c7f78d237bcb6bd8ccb5ca595cd3eafbb5c7f51b294951bf6fbc006e4e10dd8e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 8.3MB
Sample260415-eqv9xaev2k
SHA256 c7f78d237bcb6bd8ccb5ca595cd3eafbb5c7f51b294951bf6fbc006e4e10dd8e
MD5 26975d4320d28d0de3b8712d27904cd7
SHA1 47fccd49ce8923c22395119564e6dcdee00281ae
SHA512 3f7661ce9bca7e024e12a375ba58bd6a86fd577b705c9c1373622cb0e8d0fc25f46b4a5bc68ab74087b104f3d017facca1c63e4a3ebdc841b2711aaf8a1f812f
SSDEEP 98304:D7IwCrv2880E7IwCrv2880bWQtZ/K0tGOFWVRuLftCT:Arv2Xorv2X2WyZ/K0ttYVAAT
TLSH
T1F2965B13F69444A9E0AAC574EE758722AB31BC554BF1E5FF324072D81E72AD07B3831A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
4860	UpdatAuto.exe
4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
4344	UpdatAuto.exe
3704	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
4236	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3984	sc.exe
5540	sc.exe
5920	sc.exe
3224	sc.exe
5832	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2784	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134206997714222023"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
1880	chrome.exe
1880	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
4684	chrmstp.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3124	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4860	UpdatAuto.exe
4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
4344	UpdatAuto.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3184	3124	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	79
PID 3124 wrote to memory of 4860	3124	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	81
PID 4860 wrote to memory of 3548	4860	UpdatAuto.exe	82
PID 3124 wrote to memory of 4828	3124	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 4828 wrote to memory of 5780	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	85
PID 4828 wrote to memory of 4344	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	87
PID 4344 wrote to memory of 2520	4344	UpdatAuto.exe	88
PID 4828 wrote to memory of 3704	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	90
PID 3704 wrote to memory of 4236	3704	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	91
PID 3704 wrote to memory of 3644	3704	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	92
PID 4828 wrote to memory of 5652	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	93
PID 4828 wrote to memory of 5716	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	94
PID 4828 wrote to memory of 3688	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 4828 wrote to memory of 5736	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 4828 wrote to memory of 5936	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	97
PID 4828 wrote to memory of 5104	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	98
PID 4828 wrote to memory of 5932	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	99
PID 4828 wrote to memory of 5832	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	100
PID 4828 wrote to memory of 3224	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	101
PID 4828 wrote to memory of 5920	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	102
PID 4828 wrote to memory of 5540	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	103
PID 4828 wrote to memory of 3984	4828	2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	105
PID 3644 wrote to memory of 2004	3644	chrome.exe	104
PID 3688 wrote to memory of 2044	3688	cmd.exe	118
PID 5652 wrote to memory of 3020	5652	cmd.exe	119
PID 2044 wrote to memory of 1880	2044	net.exe	120
PID 5716 wrote to memory of 3240	5716	cmd.exe	121
PID 5736 wrote to memory of 2156	5736	cmd.exe	122
PID 3020 wrote to memory of 5012	3020	net.exe	123
PID 3240 wrote to memory of 3160	3240	net.exe	124
PID 3644 wrote to memory of 2252	3644	chrome.exe	125
PID 3644 wrote to memory of 2252	3644	chrome.exe	125
PID 3644 wrote to memory of 2784	3644	chrome.exe	126
PID 5932 wrote to memory of 3896	5932	cmd.exe	127
PID 5104 wrote to memory of 3732	5104	cmd.exe	128
PID 2156 wrote to memory of 748	2156	net.exe	129
PID 3644 wrote to memory of 5248	3644	chrome.exe	130
PID 3644 wrote to memory of 5248	3644	chrome.exe	130
PID 3644 wrote to memory of 5864	3644	chrome.exe	131
PID 3644 wrote to memory of 5864	3644	chrome.exe	131
PID 3644 wrote to memory of 5404	3644	chrome.exe	132
PID 3644 wrote to memory of 5404	3644	chrome.exe	132
PID 5936 wrote to memory of 2992	5936	cmd.exe	134
PID 3644 wrote to memory of 2448	3644	chrome.exe	135
PID 3644 wrote to memory of 2448	3644	chrome.exe	135
PID 2992 wrote to memory of 1520	2992	net.exe	137
PID 3732 wrote to memory of 1436	3732	net.exe	138
PID 3896 wrote to memory of 1680	3896	net.exe	139
PID 3644 wrote to memory of 5504	3644	chrome.exe	140
PID 3644 wrote to memory of 5504	3644	chrome.exe	140
PID 3644 wrote to memory of 5908	3644	chrome.exe	142
PID 3644 wrote to memory of 6064	3644	chrome.exe	143
PID 6064 wrote to memory of 1556	6064	chrmstp.exe	145
PID 6064 wrote to memory of 4684	6064	chrmstp.exe	146
PID 4684 wrote to memory of 4788	4684	chrmstp.exe	147
PID 3644 wrote to memory of 1272	3644	chrome.exe	148
PID 3644 wrote to memory of 4400	3644	chrome.exe	149
PID 3644 wrote to memory of 5912	3644	chrome.exe	150
PID 3644 wrote to memory of 1880	3644	chrome.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5780
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
- - C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
      C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff7ed5fb618,0x7ff7ed5fb628,0x7ff7ed5fb638
      4⤵
      Executes dropped EXE
      PID:4236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab4f7c728,0x7ffab4f7c734,0x7ffab4f7c740
        5⤵
        
