5076c47fcf67eddaf7fc0c4e3218b8aa3553c311885b0edbf1026
SSDEEP 384:LS0gHCe22RHDnRt1Ssk3oZuNugmk1rfp89VSL/ypx1CKBuStS/Ixxr+xOG:Lk2Ij5Ss84G1V89EOtLBlSQel
TLSH
T1F4A2D0CDAB7987BE34165005E664868AC94CC6C29F6FE02B01EB7E85C978638F5460B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 1.9MB
SHA256 e508fbc6a057e221b03d2d3d1863ac2127c368ff7adfea2bd212977fdfa91c30
MD5 f16d269d08aa7a6c9288e01a4f196e4f
SHA1 9d19350c5aa0d0bda20cb524293833cb34d4c827
SHA512 6dc88061e368a96e7b52867887c42c01ecf516329e04210e8611fd955e08e9e026055bbaca4e96d7c504c4790cccd2094f659bed2a7165bb8aa9778d472dde5b
SSDEEP 24576:XqCwRwfUfWbcSGgzssDulOPoDhAaSJbuopKIXj9qH4kca8zDaU9L1VNF7kANDydY:XqC/skiCDPoDCaSd0Yio+U9xVsJKtg3w
TLSH
T1289533B44F00813D0C6AF99B0DBC1D8C36E366F43BA5F655620DA83F9C5D52DE96ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 296KB
SHA256 c1a12912ae8a27da4acd761ed6588d5f36d911585887ff40eac0f3b381a450dd
MD5 ec11ace868ba89fbf5a54532792f0b5d
SHA1 614cf9b013f4f0c62290755a44721ce3403f0b5c
SHA512 de41f5ec01cbc0dcac311d58cceaa6fd9fa2e443b55ca11dca4a7a899e49cd04a913f0cf1f9019ee23aa1f41711a865dcafcb203e942400233023332ea46810e
SSDEEP 6144:IIpUfP526Tvijei8E/Wp4NSatyEbJrUPHMx5:IIGPO6M5NSKbBa6
TLSH
T1DE54238EE34E2DCA9CD081B37A2F56DA17712A387350EEE45EB355D0923530893CE676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 57KB
SHA256 262fbb6a998c701f2ccd09c96916da33dea03584ea2ac691870381a30ef46d7a
MD5 aff57e752c324104a6e3a875233e8c44
SHA1 15811718d655f98a1bbde15c5ac679d2056c6552
SHA512 886c52b702081dd1eb5f91f6f4b2045493616cfea8b61e2464d0b02549d910a2f8a7e894b373b8eb781af2b298a82e2b541c6e9bf8b7b8ea74c1077834b1beea
SSDEEP 1536:sG/pPR3NIcMu3kEDliyJ0rTNGiKbBrNgMvw8a:DZRdILMDwyCfNGXbBuMvBa
TLSH
T18143F10621AE10ACA8D7BDF5582FCF843627635451FE92711787C2F376CB7AA642C2B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 681KB
SHA256 8cdd7eb637141293c1ad365d8f9717c628ddb07733e204a13f65b107e8764829
MD5 0c5591b1976d09269ce2d909165970ea
SHA1 e44830ed258c285c2523a82cb9febd7d272ae9c8
SHA512 5c2013ae7cafbe1769c5c9bdf4078d813649d4d71312a6a308971d4d7f49580e4cd38d0f8aa12296fce8035b9c67bab32ea24fe8fe6d0c8116f4a945e9d753fa
SSDEEP 12288:RD9DzdRX/fGktJrSmBEHRhK3yOaOQqmfooMUBIP27PBpo4v:h1dl/uw1xCh0ZaOQDff7PBt
TLSH
T195E423621E447A9B094ABF30E8EAF98B151349F572AD8DDFF48D1C9AF27129311087D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 22KB
SHA256 3c0e09122cefeefe058dbda61971552a5195d579b6ac16f878b1e7a12d31cd18
MD5 388b3cffed6e12c8b42cf6b25fedc107
SHA1 38ff3845f75ebb54067058db667919d0acbe3c55
SHA512 337604e386a5d77638c1b52d06bb617596b82d9a7afb9479bcd794423d4e5237f896a5a5a6eae8b75469e46c902d465a209bda77518502d4cccb9d14ed4f0875
