0b51dd8f52372814379a28556eaa0c7c4ddae803fb8b69cd15fd24cb1b730573

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 10.6MB
Sample260416-pgb5saev7m
SHA256 0b51dd8f52372814379a28556eaa0c7c4ddae803fb8b69cd15fd24cb1b730573
MD5 227aa8f70e30b034dc2e3aa65e275770
SHA1 58e793bd0fa5f6b39c6afac6ab89e979c84cb80f
SHA512 67494e996db0136b830e7ff2a140375ba2d94ee574cd862f11915ba2c2814306e12522038ebcc62a53d4955b4a7ac435b500958575c8abebe78c93cfcdaf4fe0
SSDEEP 98304:f7Iwu8j0oAaldmdmnpS0oAaldmdmnpRWQtZ/K0tGOFWVRuLftCT:mKmd0BKmd0HWyZ/K0ttYVAAT
TLSH
T1B1B65A03F29944E9E19AD178DE268231EB327C594BF1A5EF328076D52E73AD03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3012	UpdatAuto.exe
3308	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
2136	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\CheckpointReceive.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4352	sc.exe
5200	sc.exe
4172	sc.exe
5168	sc.exe
4364	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208194398151989"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4596	chrome.exe
4596	chrome.exe
4596	chrome.exe
4596	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4596	chrome.exe
4596	chrome.exe
4596	chrome.exe
4596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe
Token: SeShutdownPrivilege	4596	chrome.exe
Token: SeCreatePagefilePrivilege	4596	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4596	chrome.exe
4596	chrome.exe
4596	chrome.exe
408	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3012	UpdatAuto.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 748	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 5184 wrote to memory of 3012	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 3012 wrote to memory of 4376	3012	UpdatAuto.exe	83
PID 5184 wrote to memory of 3308	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 3308 wrote to memory of 2136	3308	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	86
PID 3308 wrote to memory of 4596	3308	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	87
PID 5184 wrote to memory of 4588	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 5184 wrote to memory of 3964	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 4596 wrote to memory of 4276	4596	chrome.exe	90
PID 5184 wrote to memory of 2644	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 5184 wrote to memory of 5780	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 5184 wrote to memory of 5668	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 5184 wrote to memory of 5912	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 5184 wrote to memory of 4788	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 5184 wrote to memory of 5200	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 5184 wrote to memory of 4352	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 5184 wrote to memory of 4364	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 5184 wrote to memory of 5168	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 5184 wrote to memory of 4172	5184	2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 5668 wrote to memory of 4752	5668	cmd.exe	113
PID 2644 wrote to memory of 2428	2644	cmd.exe	114
PID 4588 wrote to memory of 1124	4588	cmd.exe	115