        PID:2004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,7137263016478737023,6455866666121117712,262144 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1684 /prefetch:2
        5⤵
        
        PID:2252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,5190247258313941340,9644481583421819019,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2228 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,5814034731904071659,11979555717324197074,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2352 /prefetch:13
        5⤵
        
        PID:5248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,10435089022975733105,9745225916842415803,2097152 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:5864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,3261185952242063639,16221566653850944346,2097152 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:5404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,291162232487280593,6158109970780915050,2097152 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:9
        5⤵
        
        PID:2448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4544,i,10585503443769882189,1316723042201938329,2097152 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4520 /prefetch:1
        5⤵
        
        PID:5504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,9670329551607606557,12229881354418734617,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:14
        5⤵
        
        PID:5908
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:6064
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff736d555a0,0x7ff736d555ac,0x7ff736d555b8
        6⤵
        Drops file in Windows directory
        
        PID:1556
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff736d555a0,0x7ff736d555ac,0x7ff736d555b8
        7⤵
        
        PID:4788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,3680165905773199400,5465475142535482460,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5904 /prefetch:14
        5⤵
        
        PID:1272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,8088034783945855616,11698335097537106877,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:4400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,16557320925178957246,16675263606391273636,524288 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5664 /prefetch:14
        5⤵
        