SSDEEP 384:LBH6qNPHpZexxlDPfC30EO2Vh7LtPlp2OwhH2GG0D3eR3399NvAD:96mHpZEekd277LtPr2GdkS3Nf4D
TLSH
T12BA2E1D85A0F062423E6C061C5E91F90F8E5DE96CF35CABD9C3D6403E35A4A53DB26B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 33KB
SHA256 ad7cf04d2df32fb7d6d59f197e811518b16db814b447c3b28b62dacfd59be463
MD5 00d225478e05cfcf9fc0516122c43a31
SHA1 102f7b94c44606e2b14a7fb46c9bbf1ca61c92c0
SHA512 a111f8c013b5a9275f07f5723fc09b2f36cc57e4b333ad1d78c5c0fc30ac6c8c48a60c9b8aa08240b8360317a84dd416a64d71445d0ef6744d81ad002272f733
SSDEEP 768:nkzaXo5cD4Qx0dOfEbYEdL4LwCjuLRL5SIhH3lNj6rZKEDjW:ngcH0dOEbRRNLIIF6r5DC
TLSH
T186F2E13BBA7B9914D41F203ADC201BDC7DAF14AB9B71E17D8886D232ED26154853771C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 46KB
SHA256 b5b4f6fda2d484adb86369dd2f986b184205ef58d3cfe655c45e16a8278c64a8
MD5 0056d33153fa2fdfdeb0bed825d494f0
SHA1 d68b3fc2a4913d372326e797e91a49a6052183c3
SHA512 0d9fa54d3d7d52eafcdf2b25a80340d94d608b014fa873d81db0837f633edd6c1c5fd7aa70d3a2345dc5c05a8bcfa328b5d20337f90003ced8a458c3e2cf3f82
SSDEEP 768:+PbAcjmWowUpOphrRiNmLFGLG8o7tWobveeonDBqpKx0Up/HsY/CqnstuPid3YHA:+PbABWo7ChrRLGa8KWobUDYpKx0UEgWL
TLSH
T1E1230247ACC075E29D43CBA7C39FA88AFE1B65ADF986F00C0441148456B4B1ADE1BE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 672B
SHA256 7f69932616b9097b9299a2d48cdcb35f702608b4a974d0ad4a6eab89e1350611
MD5 24470f19dd092309c04420f9ea637c81
SHA1 c6eef66dd58dd66d2bba15bbf4062e84e2e3cd44
SHA512 dead9b8c7c76c71ed2429b86c7b8edc3cf0f37d66e1443db371a9ddfe47668da6bc9cd76676e0527d202e5732fde4aac3f6b1b4289cc03dd41bc1da4a13fb951
TLSH
T15C010EE09AD430C8DFC81D3404B23F4CF193024BC2AF138785E0B4F4B2232D00A16D59
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 191KB
SHA256 9e32c94ba1f356b3ef62b17ba559bcaeff4b4ef5c65e129a48db98f5eb444a72
MD5 23a7d19c78370fcaad4616d293356f82
SHA1 b125936994a9308e630c86a0f3cf1a59fbc44a5a
SHA512 8228082b4181d5b390eccd8217783510aac746f13d3be71db719785777a765cc0f26851c631cda7b23387284773b41c6934f1462ec37c6a0c1630d36f88e3fe3
SSDEEP 3072:77rzOz81KKXmZizIV4bwfzfdo8OukGO2M6Sdo/LA5ow5BvU:wZZ7A8
TLSH
T12E140A06919252C8F43F83B3164A5E27D335A9C8A6C8B05AB5E17B0E3AF7B503F5171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 8608c29f5cac871a8dc1f25d0d8bf66c7ed9d08ff3b6d2ccd32662f27f59e007
MD5 403d03d5751777125b9d60eb8f812977
SHA1 1424d5cd75348e751d63a64e69a15d907c1096c0
SHA512 424646793283935196134f4b2374c3bb280252d4c93588321485184ee0eff99f6ddd40929f7b407065f0fec664a8b6456c43a25ce40a24cf88288e36b958d7ad
TLSH
T1C8E0262899DAC36F206880EB25307B0FDFEA451CDBCDBD9A5F86D52470CDC4C98AC260
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