PID 4752 wrote to memory of 1696	4752	net.exe	116
PID 1124 wrote to memory of 3396	1124	net.exe	117
PID 3964 wrote to memory of 2148	3964	cmd.exe	118
PID 2428 wrote to memory of 780	2428	net.exe	119
PID 2148 wrote to memory of 4484	2148	net.exe	120
PID 5780 wrote to memory of 3064	5780	cmd.exe	121
PID 5912 wrote to memory of 2172	5912	cmd.exe	122
PID 3064 wrote to memory of 2388	3064	net.exe	123
PID 2172 wrote to memory of 2020	2172	net.exe	124
PID 4788 wrote to memory of 1628	4788	cmd.exe	125
PID 1628 wrote to memory of 5472	1628	net.exe	126
PID 4596 wrote to memory of 1536	4596	chrome.exe	127
PID 4596 wrote to memory of 1952	4596	chrome.exe	128
PID 4596 wrote to memory of 1952	4596	chrome.exe	128
PID 4596 wrote to memory of 4028	4596	chrome.exe	129
PID 4596 wrote to memory of 4028	4596	chrome.exe	129
PID 4596 wrote to memory of 3228	4596	chrome.exe	130
PID 4596 wrote to memory of 4948	4596	chrome.exe	131
PID 4596 wrote to memory of 3228	4596	chrome.exe	130
PID 4596 wrote to memory of 4948	4596	chrome.exe	131
PID 4596 wrote to memory of 3840	4596	chrome.exe	133
PID 4596 wrote to memory of 3840	4596	chrome.exe	133
PID 4596 wrote to memory of 1664	4596	chrome.exe	135
PID 4596 wrote to memory of 1664	4596	chrome.exe	135
PID 4596 wrote to memory of 4280	4596	chrome.exe	137
PID 4596 wrote to memory of 4820	4596	chrome.exe	138
PID 4820 wrote to memory of 1616	4820	chrmstp.exe	139
PID 4820 wrote to memory of 408	4820	chrmstp.exe	141
PID 408 wrote to memory of 5732	408	chrmstp.exe	142
PID 4596 wrote to memory of 6060	4596	chrome.exe	143
PID 4596 wrote to memory of 5388	4596	chrome.exe	144
PID 4596 wrote to memory of 776	4596	chrome.exe	145
PID 4596 wrote to memory of 4492	4596	chrome.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:748
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff7e0a3b618,0x7ff7e0a3b628,0x7ff7e0a3b638
    3⤵
    - Executes dropped EXE
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0c61c728,0x7ffd0c61c734,0x7ffd0c61c740
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,6581464915302035686,12758143261627589305,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1972 /prefetch:11
      4⤵
      System Time Discovery
      PID:1536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,5471830247458183696,2316691955720984163,262144 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,18191286725986015896,15103674672247560809,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2376 /prefetch:13
      4⤵
      PID:4028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,2416213414712165904,9159704027924535328,2097152 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,8826025005463910727,17576661159027560058,2097152 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,7756758221786691819,2550100275401586014,2097152 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:9
      4⤵
      PID:3840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,7142498314377946343,4243987606341882349,2097152 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,16329840102165120386,5434248959196481257,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x248,0x24c,0x250,0x244,0x220,0x7ff672e255a0,0x7ff672e255ac,0x7ff672e255b8
        5⤵
        Drops file in Windows directory
        
