0d71884d6b2e4078180e9f7b571b56edab8a7b0d3ecade97a3d109ec5ebb894b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 5.9MB
Sample260418-ec89lsfz7x
SHA256 0d71884d6b2e4078180e9f7b571b56edab8a7b0d3ecade97a3d109ec5ebb894b
MD5 8a46794cc5ff2139b55566367c5b7b88
SHA1 40b213b7ae8e52c0982b118b0f8e8bd14675fa9a
SHA512 6370171c8ac84a488d54768e418e312fe50398fcae3b68dde7e0e47c73df6f4cb9ed0f64987ebbaea84f966b14bd634f0688e069c57fd629658be41d3eb54adf
SSDEEP 49152:wabH/8fuM4YXDgOabH/8fuM4YXDg//KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy4e:aygDLygD1WQtZ/K0tGOFWVRuLftCT
TLSH
T17D566C13F2E500E9E06AD178DE758621EB327C554BF1A9DF229072D51E73AD07B38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
1668	UpdatAuto.exe
4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
5048	UpdatAuto.exe
1060	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
4984	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3344	sc.exe
1920	sc.exe
2936	sc.exe
3044	sc.exe
4940	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3284	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209577500920159"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
3112	chrmstp.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4008	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
1668	UpdatAuto.exe
4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
5048	UpdatAuto.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2320	4008	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 4008 wrote to memory of 1668	4008	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 1668 wrote to memory of 1412	1668	UpdatAuto.exe	87
PID 4008 wrote to memory of 4248	4008	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 4248 wrote to memory of 4520	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	90
PID 4248 wrote to memory of 5048	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	92
PID 5048 wrote to memory of 2864	5048	UpdatAuto.exe	93
PID 4248 wrote to memory of 1060	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 1060 wrote to memory of 4984	1060	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	96
PID 1060 wrote to memory of 4900	1060	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	97
PID 4248 wrote to memory of 2616	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	98
PID 4248 wrote to memory of 2316	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	99
PID 4248 wrote to memory of 3604	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	100
PID 4248 wrote to memory of 4724	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	101
PID 4248 wrote to memory of 4576	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	102
PID 4248 wrote to memory of 2664	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	103
PID 4248 wrote to memory of 5024	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	104
PID 4900 wrote to memory of 2128	4900	chrome.exe	105
PID 4248 wrote to memory of 2936	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	106
PID 4248 wrote to memory of 1920	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	107
PID 4248 wrote to memory of 3344	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	108
PID 4248 wrote to memory of 4940	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	109
PID 4248 wrote to memory of 3044	4248	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	110
PID 4724 wrote to memory of 4460	4724	cmd.exe	123
PID 2316 wrote to memory of 1896	2316	cmd.exe	124
PID 4900 wrote to memory of 452	4900	chrome.exe	125
PID 4900 wrote to memory of 452	4900	chrome.exe	125
PID 4900 wrote to memory of 3284	4900	chrome.exe	126
PID 4900 wrote to memory of 3764	4900	chrome.exe	127
PID 4900 wrote to memory of 3764	4900	chrome.exe	127
PID 2664 wrote to memory of 408	2664	cmd.exe	128
PID 1896 wrote to memory of 5060	1896	net.exe	129
PID 4900 wrote to memory of 4796	4900	chrome.exe	130
PID 4900 wrote to memory of 4796	4900	chrome.exe	130
PID 4900 wrote to memory of 732	4900	chrome.exe	131
PID 4900 wrote to memory of 732	4900	chrome.exe	131
PID 4900 wrote to memory of 2368	4900	chrome.exe	133
PID 4900 wrote to memory of 2368	4900	chrome.exe	133
PID 4460 wrote to memory of 2144	4460	net.exe	134
PID 408 wrote to memory of 3716	408	net.exe	135
PID 2616 wrote to memory of 4112	2616	cmd.exe	136
PID 3604 wrote to memory of 5108	3604	cmd.exe	137
PID 4900 wrote to memory of 4836	4900	chrome.exe	138
PID 4900 wrote to memory of 4836	4900	chrome.exe	138
PID 4576 wrote to memory of 2088	4576	cmd.exe	139
PID 5024 wrote to memory of 1848	5024	cmd.exe	140
PID 2088 wrote to memory of 2396	2088	net.exe	141
PID 4112 wrote to memory of 4332	4112	net.exe	142
PID 5108 wrote to memory of 2160	5108	net.exe	143
PID 1848 wrote to memory of 4260	1848	net.exe	144
PID 4900 wrote to memory of 3300	4900	chrome.exe	147
PID 4900 wrote to memory of 4784	4900	chrome.exe	149
PID 4784 wrote to memory of 3012	4784	chrmstp.exe	151
PID 4784 wrote to memory of 3112	4784	chrmstp.exe	152
PID 3112 wrote to memory of 3680	3112	chrmstp.exe	153
PID 4900 wrote to memory of 4120	4900	chrome.exe	162
PID 4900 wrote to memory of 1632	4900	chrome.exe	163
PID 4900 wrote to memory of 3716	4900	chrome.exe	164