0f7b800b-60c7-4a8e-af6f-a991e1a861ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0f7b800b-60c7-4a8e-af6f-a991e1a861ef.tmp
Size 11KB
SHA256 2dda18b07c1973f276b392e860bb1c60ac93b4a99e768b7b7c39755d8768b3dc
MD5 5fea0dedbeccfddad97406e234d20f14
SHA1 00f12a62c6bb490028f056b6becf28d201d24063
SHA512 55ded77fd986df701790891f552a81d2a14aaf1036208e07d019498dcf51ab8009d6a645e42290755ad36ff29fd0514188ae0c3086ec6213e40b59ac25a4e8e1
SSDEEP 192:DoPtGUeSP+akW7eKeJzJOJVJ8etuaIadWijfI0Lh98U2rikPjAWOjDW4WCGV6viQ:DoPtGUeSPNkW7eKGF2j8etuaIadWijfJ
TLSH
T11442BDF7C3D4822DD82156F4DA193E1FDE2D1E2487283C2AD9D5AE4BA3E9171E34064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f1b0d39-f044-46b0-a412-56497f5eee4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9f1b0d39-f044-46b0-a412-56497f5eee4f.tmp
Size 1KB
SHA256 e1c3545af82275509471f82fb6ea561e65206d733eb8cece20f91d9e5c847d43
MD5 365943e11947c699c9fafe29a3e03de7
SHA1 b54f6bbb9e42c50cece771794f6762fdf1f982c5
SHA512 c94890b926ba98985807cef0330ae2086751f9c9796e6737fe89e7cab9d27d96c60a65aa27378bc1f4df727bd1c5f142e3533d77be36bb1184c64f67b371f630
TLSH
T16F417AB3C3D89B7DC90166F8AB256F1ACD690A15521C3C16D8E8AE1F53E2CF2D34024E
MD5 SHA1 SHA512 TLSH