        PID:1616
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:408
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff672e255a0,0x7ff672e255ac,0x7ff672e255b8
        6⤵
        Drops file in Windows directory
        
        PID:5732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,3208240535128842576,16100891278484826545,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7558845646679672302,170815738475857027,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,2642640496837705038,6471186087774926937,524288 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5612,i,6504511980455406214,14569268284511779393,262144 --field-trial-handle=1948,i,3620376323874093984,7647636324261531235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5608 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5200
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5168
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 6.8MB
SHA256 a759b93220351f9a99273927b2006f8216ab764bc54c8c9a45897195794c4fb7
MD5 7e7941dd9a500e33fff0f3e528f49203
SHA1 d87fef0f5e2b5bcbcd1ba47d5bb131eaa1445ba2
SHA512 97184458c5106e270f9205ed0d6d61adfb41363e26cde0a7ea51c48d5a1a406cce7d451e6e15202e2d953a49c4adc20f084133deccbc9b98590d3300714cb1db
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnpLjo:SKmd0BKmd0Jo
TLSH
T10F764903F29445A9D156C174CE46C236EB327C5947F2A6EB3280BAE93E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 7.2MB
SHA256 3fd2b6a13ded3e129e5960858e60886e8aa5907898b7de81e0981e51a2271887
MD5 2e1ed02a7994e8d048adf0f9d779f3e5
SHA1 c777c518dada77eef300f6bde42408026c67b8c0
SHA512 76382dacabba73a25a823e73e9af3317f408a0a176e629e2a9b9fa9d2cedf23b48f36988af5719652f0e5bd52a65ba8223fcad0d78e712c68da96af7ea93066a
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnpEezSC6v2XMH:SKmd0BKmd09
TLSH
T14A765A13F1A445AAD166C074CE86D235EB327C4947F1A6EB3280B6E93E33AD07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 7.0MB
SHA256 7cfd2155126452e9eec618eaa2292b5f8c130204aca7506c65349058c123dda4
MD5 5beb1bab4a6625fd43bb039db67e7bf5
SHA1 5878edd18832e57721152c03528ef09bf45543af
SHA512 b2998b71b7fe2cae93d8244468482c0d42801dab91e0119c4ef65930667dd2cc6e703663adfb7073b6c468f2987e871f3d0e7c893fe3293453deac5b5c2da0a2
SSDEEP 98304:47Iwu8j0oAaldmdmnpS0oAaldmdmnpQ/h1+:LKmd0BKmd0y/h1+
TLSH
T1AE765A13F29445A9D156C174CE46C236EB327C5947F2A6EB3280BAE93E33AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.3MB
SHA256 6fc80f798ef7daa29f496383a4b81f98638b6f5ee8c2f6563b58df17cc42aec8
MD5 9310c9621132b0725bd254f2fe28ef28
SHA1 03068ab9336a166a4bc9225034cd9407b39940c1
SHA512 298c80115ff885fa523c1330e81997547c7638f686ad4465e81690414b436f0c899984ce84cc3a3e26e9ff1ac033053fa5c9274a2a5a1f2a4fea698acd7e75ba
SSDEEP 49152:wabH/MiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2er:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp
TLSH
T16E664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 12.4MB
SHA256 4d491449e194e162ff7eee9092b224741826761dfab5b057795aad5727b100bd
MD5 43b53bf37e7f545f697e807ee7f10d56
SHA1 f80bb08cf8e9887c8b99461ee6a02c7ba418e886
SHA512 fbf3307302c1d1d09abc0ebc7e9c81b4cc3136f6bc8f3bfae3dac2297014f586696ce69c68a2d7b989541e01790220d1a1eb74d089ddbec847ee97842a1cf3e9
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpNQRQyi36YOcP+Lvw2gAf+PN34:GKmd0BKmd0iQyiKaUX+PNo
TLSH
T139D66C03F2A540E9E05AD574CF2992329B317C4E47F1A2EF369476E52E72AD03B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.0MB
SHA256 d40d730d515b1faf4aac19f46d1a60cc0a2ed77194b2b3dff47c931bd36927c4
MD5 437129b7fc6ca370a59a388b550b2c09
SHA1 a4c7bd8057fc5e6a93c0576c5496d4558f29cec0