        PID:5912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,11593635661457415288,15631301861552405901,262144 --field-trial-handle=1956,i,10640584954175375799,16445228526978291084,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3732
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5832
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3224
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5540
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.6MB
SHA256 c4e134b5bd67281193045b45449dbb66886c08eac58693ede31f0da02edd9791
MD5 c337ddae42ab722af785ba59b872e645
SHA1 ba723e1ad32eab4ac6d0121293dcc426629c0296
SHA512 3995bb24951f2c4f17947fa80f6ab054af28b4357c9c6f014bb03b1a96854e441f7fe4e4e5ee36a4556262f96b9537eab983fcea7c9c90789c6fcd7f4d4ec3bd
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQT+Pji0Aj:37IwCrv2880Jjo
TLSH
T182C56C12F7508662D467C470A8E6D71AAB317D911B20CAFB6385F35C2E337D2A63532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.6MB
SHA256 ebcdcf75ec55cb1d3168b9f406c7f51a37d0337013769724cecd73f666f0509f
MD5 a0cfe46ff14233796764276e9202fd21
SHA1 d847d1f8ff99740df74b16b4c607d3a2507cd33d
SHA512 b674ce65730e25cc1ca7a8c51827efc353af5b6c75c88fb0b37b3164b6aa029b886eecaf93dd6d7d02a185afbc75f5fbe105baa80c51c2d997abdf19e542f2d4
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/babH/g69dsTh7IwTerPbTO:37IwCrv2880f7IwCrv2880Jjo
TLSH
T1E2267D12F7908962D46AC570B8E5C71BAB31BD911B60C6FB6385F35C2E327D2A63431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.0MB
SHA256 281228fe7db41615bc267ccb1f1a0866a475680de80426261d963f8dc6367bdc
MD5 2a012d9531a6542c1d23981d82a36207
SHA1 d4641cf81adfe01c4a0fe65c174094c2572f9a73
SHA512 b6b0f307551511c90e6f042d6a70aade0dc675e1e3044315f53e6ab8ed77a8eaba0f4cc9fad1748e68a6bacaa046ab63184d2deb1d6ac1ec2aaadb7b414e6276
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTh/ezSC6vUzPvMHjy:37IwCrv2880CezSC6v2XMH
TLSH
T198E55B12F6648623D4B6C075D8E6975ABF317C921B20C9FB1346B35C2E337E2963532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.0MB
SHA256 306a083222c8099e05edee011110d285540109d984d5c9c3420fea7819494596
MD5 7b5a56bebcdf2dc2581ec722d1a7ec65
SHA1 b0f719982f09009abba41e8a5e9e0f505305a1bf
SHA512 29243ce69934dfa0d2a7f8245b2f7c9df0d5e1c9dff24667521a4292dae76e52d00516ca0dcf95d65cef0f10625111d34b336d5ee6bbf518e5adb99c576fcad7
SSDEEP 98304:37IwCrv2880f7IwCrv2880CezSC6v2XMH:Erv2XHrv2Xg
TLSH
T169365C12F7608663D4AAC470A8E6D71ABB317D911B20C9FB6346B35C2E327D1A53532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.7MB
SHA256 285d156b9e328a1fd6b67ca81782cca71f23c0f02d25e57f91793f8fd5a281b3
MD5 d322181510c33afbcae754960f5d92fe
SHA1 6ed7b40110db47f1af0322d6c98feed253a3d8aa
SHA512 cddffd279ef7ac1af4abcda06f7170d1271c2d9dd58a5ae01f5f337c599fb81d3bfced880e3b1347d86109dc0d210dd63b8014b40bf4aeba9543f164d9fd3167
SSDEEP 49152:wabH/yabH/g69dsTh7IwTerPbT28foh0Y1oQTOVO88hXl+:w7IwCrv2880+/h1+
TLSH
T143D56B12F7908562D476C570E8E6D71AAB317C911B20CAFB2346B35C2E737D2A63532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.7MB
SHA256 b925d3a8c03ce21018027c3fb0ddd7dde495138a67d721223bef5faa483a5444
MD5 359e5ce26f8f43c48d5d7e53d9eeffd7
SHA1 cc70b780898f889a51089085044569a67378fe5a
SHA512 3c83381971b925f492677ef055bbf8dddf51eb39fbc59d59bf1debdae55520e97248d4a9a7256a6a90b0609f33925cc102ab6f1afb58b58ea1595e07a9bfe695