Submit Download

d173afe6-0344-4c1d-91ee-0fae96bcf2e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d173afe6-0344-4c1d-91ee-0fae96bcf2e1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0e7dc979-78a5-4112-b392-39c748bb1ab4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a0476ce3-d817-4cba-b296-8c7d054a4b36\index-dir\temp-index
Size 552B
SHA256 795dc289dd977fea1b08b23a9716ef8d2e7ab62b3646bbeb278851da0c972783
MD5 165356dc3c44f8d0a24e308016fc574b
SHA1 52689b3db0d6df974e85db933521ce499cb1e95c
SHA512 c08a3beb4ee115ba0f22b827e33808abe442fa83af55cf3ffb6b2eb36996e87718304606b561620d8293964c9703aeed7941835372b0dee23a4e3b5c188e8681
TLSH
T1B4F0F14AD1B8055EDE0C08716C732404BA687F4F920507F750E468B5E94F6194C38800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a0476ce3-d817-4cba-b296-8c7d054a4b36\index-dir\the-real-index
Size 48B
SHA256 7570e1b94e476e05a7307e1fc50f94a0e92ed66937024203743cbcd4da74867d
MD5 7b9f8ed18bf996d145fb0b00ee7d2deb
SHA1 8b6c21ffcfcf8e7c9eb4d8d6d268f57c8e4e501d
SHA512 0ba9685ea7e8e1c873cfb5ae94f4833e6fb678e1ed2a04458872224de340bdda75c8b2edd949816fb2734b38d9d0ccacaa2362f321212eeb4d3c75f037095489
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c7233e9e-c9c0-4bb7-a61d-1eba28873176\index-dir\temp-index
Size 2KB
SHA256 8c0f4ffb3974a71f9dc4db8b16ea8313368f61ac987ce1b0ef7a3c68f769f77d
MD5 1e1f24c341db4511fdbba21e98d98307
SHA1 a3d1227734b740153d62a34b0a1282514b912cb3
SHA512 fac8dd4a3d01591a7522719e0d51f5d566768ea7e56531ca83887c4b6ee3bcd502654818c9bb1f5a6b4e8d0c6cf1abbc9d697881cc513870e60ef821e4471801
TLSH
T13551628CCD80ABAEECB150FD2D9819B263752C28FC55839281A8F1B534532B81B479FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c7233e9e-c9c0-4bb7-a61d-1eba28873176\index-dir\the-real-index
Size 48B
SHA256 4e6368331e75674c55784af222dfe550187357bf08f39a0a658cb66331a8aff9
MD5 706c539b21309c787ca5ab6f70c5982d
SHA1 bd97ccc9cf5c4b9c5da95d110e40ddaaf32a0f5a
SHA512 2b135cebcbb462fa2d19f8fcfc79d6eb19b8c0199de4740f74e622419953b20b12a91cd049dd26726195b6bc0c26d1188cca9c1658d05c786c68d46839e862ad
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 8854e60a41b34ad3e248e079fd511faef0c64950c25c9a824e2eb6313faa67e1
MD5 1e8057148b93459053d74887cb5c9fe6
SHA1 61884d94d92010e883ace325561b96f697359c74
SHA512 c7f7308a7ea6f215d1a59d028181cce565cdd5b2faa89af612d2c7129fa600ff462b5b68266de16ad7d0c711317d654e686a66c5556cbccbe6290b403c48b846
TLSH
T15FC04CD7992646964A31AA846038665EA75A8D4988C4C8E46149B401B138A1B8801A66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 5a46c2f2379320dca7da627d0634ffd9f1fc3ccf0ef98b3f9d2210d62a18f2fa
MD5 528d801cf54cf8efe4d217433c0ea8e9
SHA1 e350923a3376337268f1dae398c3f15c014dd268
SHA512 a5b3c82a181f8e54bfdf5681ec93a4407d85ed0ec32bdfc592e92ecbf75f9c096db331a4f73549a8d6b856415fb9d7142e6fb1d4bb86a65a23dfcac05532ee77
TLSH