SHA512 1fc0a2f90262215868d8df2cccbb40fbb0c253e940ebcd91645e0fd6cc2352e711ca990594fb6e2dedd1a5264af667492c672caba8fd72753a43dec4c905330c
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpUthHRc/Q:GKmd0BKmd0CthHf
TLSH
T1A2865A13B2A504E9D05AC135DF468231E7A27C694BF1A6EF328076D62F73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 9.8MB
SHA256 acd56172d10515e7fc09d576a574f5cb1168cb210ae89ffa4cfe5dfae38849ff
MD5 91ee95643a64d2f520eb65b59ff031ca
SHA1 c87826d36306e9b24ff1cc4b9069ce7f4b3c3e22
SHA512 c7e9bc322acd0bc4b1fc7105e33287e5db0c826fa29b6c40d983fa784c8d216beff23bf2a6584675aeeefdfb9a192bf08b83c003898f2038d543b48012d0f7e0
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpLy5112gYy5azzVvf69nLKnhZO:GKmd0BKmd0wLIHuWhs
TLSH
T19CA66A13F29904E9D059C178CF468232EB62BC5A4BF1A6EF268077D52E77AD03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 8.6MB
SHA256 b0666472566ddc46f005a4ec4c11c5e93588b8ef40e1d3a7ad43a1ee9064ba98
MD5 c5c87e68aed5678d4aab96fdeed2951c
SHA1 b07e8d456d4688a61d80f576c4b92242173664b1
SHA512 72f33d06b2415a880204bba649865087efbc63e3f8ec15adc1811a244ad9249da4f64709f0b0ff283a8e47288b0c08a48a76d9dff808d21fa732dee2554c7aa2
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnplu6Jm0xd2d3:GKmd0BKmd066Jm0G
TLSH
T10B965A03F29544E9D05AC174DE468232EB22BC594BF1A6EF3680B6D53E77AE03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 7.9MB
SHA256 494ccf270885f37776a3763831d243ac58d00e44c815e8c385b28a1d8d5c8042
MD5 2f7e20850a2da6793c3cac8ee4ace3aa
SHA1 344ceda5646cb0e7086198726b288fbd6d7e9699
SHA512 7037b07e6eb919d5a2078e55fcf93c20ef478fac83d1be842607769693e88bdafb300b3f463c0454dc69b4a09869569136c632e59ebe50106801deec04db43d2
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnprmifP5R7:GKmd0BKmd0lfPf
TLSH
T189865A03B29544E9D15AC174CE46C232EB227C590BF2A6EF3680BAD53E77AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 8.1MB
SHA256 82296b48c7bc611011da6688e9917b71d9e01c1e3b3c7debfe61986ee9728d44
MD5 c5e43e4aba54100364e2ee59423dbc16
SHA1 5e2cb13244c0d5340afcfc93db67c123a7c51dbd
SHA512 1957f26d93879c1a8fcd311074ba3d55c81103c5d6e4a37af779b1db28e578803d30cf206eae274a30172331e724517f69ecbd0e56ac0d8c85f02bc4d3e33ce8
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnp45dKCi616:GKmd0BKmd0MdKC16
TLSH
T11A866A03F29944E9D19AC174CE568232EB227C594BF1A6EF368076D53E73AE03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 7.7MB
SHA256 2b06761e4f9bb6222c3cd90db783468987d3bb99e37efff21282d2b66bf3b1a9
MD5 9afcae8808dd45f4f3ca89d16a95e4a8
SHA1 ec8cf7982fdff283be53eba78abd0ca8b386c964
SHA512 ecec2e66890a3c37617522617de31d08ee009bf010fc38688be247cc8411a826b49cabb365b357804eb337670198a09ff9463c6030a166968ab7654fadef8a0e
SSDEEP 98304:/7Iwu8j0oAaldmdmnpS0oAaldmdmnplX2iwphX:GKmd0BKmd0f2iw3
TLSH
T120866A03B29544E9D15AC174CE46C232EB227C5947F2A6EF3680BAD63E77AD03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 6.3MB
SHA256 65271652ea0afd66e21455fdc4ca0e99b31a98af1eafbf523770bc40c0c95486
MD5 c700e31a289ac2f9bd44b4d74958b042
SHA1 7f648df02f05fffae84013cde2edd336a8b0a160
SHA512 2fe910f71aeaf7da97ae04dea3b2c4a588f4ecbc7b9450a4403b4cfc1cdf10dfe5f78237fe0ffe3904b162800be64945f2208a4c1689ba9fcb6ed1b12676065a
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2es:77Iwu8j0oAaldmdmnpS0oAaldmdmnpo
TLSH
T1CC664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 6.3MB
SHA256 72eca20395e6345012c9ce74f71da698f4963ad564b99aa7a8512c14d0311f39
MD5 f03bd65d292d54f7d0bead4d521237d9
SHA1 c746a7fcf062e18c71d0cdd7ef77d5dd0a5b326e
SHA512 f1c020d8d4f14e684f682e179ebf86023fa390e3eaa4631d72d79e2cc7f967167d93913586309f9492673f8a515facd584cfee6cba4c16d320a96a097da91d25
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eE:77Iwu8j0oAaldmdmnpS0oAaldmdmnpw