SSDEEP 49152:wabH/yabH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/yabH/g69dsTh7IwTerPbTp:w7IwCrv288047IwCrv2880+/h1+
TLSH
T1E1367C12F7908962D46AC570B8E5C71BAB31BD911B60CAFB6345F35C2E327D2A63431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.0MB
SHA256 31cbaebe444ad2fe05944989bb2723be1df953597430bcd6115201bea5726b9d
MD5 28a13e7151ddb746e0e5542b5a359c16
SHA1 754a228b82de64be8f1dcd9e882c092b22c520fe
SHA512 bbfe41966939ea6c0c657baa663d1e91b88422c855699499ffe2eb608f85df7cf80fc40d365940a8079a9c1637e45db7184be10a2ee36d483324b1f791c77699
SSDEEP 49152:wabH/RabH/g69dsTh7IwTerPbT28foh0Y1oQT:d7IwCrv2880
TLSH
T1D2A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 4.0MB
SHA256 488a3d8b59cfbb4a31f3efa77dfb7de2e500bee1eca8ad4f0c25a40cc4d32cc9
MD5 dda6d867bfe58587e2ac9d660b6eea41
SHA1 ed3baa0742b69f4d24ca0305c525904e3bc306d2
SHA512 5d6964618b61736e6a3d6cbd1fdafaef1014343f7f5ea8e4903dc6b1119a633e10cc72fae9544a9d98230d82c676e96b5d3cb06e246217734205d614a027f33f
SSDEEP 49152:wabH/RabH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/RabH/g69dsTh7IwTerPbT0:d7IwCrv2880l7IwCrv2880
TLSH
T1F6167D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 4.2MB
SHA256 f00d263e225d314929820de9e6867eefcecdb358ef046b72eff6de9ba4e16e23
MD5 c5b91ee12ec380255762f35819300198
SHA1 a5b56584cadadd6c1eac985b0a2350e5566298d5
SHA512 d5774d42ba763903e821239eb312c5a6266eda3f68dfad3e15a68efac61be40fbcc657d0d1f50f3da09bfff0c05f1e8c7e271fa3f0221158137e265d9e158769
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/babH/g69dsTh7IwTerPbTA:37IwCrv2880f7IwCrv2880K
TLSH
T18E166C12E7409862D46E8530BAA5C7167B36BDA11B90C6FB6385F36C1F327D1A9B430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.2MB
SHA256 535931e843b4c7c21a411895727a508e18358429332da4ff4e63509a23030675
MD5 ee981e608ffa9303d50bd9592d5e5bce
SHA1 079802b283f58b16f30eb7a00dc33bb5752a5c48
SHA512 763d40aa580281fc9306685acdd9f475a679058c18a180fa787df35d0021a9518bfa4c51d823a7e59cd57a259be976280ccb08ff582d248bb67de2aef578aa17
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTz:37IwCrv2880K
TLSH
T1F9A53912E7409862D46E8530EAA586167B36BDA11BD0C6FB63C5F27C1F327D1A9F430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.1MB
SHA256 383e6e1a0698a30d824596c92f7f6700e6b3574624d3a69c3769b31ca70e1baf
MD5 08d2c1741076117cf07843476b2f288d
SHA1 a8842315d14e460f24e09b2af1a9a341fb25a391
SHA512 ad4aa823951dae67d7a461d9a5800acb6cc3c267235db73b60d142656254b15b7043c6480b2c1a5ae64068fdf7b02bd2f0a77a06a3a81b6d3922e5f2923d4eb0
SSDEEP 49152:wabH/3abH/g69dsTh7IwTerPbT28foh0Y1oQT/:T7IwCrv2880C
TLSH
T1A1A57C12B7809866E86A897078B5C7177B34BDA11B50C6FB7385B34C2E327D1AA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 4.1MB
SHA256 11f252cad7814c25fad28242f30541b2369565b40a20d58b5c8ee82e0cf8762e
MD5 87df301472d20d3ed098c373645684e9
SHA1 03e3119decfd30a06276204d90209874914e2157
SHA512 83a3b06a18219f56187d50e0626afb7048be4882abffb27817e5ef0b0aca9494c680ee7bfd438bb5e9e82cf6a2c58797c17cdc53527be3ca091f0155b81e963a
SSDEEP 49152:wabH/3abH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/3abH/g69dsTh7IwTerPbTo:T7IwCrv2880L7IwCrv2880C
TLSH
T168167C12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.1MB
SHA256 5e5ff41b1dc5b0ad3890c314c4fd0c800905be3851894a813ce36a75e18e149c