C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1412
- C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
- - C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
      C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7f45db618,0x7ff7f45db628,0x7ff7f45db638
      4⤵
      Executes dropped EXE
      PID:4984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff845b7c728,0x7ff845b7c734,0x7ff845b7c740
        5⤵
        
        PID:2128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,13401302523170945308,4311959646891054665,262144 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,11345523937609696289,5879004698868526800,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2348 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,6385561781713620416,14501019677152675236,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2388 /prefetch:8
        5⤵
        
        PID:3764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,9197189383329741994,10648174037073526282,2097152 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3172 /prefetch:1
        5⤵
        
        PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,1347624947990203744,16560217118264610760,2097152 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,13298686884082198766,15243971060109528028,2097152 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4304 /prefetch:2
        5⤵
        
        PID:2368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3924,i,16142350894365951771,1338248721470011454,2097152 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4632 /prefetch:1
        5⤵
        
        PID:4836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,9217823955142728267,16623971989149224307,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        
        PID:3300
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4784
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff602b855a0,0x7ff602b855ac,0x7ff602b855b8
        6⤵
        
        PID:3012
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff602b855a0,0x7ff602b855ac,0x7ff602b855b8
        7⤵
        
        PID:3680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,15073522702664899954,8086276615967540312,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5748 /prefetch:8
        5⤵
        
        PID:4120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,14556949005930236356,7296976735253821268,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:8
        5⤵
        
        PID:1632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,14588432255195191356,5324875736018098704,524288 --field-trial-handle=2004,i,12813712539830118338,6877243242712091512,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5784 /prefetch:8
        5⤵
        
        PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 20c1793557b7761f84df7e00f765f54cdd103dde095ed5d04258236d80369486
MD5 0b9857929671ddba619fd081f243c235
SHA1 3dba1e8f7a6b40da9d16cc24dce810008e694ad2
SHA512 e97a7ea5cdcbf91cb95a4edf074787679bf3e3744265652145d7caed8c6d37f84c737e0a11b32b2d292005c484b17b3f48dd0858e8051243d9c42c2d90be5584
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gp0Le5ji0hmxNrM:wabH/IfuM4YXDgaPji0Aj
TLSH
T18D553A15B6A446A5E473C179C8E1964AEA323C510B30DECF5381B72D2F377D29A39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 d8fe9141b0cf8e82e478ff19386596a740467d74ac62528ee08fa01c4e686cba
MD5 f931f1d47f555e139852044ec3fb55d4
SHA1 c664e9bb6220505b58b2b13b33dec67d8e6eeba1
SHA512 c7bf0ccc9702d5eb8b39b33f7667dd6b6d8639e000e582f149018356a67cfc916fd3bf94323c4d8ba47e71220bb220254acd8b898f0fa40d2272186bbbc234fa
SSDEEP 49152:wabH/IfuM4YXDgxabH/IfuM4YXDgaPji0Aj:WygDYygDXjo
TLSH
T171A55A15B7A405A5E433D579D8A19606EA327C610B30DECF5381B62D2F337D2AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.7MB
SHA256 3a5aca67fad9064f2af64613d2d433886a78f7dddac5b647f3e66aa6af2ada89
MD5 029c72486daf43bc90813f408f60eec3
SHA1 8c5c3c803e6a45313941112cee3a83209af4b0d8
SHA512 982b4dd9225fc8cf21d3b5a8b043b8a7d381d8886539954c3eb294a3ef6cb6bc7ae8ffc68a22a4f028ee277f3abc13088df856d9b27bcba45757da0ff08445cf
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20G7a7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/IfuM4YXDgd/ezSC6vUzPvMHjy
TLSH
T1CE852B15B6B84366D473D079C5E2A659FE323C420B308ADF4346A72C2E377D29A35B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.5MB
SHA256 a882a13f528ad70c0c6b27f07c0aacbeaba68f1901f85f8afe57550f3bc39ed2
MD5 f13aa5c37d744eca8404faf90c6aee85
SHA1 91f6d84afc3e87a5df231e2d5293256fefcf0d85
SHA512 c046584780658edcf718874ca74ff78dfe8f1d52314aea330c3f4cbaff7f1739ff2399fdf47a6da4c3bc23f0929f1c0c6721ae9cf8c6609c0a43c9149ca96f8d
SSDEEP 49152:wabH/IfuM4YXDgxabH/IfuM4YXDgd/ezSC6vUzPvMHjy:WygDYygD4ezSC6v2XMH
TLSH
T1B7C53A15B6B44266E473D179C8E19655FA323C520B308ECF5385B32D2E337D2AA39B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.5MB
SHA256 c65bbe41e12f4a3b6ac8cd804d1fe007d227f1525fb1b6e119b13d572441bb94
MD5 012013b6840f9168ff0a22b0c4f111ae
SHA1 ec41b9ff711ca64ea97f67af3190080b551d72f0
SHA512 b69fe16a5d5be87d2025ebad185a23e747b736fe5c2f961806f6c28177fd0b287aa7a978ad6df2ac0d5e5764ee532782aaf8f765eb46dd57792b9cac357d51d0
SSDEEP 24576:w4R5CIH/71jiGnB9um6c20GNcydWXkgg20GdVbqPb88hv/l+7:wabH/3fuM4YXDgSVO88hXl+
TLSH
T189653B15B6A44265E073C175C8E2965AEA323C510B31CECF5385B72D2E377D2EA39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.3MB
SHA256 3fdf7f9109e489a6d36d68308e07585a3e3b325bb60d10bb65a69e587589f161
MD5 5196398e54504a54ef46a689abf6e29b
SHA1 3c3dbd41f56c1c595470ea8583b085aa6f2948ca
SHA512 06e303f724f2dc348b9f8420b1e951b26eceb1d9dee39a41e126a88effdbab679983f1304bff9c7204a288fd6121c6cfc2489528daec4310f062a919d3916b16
SSDEEP 49152:wabH/3fuM4YXDgxabH/3fuM4YXDgSVO88hXl+:5ygDnygD8/h1+
TLSH
T109B54915B3A441A5E433D579D8A19656EA327C520B30CECF5381B72D2E337D2AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 826KB
SHA256 229543a11fafd4ea2631776d12e2937cfc0835f3059b3f286300d1d70d31465e
MD5 95dd20054fa0892d33c10a1813f38cea