TLSH
T1D5664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 6.3MB
SHA256 4c008356bbb09e606d56a353ce37991da3c18014d89f4cd86dfa58acfd610993
MD5 a3acab4ca12ecbfff6cee1ffc7e9347a
SHA1 f9e62eaf01c95ef042590add8adcc50f12b2b57e
SHA512 4a3be87f227de750e3af5c1813c31e2b2441c8eb2bb89168d23b30134442beee68a73bdadf42f5a3259d5301d32a2a9f3a9ae69d9230a0999ad99984dce16f2b
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eP:77Iwu8j0oAaldmdmnpS0oAaldmdmnp7
TLSH
T123664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 6.4MB
SHA256 058ebceac02f6b89db381199e402a989c45514efc3002600190665394cd8ee18
MD5 f71e8baa4684c76dabfb02ebb8cf9e6c
SHA1 9491730df769439e4f111385c22b63f7a17594c9
SHA512 2a2f9b4510f69ec23630b11884b7464b4f7dcab49f9c9a2474cc4e65796e1d1fb1f75f068b6e03114771a521b62f1d424243edeb3f339829c478f8e51e5a61c6
SSDEEP 49152:wabH/wiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eI:H7Iwu8j0oAaldmdmnpS0oAaldmdmnpU
TLSH
T102663903E29548D9D15AC134DF468231E7227C5D47F2A6EB3280BAE93E73AD03B79716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 6.3MB
SHA256 07dccb5946a816dc04c191dd362e2f99a1c8c6307bc4702f04575310da5037b9
MD5 e9e2f075274b61785334d3321c1a6322
SHA1 dcae7538b57015a5ea924e7359e22cd2c1b27a68
SHA512 7c0116e983222ef73d58f53e8c45cc51b9766eafca37179473bc72033fcce9b709ad50db1197f00796755c46e161062349effe1f9c4903747b96cb16722bb7ef
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eA:77Iwu8j0oAaldmdmnpS0oAaldmdmnpk
TLSH
T176664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 6.4MB
SHA256 30faf60a1f3e784ae6e37e78f2184c3741f3b4af0833979f91651c3ad9f865f6
MD5 9e71d79ba7e759a901824723cda3dff0
SHA1 f86a7473e04c5a04e1ee424742b03125f9d036da
SHA512 df07f4588b567efd6427fa250f99409972452177913812598076de65f3e289d30c96db280ff26ed7612dc71ee64ba2ba62b4b32b899a7c93d35d36637bda90f5
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eG:77Iwu8j0oAaldmdmnpS0oAaldmdmnpQj
TLSH
T178664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 6.4MB
SHA256 b3c5d10237fabf532ae0b3711f09d7379b02d9da70f444f1518b920209b2c48d
MD5 6fefb1c78d4cefd947cbe9e10002227e
SHA1 01e623c30c83301963ad84ad08a200e57287f1ff
SHA512 8f2625a4432d90e0736858ac4b4cda08fac77e475d71e48aaed80aefe63963a94c9b1b560a4ce0f99ed70309f56232deaaafb5caba7379a0bbdbc1c58aa4c6c8
SSDEEP 49152:wabH/4iabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eA:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpCD
TLSH
T1A3664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 308dc6ef39f832081ba9086da11d99c047d34d971c206771c36925dd27fa06cb
MD5 f7aa1e9bd59c99c5ecdfdf29a902249c
SHA1 682e4dc0c37bfa75616ad3586a176b798a23da76
SHA512 e39ed17ea30ae28c0cada3f1742c73fecdb15d6813c625fb54e8877bf8fd57637608cb62dbd5b2abc321de38eafa81b72a03995e83005bccc2f6ab070f5354b3
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f768331898b1215c93f6ae7a66b892839e55fe87443e853895d8501a22b6ac10
MD5 a5ded75d51ec035d29567b9d1fb558fb
SHA1 d795fdafd82af9085a1c04ce60713c7062a3d3e9
SHA512 13f934997aa4dacff1b2514c903676b50167940df25a810c00190c5f003817bb4c303e2100ed352b09eed37e2fb58ae48ec614d30faf6d4268328083b0de7f99
TLSH
T157E0E5ABC821982708FD0B2A60504785FB1003176641894B3B3C810D4FF162A499586C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 82445fdfd8af43dc27405ab71b7f060272b6783d06263fca3a0910c532647ece
MD5 ac4ca6139934c138d7a0a3f1b8875646
SHA1 c6bd16dab62ae38c5f3ba61857e1f90c4d4e15f3
SHA512 42e8c8f7015f327e7a21270bd46438c3842c751b473137b97095cdb8f2255d8b9878c1838e8d282ad232b64fb727a34d1225c290c5eb2e878f8c021e31bb81fe
TLSH
T1F9519DF793E89A6D891197E49B116E2FDE690928031C3C66C9D8AF1B43E2872D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