MD5 7b8aea4f8cbf0cabe2fc5ea9f6fe960a
SHA1 c9c1b08c9ced66556d3eb959c19e833e9bc11750
SHA512 7e5c871346ca3865702b7d552ba6eddd57b38baeee34c3641c87e20e43b10e7d10603e35a1c0a19d257ee921793db24aa0618fb9d99e920e0a14b61a27d3b7af
SSDEEP 49152:wabH/ZabH/g69dsTh7IwTerPbT28foh0Y1oQT1j:F7IwCrv2880Sj
TLSH
T12BA57D12B7809866D86A897078B5C7177B34BDA11B50C6FB7385B34C2E327D1AA7831F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 4.1MB
SHA256 4769b4d693caf49f8a44d1cdac4e3b4051b7ae8accbd0b21191bbb5cf00c46bd
MD5 56f56776e840cd4313d728649b301c59
SHA1 11a6e15974c736abe0768747ff99261d77b437eb
SHA512 0a5959aa28ffbefd4eb64af851c8c2d15d6830dc2a095320bb2d391d7296f457cf8f3e577dd9be52d3f352f6263ffc320b366749151f07dca06955535ffebce8
SSDEEP 49152:wabH/ZabH/g69dsTh7IwTerPbT28foh0Y1oQTdabH/ZabH/g69dsTh7IwTerPbTe:F7IwCrv288097IwCrv2880Sj
TLSH
T1E4167D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.1MB
SHA256 16bcf20835c9440dae52dd2545dbac107e96397241902e3558b089c72fb3e7af
MD5 24ccbc8dbaff8f251f56d65a6ce0fd7f
SHA1 aa425d8429e508c8d1a566d277b299ff593b189e
SHA512 f62f352b42d7e7d5866dc4304a3d9f2241b76d9caebe040b0ce2f67f701dc592b25ab434edba7634ab5b5cdfa4dc4f4097b52b606d56a34c0cd25144d8b6b569
SSDEEP 49152:wabH/jabH/g69dsTh7IwTerPbT28foh0Y1oQT/D:f7IwCrv2880ID
TLSH
T101A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dc16642704bbd372b6b47bd40a67b3413b4b7662236763e613a05a38e3b945e9
MD5 6c354b71b1035c9a05249154bf2c7eaa
SHA1 818a1522b5415c5dde6731dea3ccdd609647f1b0
SHA512 64495d08931e8c0d7fce3ed657eac2ade85545fba2df0ad2a6fcbebf2cadea317fef84c21734100265a8766cf23f22ade353123805ce79e3170a8a9be5feb6d4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6fe2f88b025dfa9fde9ba62d01c57768e2d8b7a02c529ee5483127a98243f83e
MD5 3f0b315ce66452ee09bb524025015a44
SHA1 0d5b8bba55a29ee9fb7ffa5d566ff6819167182a
SHA512 3049ed8879f393c37e6e0d53ad6c6f290f5d5725a66b7d09f9a3494420e4eabdd3cb4da7c2050b22a65c16582a627fb410262e914ba3c37c826394af26d3b994
TLSH
T1B2E061EAC925DC375CFE071860905796FB54135B2B40551F7A3D820D8FB063F5585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a7439923d81c1594983b4558cc6f84f85532fa616516cc1d9974320fea15aac7
MD5 6a1ddef6de7aa5dfb354aef3ca3d60c2
SHA1 3f831b208afbd6ea6d968ceabcc20425a4e7c960
SHA512 a0751989bac44e7a338a1a67869a8d9d35f41f7a447adee1c33385bb0720d4b4308e2acf146f041cb7cb1a82b5631ce9d7eb881b4810572924dd7377a416bcf0
TLSH
T1D1518CF3D3E4966E851152E4EA246E2FCE6D0A18131C3C6289D4AF4B87F2972D21139F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9e49feec32c77450d3e928e4baddbe9b905af252346e9f5b86e7e1555ea6f65a
MD5 706c62c16cc2303ba78b871b5e4757d2
SHA1 69e84fb664c371c13a6f1b9f2e98a0487ef78e27
SHA512 2f771fb9d52f98f85bee2595909b4dd224dc0a9081bd94f8a9ba022a742ccf4b7f64babfb2ff8883c17ea6ce4a36be33431661bd93e94bfa4e04df52669e2aa1
SSDEEP 384:62RXecbSz0iLv+PbDPVOhmqMPXJzwXiXwAmt2C574w2Gga8ykge:FeatXwCq2WC
TLSH
T18942C92EEA106A3BACDBD61EFA157B53D7F5102129902D44D6FCC62C25EB5CC222712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7238204636c0f52621eb229399afcb0dd42e74a2e926308bb60d414e8bb937b8
MD5 229300507696202f8749ca0eb051c24b
SHA1 23539d8a14d045f68288054a5c8490e9ecb525ad
SHA512 6bc0ca588ee75b0bcbb776f028b96e7aad5e1948a98a2434729f33ad2c7cda7cad335511f69330172ee98183db494634332d1347e0895e8103ac366ca8dfb201