T18AD0A7CED5328E1617359F842138111E9215CD09C5C8C8A4644CB092B1B8606C801A76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 9d03022b9141b173221f5bec9094397a0b1d950c89574a6be8c34b8c4d4160fe
MD5 b84dcfbbd9d157f3d3a3749c9bce2939
SHA1 f5f7d56d2c65b27212b9a23ea69b67dd232f090d
SHA512 ddaa437ff8db6cf26354a3fa8ffdfc5046de94e28144469fa3c1f09fe8c9eaa07a310d75923e0d41b7c2fe881568daaed4e92d86c2f7a5bfb3f8f36f886e2cdb
TLSH
T1C4C09BD799164A564935EFC83038671EE35FC64DC5C8CCF4614C9402F138A1B4C01E76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 243B
SHA256 4a4251993a34bdb8e4180477ebeeb509ad62e61f25d439a564cb6635536e5e28
MD5 e808daaf6afd7a5c481e156a9c58686c
SHA1 43033140329d6f3e939c1ce6b87ccd53316444c2
SHA512 e6c38991841ed6625f74a07ef09302c8452856ab4ab204644505c7a82fb5b41f964a8f321c7da870a521ebfd52e1a3f500d5ae34eda7ad3df02dc762743bdacd
TLSH
T15FD05E87A956424749355EC43034A16D925F9D49CDC6CCA85648B010B278A1AC811F25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 390B
SHA256 d0faf4fc59f4aae2b4c96cebe047cbdeb43d55c272139da9f929ba93070c58cb
MD5 5680d7a31a1756c3c0695f678097a38e
SHA1 efa5d44c3b92a2f0d4d502600a39bb36dbeaece4
SHA512 08d2ef59817e9557a436ef7de5f1e848c8a6098c930f9bc59c6b58da90940cd29b5a85b8cd0dc3b2615dceb57e23c7ee729a52cedd8d25886164bdc19dd2c9b9
TLSH
T1BFE06802ED57040DDC734FA03830A56B97FF990F8C8ACCA8664C6014F57461E9802F26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 383B
SHA256 f894f58bf687a77d952a83d6bb6522d6f864af8320610edc3e1034c2b29f2d07
MD5 936cf98874da94ea65a55428699d2e56
SHA1 128a607129b5e12aa30c452daa464d6c56200e2a
SHA512 1a800089d52c3779388d4a48f43af5773c0226ef4f5578c657b47f900f4ac73081eac7ddf726745b8761cea3468eaabbe2f6b7a6de0d580b0f73fea4817734bb
TLSH
T1F2E06842ED97040EDC738FA03830A17A97AF954E8C4ACCE866484014F13471EA803F27
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 168B
SHA256 24452cbd0d6cbe4f676ea3a0cac552b45a65a344b586c51f0ec87b72bcd16419
MD5 e184a40159760ec360fb328d89bae286
SHA1 07735612e751d6776b5c13263e7366a3e881723e
SHA512 3affb822a4acae7c71814401d15b39c7e6f9c9023c5f7f1be5893f653788cca0badd704b94580831f9408035d7ee4b77403156618306dcac06fe4aa867a92b72
TLSH
T153C02B05C0012200C28503F005B0A0A832316E64C30F131201F0281E5837270812B114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 c1bfe38d24a51a0cfc3cdcc9fa05464c4a8d69769935245c40fade584027c752
MD5 7c98a0bec3fb4e02a4eadb5fc088f3d7
SHA1 1f0791d30ffeb2c8d44743ee220e730af8830e34
SHA512 53916f53b5cfe7c8ad2a3249156270f2e91508c2d95ee3857db53f4f8472c1ef784b0669f8e67fc45dfc1c1552463f0e91f516e4265a2cec4c1610392a102525
TLSH
T109B00259C9126212C49213B0399795DC7170DF35C753139A93E01BB6DD2AEA04725560
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons Maskable\192.png
Size 2KB
SHA256 e38c817644be45d52a86cbd54bbb93d6a8eb48f235247336f634d99833ba6236
MD5 5da9741a0c59eb94fdb2294873d36c93