a137d2a4-27f7-4792-8217-85ed75a3c297.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a137d2a4-27f7-4792-8217-85ed75a3c297.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 08d51c3ff22186920a885cc405d8558b65dfbd58e0d5e8d9b9de98d79b8ea72c
MD5 43c3bc65efc1c17917238d1b1a6cb7db
SHA1 1b83620de9a4a7dc9d60de88ba9fa5c9466d8df5
SHA512 5cd6063555e3c1d08f30bb635d1bb88cee44fb4a9a6bfb2c1b4089c269b77ac7b61b9f8bafbdfb9c9afdd59f965666088e5bc4b2e4d2218ff1e3aca82a58197c
SSDEEP 192:pRf07Y7046Dv7ZqPRpn6tXsb+WNn8E26Y9ykwAiiyIsnAUgraJ:pRf071T7qXoXwf264y2e
TLSH
T19E42D62EA900763B5CDBD729F9127B13DBF6102065902E48E6FCCA2C19EB5CD362701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d7db6c41f0b5564bcec36e84c62572191ba884a638705a910f3763f6e74f37de
MD5 45530a28b11a8acb15193b9c03c05cfb
SHA1 d2018878289c0926349b05c04ae9f8eb839b73bc
SHA512 fe03eecdff6bbc9391d859402f3f24054ae95320b84243924042370eebbe04e7fb1974ea17f486f2ee0b1e25e65e59a5a7e09cb879ca5ca99ea42d0482b9733f
SSDEEP 192:pRf07Y7046Dv7Z9PRp26tXsb+WNn8E2F9ykwAKiyIsnAUgtaJ:pRf071T7bX7Xwf23yE8
TLSH
T13F32D62EA910763B5CDBD32AFD227617DBF6102065952E48E6FCC62C18EB5CC362740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5846c8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5846c8.TMP
Size 3KB
SHA256 197683a0d9df3c2636eb036dc45272b38ad651e2be56f454d72998310418fd74
MD5 8539b16fd7439377ed8bfbd5d6da1a98
SHA1 9e054cd4e165249ecdac78c67e9b1d0d7f7016fe
SHA512 7e227df9d435e62932b3f049aba7e6520ee3983e0b5c9df0d02aec99513c20a51c8ddbfd45970beb09979606085b9d5737fd70e3fae361abfbdd38821bfc4d60
TLSH
T1EC612169C4B44CB34DB2B7A5B92E4781FBA4473F118018057A7D8ACE0FB39275581F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d7348f50b25610e5636d0813f68d172424aafac96c32b572b390789984e009f6
MD5 2448411adc4c122f24b7f74df538404e
SHA1 b80f8526b56047e636313325981c3e707a3f75ea
SHA512 0e88c330c2086cdeacaaf1962fc13b8c331600547efd50cfe2a76229af4d10164086aa2baffba6e33ff85d4575c2eb0159bd10d15a8e38f8b75abdf22943e190
TLSH
T1C8B012548002A991C01312F9258204983914AF50C70B130253E06D719C3A590C015170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5874cd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5874cd.TMP
Size 96B
SHA256 1b367b1651062635972c0b4042ea3a5ed53aa09688db7d6484da1d0e62647613
MD5 56cb611af8374e26e5769e725e671b07
SHA1 7ef59865d212fc75108be36f31aa45906d94c3f8
SHA512 ec0983080e47478d33a3e4c001799cf55af2c84dba508872a68ee153fa79ae24a54730868c9fbe2ffec0a8bab80af8938de49e128d7a65df258d928b95b01e0e
TLSH
T1F0B02202C203E323C00203F03AA0A2F83A20EFAAC303030282F00E22CC30320C0202E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 11210e22b8baa5988c378aaa1d18f89fc7208154b0945fff4e881cb751c9c632
MD5 bcbca9be1c73347a20ff2412932ef271
SHA1 f3ef07882a9bca170cc73ea942c199a6b52b79df
SHA512 ef9ed847cfbb5efda5bdfe73275f587308e4e30d17b1b0c4fc2c130a92b37d983c213f45272ae9a022069848c584d77f771e35c0936c81da46b786e5dc917a28
SSDEEP 3072:IrjowAIa8DA7JEkQ/gtmOCjvcVog4Ixq+f++J3qUQm08KMWF0bFTcVHr6zv:I3owE8k7akQ/ggWpNP++JjcMW2VcVL4
TLSH
T172141275880A78685789A65371138CEE4EE2C8CDA1B8097D30C69BCD11FB3E3771B5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 fab92f8121971f769d03f5d9ed9b32c666862b0670e0352bbb7b7f5dd43e8528
MD5 d8b4229ca00d1ec0fa0878d5210dd427
SHA1 3fd28367fdd24a84478b03957b50a7cd2138f69f
SHA512 a151c9b1faa6dd563ad29f217846bf06a1f1fa4038efde2616dd0493865f767834590312598fa1e53a408517d333a8a28914178273ed5617a238fc404eaf10d1
SSDEEP 3072:0JjowAIa8DA7JEkQ/gtmOCjvcVog4Ixq+f++J3qUQm08KMWF0bFTcVHr6zv:0dowE8k7akQ/ggWpNP++JjcMW2VcVL4