SSDEEP 192:62RXecbSzYd/iLTzv+PbDPVOhmqMPXJLv7Ie9PRp2JWXsb+WNnApst2CByk44euU:62RXecbSz0iLv+PbDPVOhmqMPXJztXDP
TLSH
T16D32C92DEE10B93B6CDBC21EFA157A53D7F5102129941D44D6FC865C25EB5CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe585dbb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe585dbb.TMP
Size 3KB
SHA256 c90d5b5d061944f3aac7eab0b2c4e8593409a36e066600235666ea2ed88d1b1e
MD5 a8d15ae50764f7686199e16dd5086c96
SHA1 cd7aa0906ddc4b21deecced541615545b2ffe774
SHA512 7b41657ff5b4fb31999444289a1c09267d261cffe3a0f6c799921bf5fdbf4517914edd001cc253a4f8eb89e1dd3c8f2325323f786bf522fdf615f5a788a7d686
TLSH
T11061751DC4640DAB0DB67B75792A0783FA50827B25016C573E7E198C0F778664080F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d1e310097de084a556232611163b6f0c01bafe504d56474f3d1f2240e9a7d60c
MD5 582d130f3c7fed2949f8c698c05c317e
SHA1 3a3df6f2edecd7cca76b92ce5087140e67c5c0bc
SHA512 ccb72b1373adf720221f3e32f64b0832a488c84c4a6c98e11c17498386be15bb68ab3d44c6d4993244bc4a899a9bad484a45a483821368ede269a08a48d42544
TLSH
T10CB012908001A505C45B03F41A826C8831749F108B15134293E07D71A8372914024151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5888e2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5888e2.TMP
Size 96B
SHA256 28bcfc66277ddc681553e4eeeb0bc8616cf7f08bff702ffc6f18841b66a10ea6
MD5 f81e2e4f8e820951fc3d990c7a06594e
SHA1 1971079f590fba67e7671227284007fec50f03ad
SHA512 4a86e5297b3f889ed58c014e81080ad945f7359ae003ebd4fc84cf3fd761ef5cd7897dede3fc9700bfa4b10205b89af2dc5931845700fe4fcaca8a03d70cf764
TLSH
T1A9B00255C103B222C04303B129D5BDDA75F6EF29C6471756A2E01EF6EC696B04575560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 8c780f6b02fd637f03b14d028f9a93415c79dd3388fd560056cc5b9e338ec595
MD5 11a81a58e740c6a9e302767a586f68ff
SHA1 abec96f94c40a3d50c1d8c35addb71a16a554132
SHA512 b6e2b02f8f6963c2614bb2f39454366ad47e9ae30c1a64b691d5e83a4301f71138c3eddb5ddf52ee1724b53758c9f7c7260d58b5d3c414f4559465026ff3aaad
SSDEEP 3072:KMCQCAoIqoVX51ZSN3W8kWHwDFHtCmgEb++J3qUQm08KMWF0bFTcVHr6zt:Kp6lVpXSN3KWQDvX++JjcMW2VcVLW
TLSH
T1E11412559C1E2C2693AF976BB00F5CAE4EB384AE966163FC31C2131E05DE7C17257C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 feb7e4571e2bc08816e5fc28ac3292e2892d3ccc64547c13574f165e3f2bb836
MD5 10d4d9fcc88aa8a702348d7cc08b1cec
SHA1 186480f811a5ee56c9faedd129e8902a775101b6
SHA512 7fe6438e1240bfa0a82ea6d9308b38bf5067718da3b1d0a504bd18bf0784951e083b48d2a73e864694a316fcf2fc52708850b27be2e8e6f9e57651a3ce5d9b24
SSDEEP 3072:eAPCQCAoIqoVX51ZSN3W8kWHwDFHtCmgEb++J3qUQm08KMWF0bFTcVHr6zt:eAq6lVpXSN3KWQDvX++JjcMW2VcVLW
TLSH
T14E1412715C0E3C6A93BF969AA00F5DAE0DF2849F9A61B3BC31C2270A04DE7D17657C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8fd32ce181657a53cb8194228d44e3dcffde7c00bbefad1bcdfa2f775c33950a
MD5 e80850245e341c932515741433be46de
SHA1 c22450ece97b3d60c1b1b00c0f79448502b79c04
SHA512 3fb2bf4af9eac9daf65eb72067b8113423fe35ba3d39124cb36bf7355762232b2240d6ab60a062bb5d1fb2fd1f60af628ad4cacec4539d4a108939906d981eb9
SSDEEP 1536:eGgdTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:mL++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1BF9302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E28BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 2738473ceb1f82dc3141b16857abfbd4125eedde94a055e0870aa8fa8dcd3206