SHA1 4aeda1010beb3f5d35581997e83e9e5631bb9149
SHA512 2898188731f92e740cefb015301101755eef0ff0d4c5bfaf17ef0498a40d6f82783159f472933c508d9c2600a329e18e7f3835ec7a096b737edee5bd7f8917f5
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Gja:wabH/6fuM4YXDg
TLSH
T1F8053A1167E404A5E873D634A8A08516EA32BD610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.6MB
SHA256 e13ac3ed197a48ac39cf586baefcaaaf25d34dcfe180327e3e121e1cf9b5b76c
MD5 8e9f2891018875ce6328500f71dff156
SHA1 62cfd19d0427ffda28da2cbb6ef85680c62f4026
SHA512 9d667c70c139a06826598193a36507f79f0ecf28f464c1c9af7c68b8eaa6294cc3d2db4fd0aa62f1b51f260d1118e618f2ee55e0980646c510ca4ce3ab0579e6
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Go4R5CIH/7AjiGnB9um6c20GNcydWM:wabH/6fuM4YXDgxabH/6fuM4YXDg
TLSH
T14B753A1167E404A5E873D634A8A08516EA32BD610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 a9a3819519c64255ef214cce8df48e231fc453fa79c9b539f5275908de167d75
MD5 f76433602d6380671df5f9bde01a1bdf
SHA1 a91a74cefa3d6205c79644996970c4eda4784d99
SHA512 258a6ac0e5fdbeb7d8ed8e348451a49fcea09c49df2a72ca5ec2e8b52d58a0576fa85b381b6b4aa79e8b9364b6342d17b8d77c96416d3c7df6db7b0bdbe5eda0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 78f5b261ab0b224a41306fc2ba46536aee28b4eb2d8d9e5ff3983f609245ca7b
MD5 a1bd2f29b5a418f8d8b79118ae96dde9
SHA1 5ed912558470adba6c44cf28ce4dd5aba3a14162
SHA512 826c2fb2167a9c3b0cd51a2840b8f233bfb72be487e306f548324b17beef831f2557e8bc9790dda15de96c3c59e14a3657bc40f3ac1ebb1755b8edbbdabda50c
SSDEEP 192:w8m6rO/2seDySDtrDhDlDpDUDpDpDSDMEfzgfMrfg2Aa/DbvjaV/YZx8vkXQXpOy:NpJy2t/1xtYtt2MizuMTvbvjaV/YZx8D
TLSH
T175129FE54E02456F7B82DB2B329321515E9B244BC7E494B23BFF5206B4DEA64042F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 955KB
SHA256 76120402cb0d40e09f59be539001a516957700b30e8602a5e1de890f962d3736
MD5 90aa0562a94d5b6f1e6370695f238634
SHA1 45a71682baa5321ac677a926603af2da13fa1f63
SHA512 84f6dcd50edfaf2c2a2c9d07d2a1091f5bdbf16865f63d94da5912f6c0b5c2ac6097743fedb9aaca886ecc9fc84bd0ccf40596f8843a86482e0c3af0f2682e95
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20GqD:wabH/IfuM4YXDg3
TLSH
T12325F615E39404A5E82E9534DBA08501BA337D610BE09ADF53D0F63D1F326D2AEF9B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 4cec5265a8c18cfd61e5b52f2b50519bf6b4515bec84abd3e36aa71f201f43a4
MD5 76f0a318180c3153424111d617250071
SHA1 33bbd53fdd85a7c3cc2db3217fbce009323c974b
SHA512 ecb4f6d132136067e7a5a4dae5524377da96109436f307deae567a3d27a9b66545058515c4a5ecf2313f640c49c323d41fe2706c9f11a898015c0a3e5c6dfc41
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Go4R5CIH/7ajiGnB9um6c20GNcydWE:wabH/IfuM4YXDgxabH/IfuM4YXDg3
TLSH
T119851715E39404A5E83A9534DAA08501BA337D610BE09EDF53D0F63D1F336D2AEB9B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 868KB
SHA256 9a52e49e58df394d747e2058b38be2c34ccbd0e0fd3df6c4c6e0a0a17ec45b23
MD5 e5a76a77c14759a623b9a31bf5258860
SHA1 06d59500c872cee126f06d7c786a12ec7970afee
SHA512 8137e7fe36d77eabe49c5167528603a7356f9899b3985a65c4def26f8d68b37e1651a6f51e3a4300841a95130d395828e757dfcda2c4bcb0b2eb58d2fc2e3f8a
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20GC:wabH/MfuM4YXDgb
TLSH
T18C15391167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.6MB