TLSH
T108141275880A7C685B89995B60035CAE0DF2CACEE1B8087D70C56ACD10BF3E37B1B5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8dfe39e44daef1a36e2356fb7fc1bb4970ba75ca45c8e8c5f5cfcc430fea21eb
MD5 d45427a4a3a3d0ba2aca91f8e450cb5b
SHA1 76ff21cd6c86c34777645e3fa8d9833d2e0e16bb
SHA512 7d85f274cbddaf9c10933075d1482c05bd27f48728bd419635c632dd1568711747c20855a1e6d6d7d00c518c2b41b087640f9391f3eb028b144aa2b00dc76d6e
SSDEEP 6144:YIszeXC2WpW0iowE8k7akQ/ggWpNP++JjcMW2VcVL4:YleyrIB1k746pNROMWS
TLSH
T1A7341335881A7C6D5B5D694761038C9A4EF1C9CD90B8067E71CA5FCC10BE3A37B1B6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 bc1f4e37879c79b9eb0ca3084e42c1edad472f91b86c8100846b87a1827d841a
MD5 094a623409af1eec0caea57b80affbb1
SHA1 9495ca41096d2e19a5c3a3277f47cd0f954568f4
SHA512 30b4f80fb1ab26da8340047a72cfbde4328b688a888b892c65fd52aa5593a63b4eddc7b59d9db24809c544f05aaa2b2c83a23a458fbc07789473affcedb60743
SSDEEP 1536:XoP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:+++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1B99312B9991E7C79536BC6A6A0079CAC8CD3DCCD111451BC30CB6F1E14BA3A3A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 8aec45c486c1b487bc230c7555398b967d141c2e52e808894415615352672757
MD5 2655ee62ee42502673d05f5e7b7eb415
SHA1 4c3670da54ab5626569e7cc5e8ad711629af676a
SHA512 3513e29035a8126dabbbade8f51f40f3b6b557b676b32ebd78df798427c2c19918c2d199c7c43669cf6a2dc9b7392323db7023d0049463388679a50080a7a880
SSDEEP 3072:3rjowAIa8DA7JEkQ/gtmOCjvcVog4Ixq+f++J3qUQm08KMWF0bFTcVHr6zv:33owE8k7akQ/ggWpNP++JjcMW2VcVL4
TLSH
T106141275880A78685789A65371138CEE4EE2C8CDA1B8097D30C29BCD11FB3E3771B5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_227aa8f70e30b034dc2e3aa65e275770_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 6.3MB
SHA256 0393ae9051efc9756223c0c59923c3c4ee178b2dcc810fb4b7e105cb7433ef0a
MD5 1071be61650d655b193a770e6602b56a
SHA1 a5c4d3ca76d9cb5e303500504464afe49bf017b0
SHA512 324d314a53fe97f07a138e9ae52d3d06bb10c3854e41fc19aac65c56400663de23993115b789b7fad7870ca15703d8121e0cd688f00457ed606a73b49904bbb1
SSDEEP 49152:wabH/wiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:f7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T1E9664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 17d500511ea2d82cec7d93f6770589626462fddd761a88ddefeda973552ad7ed
MD5 f2f7fdc41991faffcb2b63eb548d436b
SHA1 6540c0e8774f7fa00f82597c837cf704860815a8
SHA512 c54c7be074de4010130504ee6322062e63c081fe06017198c3aa4853087e142b909745b80d946c3a1d411919836fba242cfae3b8265e62b0a78f38d749373782
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 f840655802fe92552b739c917893a149ea29deea2db35ac6e15e011bf089fbd4
MD5 c1f8733e0274191d66f596c38f4f3584
SHA1 8a618c5979784b11ec99267785b98dbfe4bf3f77
SHA512 f7baf927228116ba476d8d968b3ce8b6330472f59d44fc68d5d8128885da26ee4a77654f31a8af063fe68cabda2be53578ed5fa3fb39fd0e02072bfbafd153a9
SSDEEP 192:Pn7QAbPTq3JJeAJPOLOOpsbI//AA1QMZZ1fiA28bqffORETesAftzttVRkJAUv8:Pn7QAbPTq3JJeAJPOLOOpsbI//AA1QMV
TLSH
T17912CFD64E02486F3B82DF2B325375515FAB644BC7E894B237EB5202B0CA965051F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 c52c391ab724ecb8d21a7a41bfd7f7a04eb73123242376e3098ed601770e9b71
MD5 13dfb43d155a75cce20da38b048fc7da
SHA1 aeba72ead99a3a82cbceb7ca1009799897d680fb
SHA512 3ccaffce62968b3d4ed24e73fbcfcc5aef25f4989811ba14074ef82e5a501488abb07822cea47fcd2c8ae90f55b254d6a3f3fbae86968296c004b5f470887241