SHA1 edbdd46c522579b44f3feab65fceb75f8cabe108
SHA512 cae22d835be04790cd3ec818c33f17d7f79aeeb18f3dffa4e013cbd93c848e098d5c865579538d0b8ef5e85d696ec0474d3d35c65465e00039886fc3b9d76f7f
TLSH
T11D5160528E43A48F95D61189AD0AD395283FA9F772989E400DD0487C4BB1F72F0BE4C1
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons Maskable\512.png
Size 7KB
SHA256 5cf3c46ba4fb97d3c33a2f0fb6fcf21e80f806b0efaa37d4c0b093fb5d06b515
MD5 8c3ebdba674edb75ac6e781b49b385f0
SHA1 3e675d9c54ca020fe7024011c26672dded81ffee
SHA512 13cd044f3e07d507a4638db1e1c768eeaf27e8eb9dfe6ab89ff1c7f8466b948813a9842ecbb150a3dd4331a796d60eb43b13d2c0c351769641aafb22b38ca066
SSDEEP 192:1RK1l8wmf7eYldMKJjx/hUZkEzvJkwGLA:DFWUDTZPEzGZLA
TLSH
T117F14A4C6AD084E556A8D24F8036C4D646D849DAEEEF9FA1708090ED2E3B71ACE74F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons Monochrome\32.png
Size 414B
SHA256 9ab81c6c525db346f436b28dedbd230871b83e44b3d1cbbb3799060302d6f5be
MD5 0e75ba937761d9ac2cf74fe8cfb7ddae
SHA1 00d57da0fdb6e82f5fea7d8bb2e4da16647bf33e
SHA512 4d52759c3063b3ee921cb5ce44a7f49d27b2aaba83fb03decb6d7f06da4325c59be6d40d63d9adeb9af93e2481ca747e7bfbe1cee5303d6e4729f5645ffb8c53
TLSH
T100E0ABCADB1AB83AE6859A121C108589A89A0318221900AC8381EA6161D89AE6732D8B
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons Monochrome\48.png
Size 639B
SHA256 bac87bfc14cff248df502005c077fec30abb6b71e4874860b5fbca615d55e06c
MD5 1bdc03ed18a0e29d48da13da101ba676
SHA1 04b1fae9ae2e96cbf6c680e09ae95307c764199a
SHA512 0459c71d7c6b6758f76cce2d8651a6bf052dbe8e4802386fbd0cd75866e5d3dc7bfbe4d55eb4889a3e6a15755cf20591948c84aa3ffc16dbf18e447f1e765c0b
TLSH
T194F0681657963CFB8D90017CE772607ED4B751B62134816623DC5CAD610D459582134D
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons Monochrome\512.png
Size 6KB
SHA256 61348deb0a5da1f8e5cae8f1fb05653fd95c4eadc0c9628dd392afe36bff53b4
MD5 ae9c961523761367f8b19321afd804d8
SHA1 4cd4285023417ed969358f0a1442885658574618
SHA512 30b8972d89e3694b15a530b1fdec38683ab5d0bf0bae3e37c92995b6397b8d497ac789e4b1d1c5cc33281ec4b7a025428393097380e41ca20c47e35dae1869fd
SSDEEP 96:qGPhZydBAJqpBAhc3BJ50l0EHdV8fPWI8XeaYWzI/sL2c28H7fPk:gqkBdRJ50lPdSb8OaYWc/sLXbE
TLSH
T121D13AE3B22FDA41706A53B2CD43CEE1BE539695C745021A29EC567C84800A97CBAF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\128.png
Size 4KB
SHA256 41b1a4ae8496e6638ccb3b0272f2005eab76f90e56d29f48866dab38fc7df8c1
MD5 84f2b6869b9c60a182b77688c26f9838
SHA1 f9f2d89e83e3aed40f3e78ec47a905acebdc37d6
SHA512 c801e4fd6d38f08243ffb0b69e961288cc6ac1e84fdd0163acb16ea59530299784b7e082633942365e561fab41a4813ad335c44470c1c809f2ca066c2556ffb8
SSDEEP 96:o+33PzSQ75aBw18MppNU8AtQR+eQoSBQK73i5Y/1OIAF8Kr3Clbd7e5h7bYJ:o+33PJaBwlppNUFGciLEyaNOIrUkRav4
TLSH
T1D0916EB6691BAC05F9A7ABD7D17942EF0CEBAA80C704CF152C5D166437081E3A3B63D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