MD5 268d6174a22e4fb82623a99cd38e220a
SHA1 0f21bd3b53a1bdf1157f8e6d658e40e5f8439417
SHA512 d498bfdf95d8b472a4c831a3b1900945392e16742dc6108041d096bc5701a477917b845ebecde711218bf64e0885ca15c390c082c667b921fe04d6bf0e2233ad
SSDEEP 3072:bMCQCAoIqoVX51ZSN3W8kWHwDFHtCmgEb++J3qUQm08KMWF0bFTcVHr6zt:bp6lVpXSN3KWQDvX++JjcMW2VcVLW
TLSH
T13F1412559C1E2C2693AF976BF00F5CAE4EB384AE966163FC31C2131A05DE7C17257C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 6.3MB
SHA256 ad256529342553515c6076462f941571be383770529293697a2f61b3c72c91c3
MD5 efafe76cf042095da8ff4a0831c7ac58
SHA1 d5a3baaa6b095dd2aa39e65a08d52c2ed7c28bd9
SHA512 b99ecb20ad94dcc767575a2e807cf40292016966dcf03131fc15a7d9d6fdfc3ec027efd32d9bd1f28a9e9dec7752e633af0b515acb4a12db7c2670270732b015
SSDEEP 98304:D7IwCrv2880bWQtZ/K0tGOFWVRuLftCT:Arv2X2WyZ/K0ttYVAAT
TLSH
T113666C13F6E440A9E0AAD174DE758722AB32BC554BF1E5EF324072D41E72AD07B38716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_26975d4320d28d0de3b8712d27904cd7_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
Size 4.3MB
SHA256 d00b1820bfc76c68cd68ef57c77027fbae39de00f82a0615c2201f05a9a79db0
MD5 ffc92ca23754119f6131903564a063d3
SHA1 5fc09b579d4c02cd6a0879446b67dbfdca8858bf
SHA512 c5d2d0a0e0b8070fd75cec21ab6e351b853d7df56240bde4c2b047036cd78b005d555eaf4a187e30509ca97a3cf8be6abc9db8a5d23256a27a63917f8145752f
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T19A264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.0MB
SHA256 930774c172aaeb7e5dcc369023e4e0065097a55c9779526574498f21ae4f38ac
MD5 f3d1d20897fede758afa94839d56f185
SHA1 d45a47681d0c69030e2571e1fc15cbdd116b3b03
SHA512 b24a1a220b5ebe89e42060ff6002be18c036d1ac846a4c136bb45d5ad4c8b65c95a2775a0d332e058211e528646d288df513fe3b7c663a79574b9ff26a267de2
SSDEEP 49152:wabH/HabH/g69dsTh7IwTerPbT28foh0Y1oQTH:D7IwCrv2880g
TLSH
T154A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 137a899c007e2b66a8ea92cb4baa30b18b263459194684f050bd79eb4405f919
MD5 cb8db3a3a2fbb529db62062bc45d3e5e
SHA1 fbe69ebd1ce6146f3876dfacc1002d1a3d8f375a
SHA512 d99bc57bc8f6196097e05971c6b5bc8c8d9888a930e2872dc469749cfb10b413b15054d327af219da5989380610bcf42646894bf0250641b12b4b5305d1f85fb
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 47ca04da2891c7e55017fd6ea59ca2ee1b3505926194b240f4c73cd9424b2fc5
MD5 9f515fa7c1b8e76e3e7fda5d779b3239
SHA1 16c2a49b9d0163232ef1c9f0645efc3d37fccadd
SHA512 8a8cac0affabf2353550a41ac13789230624cbc46f97e165088d9e08cfd30719195c55c7b93ee2c664e7d23794290f63b7e6f2d99aad21179e3ab43ba3cc9916
SSDEEP 96:ManuExf7iw9i8hK36K3fvBV4BidvHhK2OK2vTX9b1/7/NDpAChK3OK338:juw7R9Wb4UodBp7/rlu8
TLSH
T1E712BFD64E028A6F3B82DFAB325335715D9B200AC7E994F237DB5106F4CEA64012F5B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 a5b63ef198bb8202b011ddbd51cc7b119e7157131462b7f3909f739b51fc7c3b
MD5 593c68e7a9ac72b35f0fc2f076834eef
SHA1 7b6c5865db073a0840629c514618af292caef16f
SHA512 0b02c7c9b038878872e7014324037244410fafd947843d1d8978676517edbcd7827ed2593cb5e041a07f75dcae39fe80974d91ee817837ca3d9e7a831e840a17
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTH:37IwCrv2880g
TLSH
T15BA57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 2330168e46cfe914f3c70554f0f8d90c2767e6d454ca8e5db5c1976b5af724f0
MD5 7c79190994590b9e651a0b79b6fcb06a
SHA1 bd573b481c7c1142392380c13a4b9bcf88760585