SSDEEP 49152:wabH/MiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:D7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T12C664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 0d7c6bba323b7fb8f17525649de4963110a0bf1050b78a728bf7a5959ddf0ba4
MD5 5d20637052832013a4a52c691dbb89fc
SHA1 5f9b6980b336b2821a44d72abb70152ab77b7e39
SHA512 b4f80fda0eb9521d506b61c7f55eb2ebfec9f4aeb01e2fbd8c6ecce4fa250742d957e901d97faf19618fbe6d149fb756de7de918ddfdc93fe9ac019b31dc24dd
SSDEEP 49152:wabH/wiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:H7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T130664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 505b72a0902ba882a85bfd1564c382f78c7a8864bc7a53c93a77891492aba411
MD5 2de2fa32a05ced552f4eac2c9e4e2b78
SHA1 b34ad546ea1dcf6e472380c6a41d8697da558147
SHA512 6fe1bf481b7048850f14cb182fbd656f83a0731de6a5c6c259394a7e3dc58631f53bf90b36fb9bd675abe0964f7152ae7a77a8fea39e33cf0ff169f62d9532ec
SSDEEP 49152:wabH/UiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:77Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T1F6664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 3f64085d054b95bb45b80c12326f331290c01122a6caf0c7a1b06fa33541d7c1
MD5 7baefe203e5bc77dca77bf2e726d7de3
SHA1 39338ce80980ea7760d6abd00a0335d30005a781
SHA512 c7baaa38ff5a60506b2cfe7b526f1fe942aaecd52d4fa47d97c2ca7ef2894aa6dc6948dff605525a818ccbdca095bda5a47ca5526ec114d3cc76cea573a327d9
SSDEEP 49152:wabH/4iabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T1AF664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 1baf270fb3bdebfdb4f0a934b9138dbc37a31b698ad084797a0155246e13f332
MD5 83ccf9ce074c63b5e414c71aa80a02f4
SHA1 ee623ff1d4504fcbee0d81fe5cdad158dae76476
SHA512 910525679e001bd3ffa61796536d8a6f911f265f98e95461a4fe29b7c567fe049167b24a087a217c0fa06cb034fddee690abb07e92deb364af16064c513e2c08
SSDEEP 49152:wabH/4iabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:/7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T1B2664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 b60d61aaccc0a1dda4161f60e673d4c9afdca9d6c58b05d281998b03d4738b0f
MD5 edbcb4e357f906b8bb93e61568c257a1
SHA1 50adba1a8c71ec6b254574aa79f705e6d734553e
SHA512 9f7a7d264b73b8b6b8dd390c14734dd5f285b479d95da8c8426ee4498e95314964d53fbea67a7b9f569e7b008f7237643898e71f8b05a9128240e8033043a0c5
SSDEEP 49152:wabH/8iabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:L7Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T163664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.3MB
SHA256 84198a8d2b108cd1790f3473ee8fa0a5a165c5a6bcda93c9d55dff148395d691
MD5 8679b0b0d49ab60c1bc6ed4e1e84735e
SHA1 04c7388cd4b6746fd77c0eaac95fd8efda33e48d
SHA512 ef0cf0443ce496cad9c5d75a917db81e017ef93ab794ff3aa403f5ea2bdc90a63eedd22ec73dd81a6e01ba7129aa74fe328f47edb5504c74660d958525a4f347
SSDEEP 49152:wabH/LiabH/g69dsTh7IwZgGhqF85M+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2eK:47Iwu8j0oAaldmdmnpS0oAaldmdmnpW
TLSH
T192664903A29548E9D15AC174DE46C231EB227C5D47F2A6FB3280BAE53E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-123-0x00000290168B0000-0x00000290168E1000-memory.dmp

Download

memory/1616-224-0x000002A8D51A0000-0x000002A8D51D1000-memory.dmp

Download

memory/2136-175-0x0000023B14200000-0x0000023B14231000-memory.dmp

Download

memory/3308-30-0x000001D3E6710000-0x000001D3E6741000-memory.dmp

Download

memory/4820-127-0x0000017C254F0000-0x0000017C25521000-memory.dmp

Download

memory/5732-225-0x000001CF7E2C0000-0x000001CF7E2F1000-memory.dmp

Download