144.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\144.png
Size 2KB
SHA256 5dc5e3a8c0c0b0ea564b1c378500077947988315fa64b25f62ebd55253de5659
MD5 8045398ad785fc11c7a9d5a42e0661d1
SHA1 7c9b07ccf79011949524d9e4b7f1908894d6dbec
SHA512 ee6757fc7cda9f0b8aaf085811ec254818a474adb72014b171d08d8bf0413511aff17d579d8cc7948b64462881759a4bf2fcfd58bfaee57249e3805e57aa2a46
TLSH
T18951F98297E55619DE63713A0222C904E962CA34E1A9D7E3247449EDB68C6CE8773445
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\192.png
Size 3KB
SHA256 5e80189d5743f0028efeac0b3df337266d6805a8d1f0f215f5dfb422ea223d4e
MD5 e234001453fc4adc6364522c236465af
SHA1 97d1b03a486084a51ebbd91d7395ea9c2c170daf
SHA512 2a847abcd37b1c94d8524d4bcfa46d38a50efc4d5b979b16aca45ae1c320377e44e1fc23009afa137bb744d4e95c0f998417f85e96aa927fc08de44f7d828fed
TLSH
T11E612A332A8725CDC1B6CBA6473D4C03547E504AA279E54A9EC8ECFC277694053CB7BA
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\256.png
Size 10KB
SHA256 5aec5c9ee2a69c0c3eaf9b23258b18e0c7f1e16f35387bec76061239a8fae04b
MD5 4e6b37b3b74156e6390915cb572bc37e
SHA1 47843dda50e6f2a6396630748b6db2ded41c9463
SHA512 2d913faeb2ac0067308bb845d850bbe2d2d4406069d3841987090bd0c1163d1395be8fd127171640783832efe7f96813ca48e67a0d990a110ab465b068a7366c
SSDEEP 192:ZEEEd4EwKtFFYRHWE+rhfQHQYGdjm0+AqQtmw5NvFgoNriGMkua0SEEE6:w4OFFY1WEUrfdjmnNiaoIxU
TLSH
T1ED22AEB073A1578FE1DFB3CD9F07CD14AC2875A884D7AE96AA95E1E19A08509D00EF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\32.png
Size 1KB
SHA256 bf77e0c65df7ce83532308d1acbf333098e1f4089672b67a9514a56144b1f1d8
MD5 ec856287ecbd2b1742659ffb05190088
SHA1 9c1ddd95b78d8ab154c85c57b5f89e7d7c39c7d5
SHA512 791f2f64ae67bb5798b249f55a966769c2cfccc21388cc17f6a41254649fc7f4c7c61a23fa3ad4920f2fef3e2acffd0ced7f1bb407736a0f1f2cf9c18bef8b4a
TLSH
T1641160C3EAC399B0E9FA232F6BB101B42402E429A7540908D878EC359A24A19A2DC2D1
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\48.png
Size 1KB
SHA256 148a4e02b72a9fd908a6b2fba36bc2f5101c747d0b3167bb29608c9d6d3e643b
MD5 26ef2d3ec2906fb06f431e4ad0f0883f
SHA1 c7f3c3e2abdfc40ff64b1185400ad00dc7db53f3
SHA512 8fadd9090320de5820e5a323c6b0ccca899d062c061945589992827ae26c587c21fed2a3100b70b20e665d1b5d70479ed0efeffda867e37b21f875fea2ab5389
TLSH
T1F0312AF7AA3D5DF02E440562B8CBB798E1248ED9C2677026681F331509DF2900725FC0
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\64.png
Size 2KB
SHA256 1d14c6cc14f6adca1d761b639adac4519b078766ec4d5872f4a4d3384c69162f
MD5 a5938c289204eb6828b69966640ff454
SHA1 169905d2da57cb1b0203df14553323ab45c10f57
SHA512 4c21be815bc7d8466d034e14e14c3a820c4681e9607a76cbdf889ec1b939e4ceecd1e90bf5dac38138fb7c646f35a8445d2306cab3a2c809ab5eaf5172b6e405
TLSH
T143413A2FA615D572D996E085B89C1AD1DC920B2F71F168052E67F401AD29EC938CE842
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2668_206108679\Icons\96.png
Size 3KB
SHA256 aadcc8084bbb970accd15979e1512a992e64f3169a44d911c44100bd63b13e3f
MD5 992c01e537191cb57b74dc0e33b9f30e
SHA1 9aafda8fba4ee601696e0371f32ad78ecaea45e9
SHA512 017a6c48021caf2d270e45292322c976ddc2f78f778d5d0f853deae067820f40b0fa619286c873a988b8395358ebe1a023f23ce6519ec70656c73bf2516d8b5b
TLSH
T13D613CFDC0A5BD2EC13FD5B18EB09544FD10805B76CB434BF89544A67842B690D7E24D
MD5 SHA1 SHA512 TLSH