SHA512 abece441d3404e0666075e2ba9e2630a43499ed4d243b92033d5fb058e35a8d450fb32642f976c4e239ef5322679fd375ba3b9934a012608c7bc8e993ccced15
SSDEEP 49152:wabH/yabH/g69dsTh7IwTerPbT28foh0Y1oQTH:w7IwCrv2880g
TLSH
T100A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 c8868086a4e32baf1f455985e284e4b2cfffc38f73f39a3330bd4c9d07ca5684
MD5 5820313e1df844581498a2c2d2ccbdd8
SHA1 107befbb1be66131ef48329a31a33a831231431b
SHA512 03a77378366044bc3352af40bb49ef91a1c553ee8054151321659fd26edbee42bd4e18dc80288444051843ee6755a73b937db3c882739fb0daef29a71ed167a1
SSDEEP 49152:wabH/RabH/g69dsTh7IwTerPbT28foh0Y1oQTH:d7IwCrv2880g
TLSH
T1D9A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 3a4033d6e0e9b2898135d5db5db4544b607c76b9cdb2c874ddd174e7d0aa6f5f
MD5 ae6da3a9503d3f745929a4e39a6c5287
SHA1 0fcdc426c61cce9b9874f8119faf021227e6e4b4
SHA512 c74fd736a4b9368ad23a76df56e6d07794b2a07670801f5441b06c0f212ca087dc1c4b97a244f155005b3b28eb1b05a71877f386e93397d6181a1c555bed7670
SSDEEP 49152:wabH/jabH/g69dsTh7IwTerPbT28foh0Y1oQTH:f7IwCrv2880g
TLSH
T1B1A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 6b235fbef672c78a1cdbe89528f47bdc58a75540885e8f144b222b626a27ded2
MD5 d45fa62e87bb1688066556059fc55694
SHA1 a1cfdb07fca7fe2c7dc55151a94479aefc76e85f
SHA512 49bc28d81d4330dc47b4a0a22d04ebcffd4d4b6e0cc293e45bb3fd05b126ed58d5464ef7219e3616ae3299e005ddf2e652240c0c4fc1f076363bbaf52247726d
SSDEEP 49152:wabH/3abH/g69dsTh7IwTerPbT28foh0Y1oQTH:T7IwCrv2880g
TLSH
T174A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 ff643d5342690b66abf4023cac3cebb35c519e3427fd0bf9ad64e36fb8aa88cb
MD5 28089d7201e6cef14ae2fa4e2b93049d
SHA1 726d6dad60ce642c10a46612bfe96ac6942ef9ce
SHA512 cce0c7399ee934072000945f40b89cb67f0eedbe343f2ece350965be5fe4d6bf2f5a656b60cd3fa7610d3292da16dcac58b18e71d1989e0de2c203cec86ace7d
SSDEEP 49152:wabH/jabH/g69dsTh7IwTerPbT28foh0Y1oQTH:f7IwCrv2880g
TLSH
T1A4A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 33d4d35eccfd8eb6907fa0750cfba49a0104cb1298993247d1c5fec818fe622e
MD5 0aad834f88161da73bbb9328060d1cd6
SHA1 93b2ed05274f4357cf219532c31ca0f1a970de1f
SHA512 b3c4d251dd1976a3b16d090b0b816ecc4a6c3f92d5551030f89fdacc5a2c191ca5f9fc0bdac97bd7994a3ac02177bd46a9adf67f553b4a737f0bbf3b11f3184c
SSDEEP 49152:wabH/ZabH/g69dsTh7IwTerPbT28foh0Y1oQTH:F7IwCrv2880g
TLSH
T12EA57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.0MB
SHA256 5b9e1cbafb5d29891b5b1829e8b35fee11374bc5add0dd9f90de598e50082e46
MD5 d8028ed7bd896ee85553168fd04a9ef4
SHA1 da16e6997af7d325e431d36942994c6deb255b13
SHA512 c95bb2f18746bb55660429167089b56d84c8b828048548508abc48ed7f54a1296fc1c18a937ce9fdbd530953d817397287aea10ee78168e3cc57fc7988776fa1
SSDEEP 49152:wabH/babH/g69dsTh7IwTerPbT28foh0Y1oQTH:37IwCrv2880g
TLSH
T176A57D12B7809866E86A897078B5C7176B34BDA11B50C6FB7385B34C2E327D1BA7431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-292-0x0000028004EA0000-0x0000028004EFD000-memory.dmp

Download

memory/3704-64-0x000001DF47510000-0x000001DF4756D000-memory.dmp

Download

memory/4172-92-0x000001BDE8960000-0x000001BDE89BD000-memory.dmp

Download

memory/4236-239-0x0000016B623C0000-0x0000016B6241D000-memory.dmp

Download

memory/4684-151-0x0000027C4BD50000-0x0000027C4BDAD000-memory.dmp

Download

memory/6064-154-0x000001B89FB00000-0x000001B89FB5D000-memory.dmp

Download