SHA256 8933b27201e24ef355937d4d1e4af75f1b6ec67bc0f61bb85ee8eb7ffe794271
MD5 3b839a18d3db8d05e1634f97a62aa976
SHA1 3ef7903630860172fb5c8cdf3ac1736b6d4ad77f
SHA512 95bfb1d60e0be9bf88a24a3dc8c19da6e0265dc85872ef5fa8104e253e8e97e7c2aedea202713b89f38915ed7a4e4fb0fc6bcec44037983ebb7956ce40c68f29
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20Go4R5CIH/7WjiGnB9um6c20GNcydW0:wabH/MfuM4YXDgxabH/MfuM4YXDgb
TLSH
T1E985391167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 876KB
SHA256 f4b0f88928e7c9ad0514e6bfea690e7540c3efff1b6217bdf4105ae4de3cdec4
MD5 10bf247967888022e0a60548ba6455e9
SHA1 356d41fed999c757cead3b0f8de606c31d77fae8
SHA512 e214adf2210828bacea26173c722c11618482622295018fa68853e58861cd782b44e0dc533f21d08004c5f432b00524af229f3591ca7bc66c230a8516c55f773
SSDEEP 24576:w4R5CIH/74jiGnB9um6c20GNcydWXkgg20GSj:wabH/CfuM4YXDgJj
TLSH
T12F15391167E404E9E833967498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.6MB
SHA256 7cbebc00d81f552749409dd2495f0c9e96cb927d52f33c637e5ff04271366be3
MD5 c51b2c9cb343a76023b3e04b0b411ae5
SHA1 b94cebb543ea4cb1a7d13cbd65517f42e4db7b03
SHA512 01d245b4cf526f928e8357acace616715ac44f4c245a8c5c3eed53405796971056879f270c438fcd798b95b42aaf2e8ac571e28a70ebe5ed9b741ecc8bb56467
SSDEEP 24576:w4R5CIH/74jiGnB9um6c20GNcydWXkgg20Go4R5CIH/74jiGnB9um6c20GNcydWK:wabH/CfuM4YXDgxabH/CfuM4YXDgJj
TLSH
T1FD853A1167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 872KB
SHA256 0a12e08c45b44239058ef960fdc5fd3575ca04b80561cbc48d4f5f2faa901111
MD5 28e0edd376c09d9fa4e59030ca641127
SHA1 b867b061569c90dd3fa6f989338c06fa38a3c3cd
SHA512 c3972b2fdbf8cdc9c1cdecc301d4f196c73161dd5db8e040b1e6836ee7dbd55a8f3884efe5c86c2815470dac07abd8bdeecc16b557f9810110de7d2bc4865e1c
SSDEEP 24576:w4R5CIH/7yjiGnB9um6c20GNcydWXkgg20GIjv:wabH/QfuM4YXDgbD
TLSH
T1D515391167E404E9E833967498A18516EA32BD610B60DFDF63D0721E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0e16dbd80606f2bf8550b4cbdf9aeb4167eb83430ef926a3cbfd18c538899472
MD5 96b69267a6ec1aff2f1458f85203bc3c
SHA1 dbc13d2068dccefa2aa317e0f97d8fe48baef7b7
SHA512 1dae3df6661dba8679f3c0c78ea6125af04f0a2721422450b9ae450848164ea1662b0186f683bb086d3370eed2cc3394194d8cc271e0f312e3f156e4dfb3b84b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 74a712ef4e08e3cbb1c4b59c3e898340122a5262bb721adf9b876cbc5994f731
MD5 657367a53365adf907a7ff99ddeab0f7
SHA1 657d551608814c33116a958a15188fd9f940e9f1
SHA512 d19f4a5a8d954d042ba43c401429da02b157e6d5785edc3f4c9d62fa7c897cf96773681e5fa998fa1b96a1a56a676e33b85a2e6afad3b16da43d8bbbd4d18e43
TLSH
T131E02BAAC825DC370CFD0B1972044786E7502B572791581F373C960D8FB073A4982C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 363f5f7e3baa018cd9e634a75fa4b1e2354c8c4a2428cb5f9e3e0961e502ce6d
MD5 1927a648b008771108dde66163fd46e2
SHA1 e8f4b5904e773f537f88a8194c687bc955ebaa18
SHA512 eda7014beacab7d0138a614d05201246e79c76b72461f1607dbc6ab36c5902e3027ae92d6bd43de0263553ddca8ceeebccb854a8d9787ab848eb13a0a7735524
TLSH
T1B35180F793E4967DC91196E49B156E1FCE7E0928031C3C62C9D4AE4B43E29B2E24134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 60de9fd52b7b7e5b2d3bade1957622a4d7190aa901bb4cccc2053cbbbec5a26e
MD5 599fae62b8b3a8c5bb4567cb0e7c1bef
SHA1 f69ad25540fcdef08d15640a81359558c3be1e9e
SHA512 41f498465038654d83950a57c2d265d41f2a985fc44340e87e2ff1490fc6556affc4846bf7847d38fa2eb1a40e8ee87e4dc679d0575c86582693635985532aff
SSDEEP 192:cRQz6e+PIv7l9PRp2bXsb+WNn6u2Pk+Ae+uCVaIiyIsnAUgtaJ:cRQzUU3XwXwH2c+jaaZ8
TLSH
T13B32D62EA910753B1CEBC21AFE257767DBF5106261901E44EAFC9A2C14DB5DC322B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58c762.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58c762.TMP
Size 3KB
SHA256 db0aa9008321d98b143718919c42eceb44e600c18376508fccc471bbb6a38bd5
MD5 3176f41b86eb0cc10ad9499bad05dc50
SHA1 94fad53a6eab038e7a1f2c45d35c8472e2cc06a7
SHA512 3c94af9c8a482d56461c401fa65c957a6d64ce6a063053ce0d24dffc5e2cf61bde97a53fb6eb657860ca98083808f93fe501d8396d44584ea011a0981470e5ca
TLSH
T1736145ADD0944CAB0DF2B731B4290782FA925B3B5140180B7D7F86CD5F725175085F8E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 79ad691fd44079c6b5bd9faa27af00ee4b51db3d1981072107862d0f6e2f01bf
MD5 3416736d087076bf50d3c98280840d03
SHA1 68beae1170c777fda9d3338f7802c72e688fe1eb
SHA512 beef0db290f64183731551f8f15dc010d687b25bab6adc6924bea738d6bd79c5d6e415f53e261444fe25a1c09cac959ce6320afdc41c83926b2659a11380b66a
TLSH
T17AB02208C002E203C00A03F03888C0CC3028CF38CB030203E3E00AA2CC20B200020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cd9458ce6c9a6aeb16d83069e05c9de046b3afd2c100357642fe4bdbc532d094
MD5 488bf61b264f18784ecbf4991c8303be
SHA1 47609c2ee5127b98309826d84d9ca05605564af1
SHA512 9b87cfc9170ff71c2d269fc351121f6fd8bbc5782bd19887a2603d151bd639f37b79ede4863193de23e7f269da013c7eb1f4152599367cfa350db979ff5fd937
TLSH
T16BB012518001E601C00302F52392048E31149F1887051301D3F0A9729D371D04024251
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 dca350acaaa0f27240a7fad6426e25fcd5c877b129d06209d98682352a222e5f
MD5 cc37012505d20361d34678c7ceb65d6e
SHA1 bdad77df1e447f54372edcaf2724ca298630fc76
SHA512 e692a74c9ea6bd1e2bfac9662e62c9f29b39d36417783b50eaa77cdfeca083c02c11eeb7801d2f2688d9bb9f806764ae3077c12d92a2da8dd517f4552f48ea93
SSDEEP 6144:GMy3SiqBS3SSiXT649lrOk0HOGm/SFyEEc:GM+SgUX+4nrOjuGdF2c
TLSH
T1F81423759F079D961C7F2BA37649A009CEA197CFA81DAEDCB0489B8D37482C07F51E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 eec9e63fa9d10d4ef0bd33bb7ca4abdd9a41140f6e7e64f2a49538e29d032e36
MD5 59d3a5c0c8f3ae0ac61081922603d47f
SHA1 46657f51ef4e2f6be16106697b543a7e049c377d
SHA512 ff725330fa7ba5fb67cdb47213ee4d87d5b4d3909a488734850f98a958a51228f5be0beb2cad609de6975a441ec00c031998aa50d8e418c583be5cd5028f577e
SSDEEP 1536:gjcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:63Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T18C9302BA5E2A46E7957E469176AE7809CE13134D705FA8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 81819dc6754c36a56d125a1cb069edf67276a8e0a62fcf286c0f78883d09da1a
MD5 0535ef3285545406d424fec679da4a16
SHA1 a3f82f3abccb1d4b5e9ca264c4d4ae09c49ee90d
SHA512 454ce5c4df85e6880b9fdad7e79a9fad2a1e17b380accf3fc95e3e0dc982f0ff81c45f610e0985ee2bd309e19f72ae35568153c63d76fa55911444d5e8af4a5a
SSDEEP 6144:UMy3SiqBS3SSiXT649lrOk0HOGm/SFyEEc:UM+SgUX+4nrOjuGdF2c
TLSH
T19D142366DF075D961C7F2AA37649B009CE9056CE641E7EECB04897CE37483C13B51E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 7775d222aa03e4604c0194347c8007dff68dc392dbcd176cdf940483d9c79c01
MD5 197f968a89db3b5fc28517982be44d92
SHA1 aca2686b9a5c3d4d5ccd450809bd8312f17b21d2
SHA512 9f8c875598dffa79f9ccfba2f1b3493219613cd3f2dbfff712b1bda8468abe876437b430788b590f8588481434e7c595f905df2c934b771160bbba7e51741563
SSDEEP 6144:DMy3SiqBS3SSiXT649lrOk0HOGm/SFyEEc:DM+SgUX+4nrOjuGdF2c
TLSH
T1B81423759F079DD61C7F2BA37649A009CEA197CFA81DAEDCB0489B8D37482C07B51E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 b6a14b6f6a6b642f11301a723ab4059fd84539596f2aef61538e6fe72b404612
MD5 d69f6085d07189e7dd96ec493f1d177d
SHA1 cd1e9017c051e679f00127ae51330b892493bd7f
SHA512 6f8d532f70380db7cd2529761aeff038cc021c8ba91b0cf461f398d7d80560de70b1513f618acb6da3d98307b78a0ddc1ab99bcbc915ee15984d871fdf74fddf
SSDEEP 6144:RMy3SiqBS3SSiXT649lrOk0HOGm/SFyEEc:RM+SgUX+4nrOjuGdF2c
TLSH
T1F9142366DF075E961C7F2AA37649B009CE9096CE641E7EECB04897CE37483C13B51E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 5.1MB
SHA256 9fe4f1431f2d0d0e543c59911a4908fac645b2a5277cdd56fe5c3b2fd5f44b5e
MD5 6f002aa27b9250e37738bb47a1b1b04f
SHA1 7a8551a7fad62ae5e05b1429a6e768bfc5cbd1a4
SHA512 a49d651d8ac3c29bc3fb9b37219243eef14829ca712a59376530682d6d4396deb7731a7d51c72bcd9789edc41e1c71f35934854099bcb327bcace1be530718ed
SSDEEP 49152:wabH/8fuM4YXDg//KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWV2:aygD1WQtZ/K0tGOFWVRuLftCT
TLSH
T166365B13F2E900E9E06AE278DF3586219B727C5A4BF1A5DF225032D51E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
Size 4.3MB
SHA256 d00b1820bfc76c68cd68ef57c77027fbae39de00f82a0615c2201f05a9a79db0
MD5 ffc92ca23754119f6131903564a063d3
SHA1 5fc09b579d4c02cd6a0879446b67dbfdca8858bf
SHA512 c5d2d0a0e0b8070fd75cec21ab6e351b853d7df56240bde4c2b047036cd78b005d555eaf4a187e30509ca97a3cf8be6abc9db8a5d23256a27a63917f8145752f
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T19A264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 811KB
SHA256 e7efecdb012e197c799ed0193976249ab153f7d4b821dd2babf185571046bcfe
MD5 30cdeb81288f379b282f1014d308e4b4
SHA1 d2ec07744d6677372a30b34511e2bde76ddcc61b
SHA512 54e6d3b249a2165fdd297f38e3f153d24f70c607e1fbbb314f68109a5e91b7b05377cd1ca76634327793cfe0c0cc0299fc1bfae212d05478e3366b6fb494f39e
SSDEEP 24576:w4R5CIH/7mjiGnB9um6c20GNcydWXkgg20Gg:wabH/8fuM4YXDgL
TLSH
T12F053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 777497dd54fa3ea2dabf3ae28aaef937fa1f23db23e8448c5414d4107f070b85
MD5 3a1b94cdb125759f172153bad19cccdb
SHA1 22e4adc8cc959c6beded5e4d37d1bb881470e146
SHA512 960cb73efd16df5bfc08ace909d81b250a5f7a2fcc3b49f1b6f61d251558def8a8e0017aaa940bb41be7be09ad0538a364d07eabf323ceae29dd858d63361c56
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gg:wabH/IfuM4YXDgL
TLSH
T187053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 7faa8638b77beb4a0c1ff506ff7a22090b154c6e17e99bb0b43c80e8cba3d064
MD5 116b760a38b3a4da2a36fbc12abef746
SHA1 adc20a1af1c9bf5b2bb574f226bd267430dcf64b
SHA512 9f2e0a9ed15961f9cd53757f46633c1313185443f6f57c4988f6a89749619910b2bf1ebfeb41e85855c16aa0864b9e3b1ae70df2d0fd6257424644b3693b37aa
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gg:wabH/IfuM4YXDgL
TLSH
T133053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 0d48416aa027063e4dd93c96ab7fadf1e49c7212c6667cd4dc53eabf574b3c70
MD5 685d19646877bad7a60675e21f0d50a4
SHA1 a50aeb7bde5bb3e4a52c1ad192a96b817f07fa67
SHA512 398f19c2abf457b249619e3f2be6eade372a629f5f09c557982003fa294d57a32e0167aead7f1791beed984c168ede36ec6a83cc972be67de5ac8178599a56fb
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Gg:wabH/6fuM4YXDgL
TLSH
T132053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 08bbac944fd5a079cc76e35ed9b92c26f16d0086ffffa64cbb53e0c7262b7f80
MD5 a5031c839ac5a7fba27155ccdb7171b4
SHA1 fd52cc2994b2f07d88a5b0faf1fd5633a6e2042c
SHA512 5798eff8453cf7e88014955a8a26b0621276d26885d544b448c356c3b117fc8067dd5bbe397bfd84bd922ce339759a902dedb6f0bea0811d56144f12ca373f13
SSDEEP 24576:w4R5CIH/7yjiGnB9um6c20GNcydWXkgg20Gg:wabH/QfuM4YXDgL
TLSH
T196053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 e75045d582ece31fd391582c47d57aebab0f644579346d1438a7d9251fc264e5
MD5 46f6278d8e29f0090ab5a962b4ca3268
SHA1 5311be8a971534811e51d0f8174dff5e37733570
SHA512 312a3bb35edc071d861ba952e0353a6ee39e506d34aca0e1cc5dc922bd1ac789aa118d2d578d624b3fe135ddfd16cb601e6dbf4bdaab51c5609c1917661cf9b3
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20Gg:wabH/MfuM4YXDgL
TLSH
T1F8053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 6392d238bcef104fc6829ca74785345a5a1ee63456fdedfcb389ecc8f0235688
MD5 5a77cf38306edace9ffceedf71e4950d
SHA1 0bc8d1214e60cdf591114a32b4dc00e60ba01198
SHA512 db94a37dae2997a0df727aea2c2559eb0eb638c55275c29ec5787aa64ed6b665bd3ce37336591eb9b91c879d08f8b57186db5445d021dd96a2dd8412c0b8d89d
SSDEEP 24576:w4R5CIH/7cjiGnB9um6c20GNcydWXkgg20Gg:wabH/OfuM4YXDgL
TLSH
T1E0053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 af34a0c1dbfe34b07180fb75cb9840a45b732731ac691954e1f2d692ab390286
MD5 93c769bcf731e0a5cbcb3f5f63e02886
SHA1 e9adaf72dc96bb8805022757467a8c49f7415097
SHA512 19498b305d6e498090e191c3dff3604ac83c764a9226067f03ee475a37f97ba016c9d16286b9f8abbf533f2b357d1c130c9ab292f60079f86f294b19487556d4
SSDEEP 24576:w4R5CIH/74jiGnB9um6c20GNcydWXkgg20Gg:wabH/CfuM4YXDgL
TLSH
T13B053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 5eff2ad2249618966ba58110e20fce81989afcaeea7eb82c4b9aa54196f7503e
MD5 362c91e6d403f47feb8b597544cbec41
SHA1 28c36b76776ce5eb33262f8c86b5a02bd3490cc4
SHA512 dd02e6f174aaf536ccac2dbe56ec53082fd0c1616078900bb5b16f87db0f658c432f2a75352dcab3252b795ee715db58755452247a2f7bd44b29a8f1ee532114
SSDEEP 24576:w4R5CIH/71jiGnB9um6c20GNcydWXkgg20Gg:wabH/3fuM4YXDgL
TLSH
T1CA053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-111-0x000001D3BC920000-0x000001D3BC975000-memory.dmp

Download

memory/1060-78-0x000001AB02CB0000-0x000001AB02D05000-memory.dmp

Download

memory/1668-204-0x0000000000770000-0x00000000007E5000-memory.dmp

Download

memory/3012-308-0x00000278154A0000-0x00000278154F5000-memory.dmp

Download

memory/3112-188-0x000001A678570000-0x000001A6785C5000-memory.dmp

Download

memory/3680-309-0x00000260AB770000-0x00000260AB7C5000-memory.dmp

Download

memory/4008-152-0x0000000000870000-0x00000000008E5000-memory.dmp

Download

memory/4248-234-0x0000000000780000-0x00000000007F5000-memory.dmp

Download

memory/4784-192-0x00000295B7880000-0x00000295B78D5000-memory.dmp

Download

memory/4984-261-0x000001DB6F810000-0x000001DB6F865000-memory.dmp

Download

memory/5048-244-0x00000000004B0000-0x0000000000525000-memory.dmp

Download