Submit Download

f98ff7a3-6025-4661-b617-6668e26b115e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f98ff7a3-6025-4661-b617-6668e26b115e.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ade59bca-221f-4f9b-8f3d-3b802d655786.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ade59bca-221f-4f9b-8f3d-3b802d655786.tmp
Size 348KB
SHA256 67f891e21dd72433e851c4dc1f5df702ff58dbdb00fdf91f74ca4958673eba38
MD5 fd971f30249c0a6b4d9706a59ea43060
SHA1 53693abbed524e870d9d2b50f0785a97e6deacb9
SHA512 46a8bbb095192d800aded65ef56fa6afdf55e45a4adf6cf456f666a4ca8d1e581168d02ebba22f05e9e203ee3c524b3ed18697350ac2298c8014294c6a1ddc45
SSDEEP 6144:BAiXXGus8Q7q3/2jBDfCHCm1cB8O+NMTVsUi+903/99mtP+hFD+7t56OD9ZfSApD:OZ+3/A5CHpGaUi60FYhyFSXD9ZfS4D
TLSH
T1937423329E5269D786BD52868C87E651CFD2F8E68002FEC842851B9B500FFCE4617F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56e18fe-4fa4-4fb4-aef4-a132fdd88b67.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e56e18fe-4fa4-4fb4-aef4-a132fdd88b67.tmp
Size 130KB
SHA256 bcba36f802778d430d4d22e56cfab804f72313383715bd1c4f14100ff3f5f466
MD5 41cec36225a895f0ea46638ee6b11214
SHA1 e8a01a7a0058a6decda041efb1159ef7eed10b9b
SHA512 bbaed5a32b778e7ee4ea5cb15ee95d3a6a4fa13452cf06c224793c8335450f079bd886f0529ec5d6ad94ba32f24df94c53863bc57737ed7bb55aad240666cbd7
SSDEEP 3072:UD+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UD+hFD+7t56OD9ZfSApprB
TLSH
T1BFD31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21258ddde9884fed887434ac0f107f62.exe

Path C:\Users\Admin\AppData\Local\Temp\21258ddde9884fed887434ac0f107f62.exe
Size 921KB
SHA256 deaf30953149d0bef45a11bd89f4ef69f77115e50380c7ef3607c37ff4f40a1d
MD5 03c3e9290329eec39c6543006f9ac9f1
SHA1 78e676fc850fb5d4e1c75b813f15b841fdf7705d
SHA512 b2c5b1b060a0349bc92cc5a8b286f149b5cf6b40264e7b613b76c911e4acc6352ed0fdd9d945fae9c025963cae02f3f2cbef8a62bff844764a66481119c6321d
SSDEEP 24576:QCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATg:1F+LL+fIWybB8
TLSH
T13B15239832772A1FCCE72737E5E739A463AE323D0937229D04A5F37D1E415C05726AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-777-0x0000000000390000-0x00000000003D6000-memory.dmp

Download

memory/448-1-0x0000000075562000-0x0000000075564000-memory.dmp

Download

memory/448-0-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Download

memory/448-285-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/448-540-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/448-50-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Download

memory/448-53-0x0000000075562000-0x0000000075564000-memory.dmp

Download

memory/1824-795-0x0000000000E20000-0x0000000000E28000-memory.dmp

Download

memory/2692-761-0x00000000057E0000-0x0000000005D84000-memory.dmp

Download

memory/2692-763-0x0000000005260000-0x000000000526A000-memory.dmp

Download

memory/2692-762-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/2692-760-0x00000000006F0000-0x00000000007A8000-memory.dmp

Download

memory/2964-778-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4664-740-0x0000000000630000-0x000000000066A000-memory.dmp

Download

memory/5728-724-0x000000001AEC0000-0x000000001AFA4000-memory.dmp

Download

memory/5728-723-0x0000000000150000-0x000000000023C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads